@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/release-publish.job.impl.js

@@ -0,0 +1,295 @@
+import { CapabilityError, CaughtFailureSchema, settle, valueFreeFailure, } from "@vibesdotdev/kernel";
+import { getVibesClient } from "@vibesdotdev/kernel/client";
+import { ReleasePublishJobOutputSchema, RegistryPutStatusSchema, } from "../../../schemas/release-jobs.js";
+import { resolveRuntimeExecution } from "../../shared/runtime-execution.js";
+import { resolveTokenFromSecrets } from "./registry-credentials.js";
+import { createPlatformRegistryClient } from "./platform-registry.js";
+import { GRANT_READ_LAG_RETRY_DELAYS_MS, RegistryGrantReadLagError } from "./managed-lease.js";
+import { ManagedPublishLeasePendingError } from "./platform-registry.js";
+import { publishPackage, ReleasePublishRetryRequested } from "./publish-package.js";
+import { RELEASE_PUBLISH_JOB_ID } from "./release-jobs.consumer.plugin.js";
+const TRANSIENT_PUBLISH_RETRIES = 3;
+const TRANSIENT_PUBLISH_BASE_DELAY_MS = 2_000;
+const RELEASE_JOB_TIMEOUT_MS = 45 * 60_000;
+function uiForJob(events) {
+    const report = (level, message) => {
+        void events?.emit("release-output", { level, message });
+    };
+    return {
+        info: (message) => report("info", message),
+        warn: (message) => report("warn", message),
+        log: (message) => report("log", message),
+    };
+}
+function cancellationFailure(signal, cause) {
+    if (cause) {
+        return new CapabilityError("Registry publish job was cancelled.", "CANCELLED", { reason: "job-cancelled", cause: valueFreeFailure(cause) });
+    }
+    if (signal.reason instanceof Error)
+        return signal.reason;
+    if (signal.reason !== undefined) {
+        return new CapabilityError("Registry publish job was cancelled.", "CANCELLED", {
+            reason: "job-cancelled",
+            cause: valueFreeFailure(CaughtFailureSchema.parse(signal.reason)),
+        });
+    }
+    return new CapabilityError("Registry publish job was cancelled.", "CANCELLED", { reason: "job-cancelled" });
+}
+function executionForJob(execution, signal) {
+    if (!signal)
+        return execution;
+    const stop = (child) => Promise.resolve(child.kill("SIGTERM"));
+    const spawnForJob = async (options) => {
+        if (signal.aborted)
+            throw cancellationFailure(signal);
+        const child = await execution.spawn(options);
+        if (signal.aborted) {
+            await stop(child);
+            throw cancellationFailure(signal);
+        }
+        let rejectStopFailure = () => { };
+        const stopFailure = new Promise((_resolve, reject) => {
+            rejectStopFailure = (reason) => reject(reason);
+        });
+        const exited = Promise.race([child.exited, stopFailure]).then((result) => {
+            signal.removeEventListener("abort", onAbort);
+            if (signal.aborted)
+                throw cancellationFailure(signal);
+            return result;
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            throw error;
+        });
+        const onAbort = () => {
+            signal.removeEventListener("abort", onAbort);
+            void stop(child).then(undefined, rejectStopFailure);
+        };
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener("abort", onAbort, { once: true });
+        const processHandle = {
+            pid: child.pid,
+            stdout: child.stdout,
+            stderr: child.stderr,
+            stdin: child.stdin,
+            exited,
+            kill: (killSignal) => child.kill(killSignal),
+        };
+        if (child.unref)
+            processHandle.unref = child.unref.bind(child);
+        return processHandle;
+    };
+    const wrappedExecution = {
+        id: execution.id,
+        descriptor: execution.descriptor,
+        environmentId: execution.environmentId,
+        execute: (options) => execution.execute(options),
+        spawn: spawnForJob,
+        kill: (pid, killSignal) => execution.kill(pid, killSignal),
+        listSpawnedProcesses: () => execution.listSpawnedProcesses(),
+        session: (options) => execution.session(options),
+        resolveCommand: (command, options) => execution.resolveCommand(command, options),
+        getCapabilities: () => execution.getCapabilities(),
+        healthCheck: () => execution.healthCheck(),
+    };
+    if (execution.executeRestricted) {
+        wrappedExecution.executeRestricted = execution.executeRestricted.bind(execution);
+    }
+    return wrappedExecution;
+}
+function continuationFor(input, failure) {
+    if (failure instanceof ReleasePublishRetryRequested) {
+        if (failure.reason === "transient") {
+            if (input.retry.transientRetries >= TRANSIENT_PUBLISH_RETRIES)
+                return undefined;
+            const retry = {
+                ...input.retry,
+                attempts: input.retry.attempts + 1,
+                transientRetries: input.retry.transientRetries + 1,
+            };
+            const delayMs = TRANSIENT_PUBLISH_BASE_DELAY_MS * 2 ** input.retry.transientRetries;
+            return {
+                retry,
+                delayMs,
+                message: `transient publish failure for ${input.sealedArtifact.name}@${input.version}; retrying in ${delayMs}ms (${retry.transientRetries}/${TRANSIENT_PUBLISH_RETRIES}).`,
+            };
+        }
+        if (input.retry.rateLimitRetries >= input.rateLimitRetries)
+            return undefined;
+        const retry = {
+            ...input.retry,
+            attempts: input.retry.attempts + 1,
+            rateLimitRetries: input.retry.rateLimitRetries + 1,
+        };
+        return {
+            retry,
+            delayMs: input.rateLimitDelayMs,
+            message: `npm rate-limited ${input.sealedArtifact.name}@${input.version}; retrying in ${input.rateLimitDelayMs}ms (${retry.rateLimitRetries}/${input.rateLimitRetries}).`,
+        };
+    }
+    if (failure instanceof ManagedPublishLeasePendingError) {
+        return {
+            retry: { ...input.retry, leasePolls: input.retry.leasePolls + 1 },
+            delayMs: failure.retryAfterMs,
+            message: `Waiting to publish ${input.sealedArtifact.name}@${input.version}; retrying in ${Math.round(failure.retryAfterMs / 1000)}s.`,
+        };
+    }
+    if (failure instanceof RegistryGrantReadLagError) {
+        const delayMs = GRANT_READ_LAG_RETRY_DELAYS_MS[input.retry.grantReadLagAttempt];
+        if (delayMs === undefined)
+            return undefined;
+        return {
+            retry: { ...input.retry, grantReadLagAttempt: input.retry.grantReadLagAttempt + 1 },
+            delayMs,
+            message: `Waiting for Registry grants to become visible for ${input.sealedArtifact.name}@${input.version}; retrying in ${delayMs}ms.`,
+        };
+    }
+    return undefined;
+}
+function failureOf(failure) {
+    if (failure instanceof ReleasePublishRetryRequested)
+        return failure.failure;
+    if (failure instanceof RegistryGrantReadLagError) {
+        return CaughtFailureSchema.parse(failure.refusal);
+    }
+    return failure;
+}
+function failureOutput(input, failure) {
+    const failedAttempt = failure instanceof ReleasePublishRetryRequested ? 1 : 0;
+    const cause = failureOf(failure);
+    const registryStatus = cause instanceof CapabilityError && cause.reason === "registry-put-failed"
+        ? RegistryPutStatusSchema.safeParse(cause.details?.status)
+        : undefined;
+    return ReleasePublishJobOutputSchema.parse({
+        status: "failed",
+        name: input.sealedArtifact.name,
+        version: input.version,
+        attempts: input.retry.attempts + failedAttempt,
+        failure: valueFreeFailure(cause),
+        registryStatus: registryStatus?.success ? registryStatus.data : undefined,
+    });
+}
+export default class ReleasePublishJob {
+    descriptor;
+    context;
+    id = RELEASE_PUBLISH_JOB_ID;
+    type = "default";
+    isolation = "inline";
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+    }
+    async handle(job) {
+        const input = job.data;
+        if (input.retry.publishDelayPending && input.publishDelayMs > 0) {
+            return this.continue(job, input, {
+                retry: { ...input.retry, publishDelayPending: false },
+                delayMs: input.publishDelayMs,
+                message: `Waiting ${input.publishDelayMs}ms before the next npm publish attempt.`,
+            });
+        }
+        const otp = input.otpSecret
+            ? await this.resolveOtp(input.otpSecret.key)
+            : undefined;
+        const execution = executionForJob(await resolveRuntimeExecution(this.context.runtime), job.signal);
+        const outcome = await settle(() => publishPackage({
+            platformRegistry: createPlatformRegistryClient(this.context.runtime, job.signal),
+            packageDir: input.packageDir,
+            workspaceRoot: input.workspaceRoot,
+            registry: input.registry,
+            scope: input.scope,
+            tag: input.tag,
+            otp,
+            provenance: input.provenance,
+            dryRun: false,
+            resolveToken: input.tokenSecret ? () => this.resolvePublishToken(input) : undefined,
+            rateLimitRetries: input.rateLimitRetries,
+            rateLimitDelayMs: input.rateLimitDelayMs,
+            retry: input.retry,
+            signal: job.signal,
+            park: job.park,
+            ui: uiForJob(job.events),
+            versions: new Map(),
+            execution,
+            runtime: this.context.runtime,
+            quiet: input.quiet,
+            managedLease: input.managedLease,
+            authorityVerify: input.authorityVerify,
+            artifactDir: input.artifactDir,
+            workspaceProvenance: input.workspaceProvenance,
+            expectedGitHead: input.expectedGitHead,
+            releaseWorkspace: input.releaseWorkspace,
+            publishTargets: input.publishTargets,
+            sealedArtifact: input.sealedArtifact,
+            version: input.version,
+        }));
+        if (outcome.ok) {
+            return { status: "published", result: outcome.value };
+        }
+        const failure = outcome.cause;
+        if (job.signal?.aborted) {
+            throw cancellationFailure(job.signal, failureOf(failure));
+        }
+        const continuation = continuationFor(input, failure);
+        if (continuation) {
+            return this.continue(job, input, continuation);
+        }
+        return failureOutput(input, failure);
+    }
+    async resolveOtp(key) {
+        const result = await this.context.runtime.resolveCredential({ source: "secret", key });
+        if (!result.ok) {
+            throw new Error(result.error.message, { cause: result.error });
+        }
+        return result.value;
+    }
+    async resolvePublishToken(input) {
+        const reference = input.tokenSecret;
+        if (!reference)
+            throw new Error("A publish token reference is required.");
+        const resolved = await resolveTokenFromSecrets(this.context.runtime, reference.key, {
+            environment: reference.environment,
+            backend: reference.backend,
+        });
+        if (!resolved.value) {
+            throw new CapabilityError(`Missing ${reference.key} in ${resolved.environment}/${resolved.tier}.`, "AUTH_REQUIRED", { reason: "credential-not-set" });
+        }
+        return resolved.value;
+    }
+    async continue(job, input, continuation) {
+        if (!job.park) {
+            throw new CapabilityError("Release continuation requires Workers park support.", "UNAVAILABLE", { reason: "release-continuation-park-unavailable" });
+        }
+        const workers = await getVibesClient("workers", this.context.runtime);
+        const continuationIndex = input.retry.continuationCount + 1;
+        const retry = {
+            ...continuation.retry,
+            continuationCount: continuationIndex,
+        };
+        const receipt = await workers.startJob(RELEASE_PUBLISH_JOB_ID, { ...input, retry }, {
+            signal: job.signal,
+            jobId: `${input.runId}:${continuationIndex}`,
+            dispatch: { delayMs: continuation.delayMs },
+            metadata: { release: "infra-deploy", continuation: continuationIndex },
+        });
+        await job.events?.emit("release-output", {
+            level: "warn",
+            message: continuation.message,
+        });
+        const output = ReleasePublishJobOutputSchema.parse(await job.park(() => workers.completeJob(receipt, {
+            signal: job.signal,
+            cancelOnAbort: true,
+            timeoutMs: RELEASE_JOB_TIMEOUT_MS,
+        })));
+        const continuationMessages = output.continuationMessages ?? [];
+        for (const message of continuationMessages) {
+            await job.events?.emit("release-output", { level: "warn", message });
+        }
+        return {
+            ...output,
+            continuationMessages: [continuation.message, ...continuationMessages],
+        };
+    }
+}
+//# sourceMappingURL=release-publish.job.impl.js.map

package/dist/cli/npm/publish/release-publish.job.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-publish.job.impl.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-publish.job.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,MAAM,EACN,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAC9C,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAQ3C,SAAS,QAAQ,CAAC,MAA6D;IAC7E,MAAM,MAAM,GAAG,CAAC,KAA8B,EAAE,OAAe,EAAQ,EAAE;QACvE,KAAK,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1C,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1C,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC;AAID,SAAS,mBAAmB,CAC1B,MAAmB,EACnB,KAAqB;IAErB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,eAAe,CACxB,qCAAqC,EACrC,WAAW,EACX,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,YAAY,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,IAAI,eAAe,CACxB,qCAAqC,EACrC,WAAW,EACX;YACE,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAClE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CACxB,qCAAqC,EACrC,WAAW,EACX,EAAE,MAAM,EAAE,eAAe,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,SAA2B,EAC3B,MAAoB;IAEpB,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAoB,EAAiB,EAAE,CACnD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAEzC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAqB,EAA0B,EAAE;QAC1E,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,iBAAiB,GAA4B,GAAG,EAAE,GAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YAC1D,iBAAiB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAC3D,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC;QAChB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;;YACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,aAAa,GAAkB;YACnC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM;YACN,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;SAC7C,CAAC;QACF,IAAI,KAAK,CAAC,KAAK;YAAE,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAqB;QACzC,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QAC1D,oBAAoB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,oBAAoB,EAAE;QAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;QAChF,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE;QAClD,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC;IACF,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,gBAAgB,CAAC,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CACtB,KAA6B,EAC7B,OAA8B;IAE9B,IAAI,OAAO,YAAY,4BAA4B,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,IAAI,yBAAyB;gBAAE,OAAO,SAAS,CAAC;YAChF,MAAM,KAAK,GAAG;gBACZ,GAAG,KAAK,CAAC,KAAK;gBACd,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC;gBAClC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC;aACnD,CAAC;YACF,MAAM,OAAO,GAAG,+BAA+B,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACpF,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,OAAO,EAAE,iCAAiC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,iBAAiB,OAAO,OAAO,KAAK,CAAC,gBAAgB,IAAI,yBAAyB,IAAI;aAC3K,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QAC7E,MAAM,KAAK,GAAG;YACZ,GAAG,KAAK,CAAC,KAAK;YACd,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC;YAClC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC;SACnD,CAAC;QACF,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,OAAO,EAAE,oBAAoB,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,gBAAgB,OAAO,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,IAAI;SAC1K,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,YAAY,+BAA+B,EAAE,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE;YACjE,OAAO,EAAE,OAAO,CAAC,YAAY;YAC7B,OAAO,EAAE,sBAAsB,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI;SACtI,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,YAAY,yBAAyB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,EAAE;YACnF,OAAO;YACP,OAAO,EAAE,qDAAqD,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,iBAAiB,OAAO,KAAK;SACtI,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,OAA8B;IAC/C,IAAI,OAAO,YAAY,4BAA4B;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5E,IAAI,OAAO,YAAY,yBAAyB,EAAE,CAAC;QACjD,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CACpB,KAA6B,EAC7B,OAA8B;IAE9B,MAAM,aAAa,GAAG,OAAO,YAAY,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,cAAc,GAAG,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB;QAC/F,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,6BAA6B,CAAC,KAAK,CAAC;QACzC,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,aAAa;QAC9C,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAChC,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,iBAAiB;IAMzB;IACQ;IANV,EAAE,GAAG,sBAAsB,CAAC;IAC5B,IAAI,GAAG,SAAkB,CAAC;IAC1B,SAAS,GAAG,QAAiB,CAAC;IAEvC,YACW,UAAyB,EACjB,OAAkC;QAD1C,eAAU,GAAV,UAAU,CAAe;QACjB,YAAO,GAAP,OAAO,CAA2B;IAClD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,GAAgD;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC;QACvB,IAAI,KAAK,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE;gBAC/B,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE;gBACrD,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,OAAO,EAAE,WAAW,KAAK,CAAC,cAAc,yCAAyC;aAClF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS;YACzB,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,eAAe,CAC/B,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EACnD,GAAG,CAAC,MAAM,CACX,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC;YAChD,gBAAgB,EAAE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC;YAChF,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG;YACH,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK;YACb,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACxB,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAA6B;QAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,EAAE;YAClF,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,WAAW,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,GAAG,EACvE,eAAe,EACf,EAAE,MAAM,EAAE,oBAAoB,EAAE,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAgD,EAChD,KAA6B,EAC7B,YAA+B;QAE/B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CACvB,qDAAqD,EACrD,aAAa,EACb,EAAE,MAAM,EAAE,uCAAuC,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAgB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrF,MAAM,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,GAAG,YAAY,CAAC,KAAK;YACrB,iBAAiB,EAAE,iBAAiB;SACrC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CACpC,sBAAsB,EACtB,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EACnB;YACE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;YAC5C,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE;YAC3C,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE;SACvE,CACF,CAAC;QACF,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACvC,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CACrE,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,sBAAsB;SAClC,CAAC,CACH,CAAC,CAAC;QACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;QAC/D,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,oBAAoB,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,oBAAoB,CAAC;SACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/cli/npm/publish/release-workspace.d.ts

@@ -0,0 +1,95 @@
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RegistryForgeSourceIdentity, RegistryReleaseBuildPackage } from "./types.ts";
+/**
+ * The sealed release workspace (contract v2): exact sources, build closure,
+ * publish outputs and the committed lock.
+ */
+export type ManagedRegistryReleaseWorkspace = {
+    contractVersion: 2;
+    sources: Array<{
+        repositoryId: string;
+        cloneUrl: string;
+        sha: string;
+    }>;
+    buildPackages: Array<{
+        sourceRepositoryId: string;
+        directory: string;
+        packageName: string;
+        version: string;
+    }>;
+    packages: Array<{
+        sourceRepositoryId: string;
+        directory: string;
+        packageName: string;
+        version: string;
+    }>;
+    lock: {
+        source: {
+            repositoryId: string;
+            cloneUrl: string;
+            sha: string;
+        };
+        workspaceManifestPath: string;
+        workspaceManifestSha256: string;
+        lockfilePath: string;
+        lockfileSha256: string;
+        sourceCheckouts: Array<{
+            sourceRepositoryId: string;
+            directory: string;
+        }>;
+    };
+};
+/** The legacy (v1) wire form, which has no build closure. */
+export type ManagedRegistryReleaseWorkspaceV1Wire = Omit<ManagedRegistryReleaseWorkspace, "contractVersion" | "buildPackages"> & {
+    contractVersion?: 1;
+    buildPackages?: never;
+};
+/** Either wire form of the release workspace. */
+export type ManagedRegistryReleaseWorkspaceWire = ManagedRegistryReleaseWorkspace | ManagedRegistryReleaseWorkspaceV1Wire;
+/** One publish output of the release workspace. */
+export type ManagedRegistryReleasePackage = ManagedRegistryReleaseWorkspace["packages"][number];
+/**
+ * Explicit rollout projection. The v1 wire carries no `buildPackages` array at
+ * all, so what it can and cannot represent is a question about *sets*, never
+ * about array order: `buildPackages` is emitted in dependency-first build order
+ * while `packages` is emitted in publish order, and those legitimately differ
+ * for the same release. V1 remains available only when the build closure and
+ * the publish set hold the same package identities. A split set cannot be
+ * represented by v1, so it fails closed until both durable consumers support v2.
+ */
+export declare function projectManagedRegistryReleaseWorkspaceWire(workspace: ManagedRegistryReleaseWorkspace, contractVersion: 1 | 2, options?: {
+    configPath?: string;
+}): ManagedRegistryReleaseWorkspaceWire;
+/** The default sealed release workspace manifest. */
+export declare const DEFAULT_REGISTRY_RELEASE_MANIFEST = "release/registry/package.json";
+/**
+ * Throw unless the committed release manifest is private and declares every
+ * build-closure package as an exact workspace.
+ */
+export declare function assertManagedRegistryReleaseWorkspaceManifest(options: {
+    workspaceRoot: string;
+    buildPackages: readonly RegistryReleaseBuildPackage[];
+    manifest: unknown;
+    runtime: ChildEnvRuntime;
+}): Promise<void>;
+/**
+ * Project the dependency-first source build plan into the exact multi-source
+ * Forge workspace. Publish outputs remain a separate Registry plan. No bytes
+ * are copied here: every source and the Bun lock are addressed by canonical SSH
+ * repository identity plus immutable commit.
+ */
+export declare function buildManagedRegistryReleaseWorkspace(options: {
+    workspaceRoot: string;
+    buildPackages: readonly RegistryReleaseBuildPackage[];
+    packages: readonly RegistryReleaseBuildPackage[];
+    buildPackageOrder: readonly string[];
+    expectedGitHeads: ReadonlyMap<string, string>;
+    lockSource: RegistryForgeSourceIdentity;
+    lockGitHead: string;
+    workspaceManifestSha256: string;
+    lockfileSha256: string;
+    workspaceManifestPath?: string;
+    lockfilePath?: string;
+    runtime: ChildEnvRuntime;
+}): Promise<ManagedRegistryReleaseWorkspace>;
+//# sourceMappingURL=release-workspace.d.ts.map

package/dist/cli/npm/publish/release-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-workspace.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-workspace.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,eAAe,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,aAAa,EAAE,KAAK,CAAC;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,kBAAkB,EAAE,MAAM,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,IAAI,EAAE;QACJ,MAAM,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QAChE,qBAAqB,EAAE,MAAM,CAAC;QAC9B,uBAAuB,EAAE,MAAM,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,KAAK,CAAC;YAAE,kBAAkB,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC3E,CAAC;CACH,CAAC;AACF,6DAA6D;AAC7D,MAAM,MAAM,qCAAqC,GAAG,IAAI,CACtD,+BAA+B,EAC/B,iBAAiB,GAAG,eAAe,CACpC,GAAG;IACF,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC;CACvB,CAAC;AACF,iDAAiD;AACjD,MAAM,MAAM,mCAAmC,GAC7C,+BAA+B,GAAG,qCAAqC,CAAC;AAC1E,mDAAmD;AACnD,MAAM,MAAM,6BAA6B,GACvC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AA0BtD;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CACxD,SAAS,EAAE,+BAA+B,EAC1C,eAAe,EAAE,CAAC,GAAG,CAAC,EACtB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,mCAAmC,CA2BrC;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,kCAAkC,CAAC;AAEjF;;;GAGG;AACH,wBAAsB,6CAA6C,CAAC,OAAO,EAAE;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkGhB;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CAAC,OAAO,EAAE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACtD,QAAQ,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACjD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,UAAU,EAAE,2BAA2B,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CA6I3C"}

package/dist/cli/npm/publish/release-workspace.js

@@ -0,0 +1,243 @@
+/**
+ * The sealed release workspace: the exact sources, lock and outputs a managed
+ * Registry release builds from, and its projection onto the release wire.
+ */
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { z } from "zod/v4";
+import { canonicalForgeRepositoryIdentity } from "./forge-source-identity.js";
+function managedRegistryReleasePackageIdentity(entry) {
+    return JSON.stringify([
+        entry.sourceRepositoryId,
+        entry.directory,
+        entry.packageName,
+        entry.version,
+    ]);
+}
+/** Members of `left` whose exact identity is absent from `right`, named for an error. */
+function managedRegistryReleasePackagesMissingFrom(left, right) {
+    const present = new Set(right.map(managedRegistryReleasePackageIdentity));
+    return left
+        .filter((entry) => !present.has(managedRegistryReleasePackageIdentity(entry)))
+        .map((entry) => `${entry.packageName}@${entry.version}`);
+}
+/**
+ * Explicit rollout projection. The v1 wire carries no `buildPackages` array at
+ * all, so what it can and cannot represent is a question about *sets*, never
+ * about array order: `buildPackages` is emitted in dependency-first build order
+ * while `packages` is emitted in publish order, and those legitimately differ
+ * for the same release. V1 remains available only when the build closure and
+ * the publish set hold the same package identities. A split set cannot be
+ * represented by v1, so it fails closed until both durable consumers support v2.
+ */
+export function projectManagedRegistryReleaseWorkspaceWire(workspace, contractVersion, options) {
+    if (contractVersion === 2)
+        return workspace;
+    const buildOnly = managedRegistryReleasePackagesMissingFrom(workspace.buildPackages, workspace.packages);
+    if (buildOnly.length > 0) {
+        const configPath = options?.configPath ?? "the workspace root package.json";
+        throw new Error(`Registry release contract v1 cannot represent build-only packages (${buildOnly.join(", ")}); set "vibes": { "release": { "contractVersion": 2 } } in ${configPath}, or pass --release-contract-version 2 (contract v2 requires Platform and release-worker support)`);
+    }
+    const publishOnly = managedRegistryReleasePackagesMissingFrom(workspace.packages, workspace.buildPackages);
+    if (publishOnly.length > 0) {
+        throw new Error(`Registry release publish set escapes the build closure (${publishOnly.join(", ")}); the release workspace is malformed`);
+    }
+    const { contractVersion: _contractVersion, buildPackages: _buildPackages, ...legacy } = workspace;
+    return legacy;
+}
+/** The default sealed release workspace manifest. */
+export const DEFAULT_REGISTRY_RELEASE_MANIFEST = "release/registry/package.json";
+/**
+ * Throw unless the committed release manifest is private and declares every
+ * build-closure package as an exact workspace.
+ */
+export async function assertManagedRegistryReleaseWorkspaceManifest(options) {
+    const paths = await getRuntimePath(options.runtime);
+    const record = z.record(z.string(), z.unknown()).safeParse(options.manifest);
+    if (!record.success || Array.isArray(options.manifest)) {
+        throw new Error("Registry release workspace manifest must be an object");
+    }
+    const privacy = z.object({ private: z.literal(true) }).safeParse(record.data);
+    if (!privacy.success) {
+        throw new Error("Registry release workspace manifest must be private");
+    }
+    const workspaces = z
+        .object({ workspaces: z.array(z.string()) })
+        .safeParse(record.data);
+    if (!workspaces.success ||
+        new Set(workspaces.data.workspaces).size !== workspaces.data.workspaces.length) {
+        throw new Error("Registry release workspace manifest must declare unique exact workspace paths");
+    }
+    const declared = workspaces.data.workspaces;
+    const expected = options.buildPackages.map((buildPackage) => {
+        const directory = paths
+            .relative(options.workspaceRoot, buildPackage.packageDir)
+            .replaceAll("\\", "/");
+        if (!directory ||
+            directory === "." ||
+            directory === ".." ||
+            directory.startsWith("../") ||
+            directory.startsWith("..\\") ||
+            paths.isAbsolute(directory)) {
+            throw new Error(`Registry release build package escapes lock workspace: ${buildPackage.name}`);
+        }
+        return directory;
+    });
+    const vibesField = z.object({ vibes: z.unknown().optional() }).safeParse(record.data);
+    const vibes = vibesField.success ? vibesField.data.vibes : undefined;
+    let installOnly = [];
+    if (vibes !== undefined) {
+        const vibesObject = z
+            .object({ releaseInstallOnlyWorkspaces: z.unknown().optional() })
+            .safeParse(vibes);
+        const listed = vibesObject.success
+            ? vibesObject.data.releaseInstallOnlyWorkspaces
+            : undefined;
+        if (listed !== undefined) {
+            const entries = z.array(z.string()).safeParse(listed);
+            if (!entries.success || new Set(entries.data).size !== entries.data.length) {
+                throw new Error("Registry release workspace install-only inputs must declare unique exact workspace paths");
+            }
+            installOnly = entries.data;
+        }
+    }
+    const expectedSet = new Set(expected);
+    for (const directory of installOnly) {
+        const absolute = paths.resolve(options.workspaceRoot, directory);
+        const position = paths
+            .relative(options.workspaceRoot, absolute)
+            .replaceAll("\\", "/");
+        if (expectedSet.has(position))
+            continue;
+        if (!position ||
+            position === "." ||
+            position === ".." ||
+            position.startsWith("../") ||
+            position.startsWith("..\\") ||
+            paths.isAbsolute(position)) {
+            throw new Error(`Registry release install-only workspace is not a distinct exact input: ${directory}`);
+        }
+    }
+    const declaredSet = new Set(declared);
+    if (declaredSet.size !== declared.length) {
+        throw new Error("Registry release workspace manifest must declare unique exact workspace paths");
+    }
+    // Install membership is the manifest's attestation; the build closure is a
+    // computed subset of it. Any declared workspace outside the closure and the
+    // explicit install-only list is implicitly install-only for this run — a
+    // subset publish must not require re-attesting the whole universe by hand.
+    const missingFromManifest = expected.filter((directory) => !declaredSet.has(directory));
+    if (missingFromManifest.length > 0) {
+        throw new Error(`Registry release workspace manifest is missing source build closure packages: ${missingFromManifest.join(", ")}`);
+    }
+}
+/**
+ * Project the dependency-first source build plan into the exact multi-source
+ * Forge workspace. Publish outputs remain a separate Registry plan. No bytes
+ * are copied here: every source and the Bun lock are addressed by canonical SSH
+ * repository identity plus immutable commit.
+ */
+export async function buildManagedRegistryReleaseWorkspace(options) {
+    const paths = await getRuntimePath(options.runtime);
+    if (!/^[0-9a-f]{40}$/i.test(options.lockGitHead)) {
+        throw new Error("Registry release lock source requires an exact 40-hex commit");
+    }
+    if (!/^[0-9a-f]{64}$/i.test(options.lockfileSha256)) {
+        throw new Error("Registry release lockfile requires an exact SHA-256 digest");
+    }
+    if (!/^[0-9a-f]{64}$/i.test(options.workspaceManifestSha256)) {
+        throw new Error("Registry release workspace manifest requires an exact SHA-256 digest");
+    }
+    const sourcesByRoot = new Map();
+    for (const buildPackage of options.buildPackages) {
+        const gitHead = options.expectedGitHeads.get(buildPackage.sourceRoot);
+        if (!gitHead) {
+            throw new Error(`Registry release snapshot is missing for ${buildPackage.name}`);
+        }
+        const source = {
+            repositoryId: buildPackage.workspaceProvenance.repositoryId,
+            cloneUrl: canonicalForgeRepositoryIdentity(buildPackage.workspaceProvenance.repository).repository,
+            sha: gitHead,
+        };
+        const prior = sourcesByRoot.get(buildPackage.sourceRoot);
+        if (prior && JSON.stringify(prior) !== JSON.stringify(source)) {
+            throw new Error(`Registry release source identity disagrees within ${buildPackage.sourceRoot}`);
+        }
+        sourcesByRoot.set(buildPackage.sourceRoot, source);
+    }
+    const sourceEntries = [...sourcesByRoot.entries()].sort(([left], [right]) => left.localeCompare(right));
+    const buildPackageByName = new Map(options.buildPackages.map((buildPackage) => [
+        buildPackage.name,
+        buildPackage,
+    ]));
+    if (options.buildPackageOrder.length !== options.buildPackages.length ||
+        new Set(options.buildPackageOrder).size !== options.buildPackages.length ||
+        options.buildPackageOrder.some((name) => !buildPackageByName.has(name))) {
+        throw new Error("Registry release build order must name every build package exactly once");
+    }
+    const publishPackageNames = new Set();
+    for (const publishPackage of options.packages) {
+        if (publishPackageNames.has(publishPackage.name)) {
+            throw new Error("Registry release publish packages must name each output exactly once");
+        }
+        publishPackageNames.add(publishPackage.name);
+        const buildPackage = buildPackageByName.get(publishPackage.name);
+        if (!buildPackage ||
+            buildPackage.version !== publishPackage.version ||
+            buildPackage.packageDir !== publishPackage.packageDir ||
+            buildPackage.sourceRoot !== publishPackage.sourceRoot ||
+            JSON.stringify(buildPackage.workspaceProvenance) !==
+                JSON.stringify(publishPackage.workspaceProvenance)) {
+            throw new Error(`Registry release publish package must be an exact member of the build closure: ${publishPackage.name}`);
+        }
+    }
+    const sourceCheckouts = sourceEntries.map(([sourceRoot, source]) => {
+        const directory = paths
+            .relative(options.workspaceRoot, sourceRoot)
+            .replaceAll("\\", "/");
+        if (directory === ".." ||
+            directory.startsWith("../") ||
+            directory.startsWith("..\\") ||
+            paths.isAbsolute(directory)) {
+            throw new Error(`Registry release package source must be nested in lock workspace: ${sourceRoot}`);
+        }
+        return {
+            sourceRepositoryId: source.repositoryId,
+            directory: !directory || directory === "." ? "." : directory,
+        };
+    });
+    const rootSourceGitHead = options.expectedGitHeads.get(options.workspaceRoot);
+    if (rootSourceGitHead && rootSourceGitHead !== options.lockGitHead) {
+        throw new Error("Registry release root lock must use the verified package source snapshot");
+    }
+    return {
+        contractVersion: 2,
+        sources: sourceEntries.map(([, source]) => source),
+        buildPackages: options.buildPackageOrder
+            .map((name) => buildPackageByName.get(name))
+            .map((buildPackage) => ({
+            sourceRepositoryId: buildPackage.workspaceProvenance.repositoryId,
+            directory: buildPackage.workspaceProvenance.directory,
+            packageName: buildPackage.name,
+            version: buildPackage.version,
+        })),
+        packages: options.packages.map((publishPackage) => ({
+            sourceRepositoryId: publishPackage.workspaceProvenance.repositoryId,
+            directory: publishPackage.workspaceProvenance.directory,
+            packageName: publishPackage.name,
+            version: publishPackage.version,
+        })),
+        lock: {
+            source: {
+                repositoryId: options.lockSource.repositoryId,
+                cloneUrl: canonicalForgeRepositoryIdentity(options.lockSource.repository).repository,
+                sha: options.lockGitHead,
+            },
+            workspaceManifestPath: options.workspaceManifestPath ?? DEFAULT_REGISTRY_RELEASE_MANIFEST,
+            workspaceManifestSha256: options.workspaceManifestSha256.toLowerCase(),
+            lockfilePath: options.lockfilePath ?? "release/registry/bun.lock",
+            lockfileSha256: options.lockfileSha256.toLowerCase(),
+            sourceCheckouts,
+        },
+    };
+}
+//# sourceMappingURL=release-workspace.js.map