@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/release-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-workspace.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-workspace.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAiD9E,SAAS,qCAAqC,CAC5C,KAAoC;IAEpC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,kBAAkB;QACxB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,SAAS,yCAAyC,CAChD,IAA8C,EAC9C,KAA+C;IAE/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI;SACR,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC,CACtE;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CACxD,SAA0C,EAC1C,eAAsB,EACtB,OAAiC;IAEjC,IAAI,eAAe,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,SAAS,GAAG,yCAAyC,CACzD,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,QAAQ,CACnB,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,iCAAiC,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,sEAAsE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,8DAA8D,UAAU,mGAAmG,CACtQ,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,yCAAyC,CAC3D,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,aAAa,CACxB,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2DAA2D,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CACzH,CAAC;IACJ,CAAC;IACD,MAAM,EACJ,eAAe,EAAE,gBAAgB,EACjC,aAAa,EAAE,cAAc,EAC7B,GAAG,MAAM,EACV,GAAG,SAAS,CAAC;IACd,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,iCAAiC,GAAG,+BAA+B,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6CAA6C,CAAC,OAKnE;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC;SACjB,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;SAC3C,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IACE,CAAC,UAAU,CAAC,OAAO;QACnB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAC9E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,KAAK;aACpB,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,UAAU,CAAC;aACxD,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,IACE,CAAC,SAAS;YACV,SAAS,KAAK,GAAG;YACjB,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YAC3B,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,YAAY,CAAC,IAAI,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,CAAC;aAClB,MAAM,CAAC,EAAE,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;aAChE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO;YAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,4BAA4B;YAC/C,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;YACJ,CAAC;YACD,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK;aACnB,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;aACzC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxC,IACE,CAAC,QAAQ;YACT,QAAQ,KAAK,GAAG;YAChB,QAAQ,KAAK,IAAI;YACjB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAC1B,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0EAA0E,SAAS,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CACzC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAC3C,CAAC;IACF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,iFAAiF,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,OAa1D;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IACJ,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4CAA4C,YAAY,CAAC,IAAI,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG;YACb,YAAY,EAAE,YAAY,CAAC,mBAAmB,CAAC,YAAY;YAC3D,QAAQ,EAAE,gCAAgC,CACxC,YAAY,CAAC,mBAAmB,CAAC,UAAU,CAC5C,CAAC,UAAU;YACZ,GAAG,EAAE,OAAO;SACb,CAAC;QACF,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,qDAAqD,YAAY,CAAC,UAAU,EAAE,CAC/E,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1C,YAAY,CAAC,IAAI;QACjB,YAAY;KACb,CAAC,CACH,CAAC;IACF,IACE,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,MAAM;QACjE,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC,MAAM;QACxE,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,MAAM,cAAc,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACjE,IACE,CAAC,YAAY;YACb,YAAY,CAAC,OAAO,KAAK,cAAc,CAAC,OAAO;YAC/C,YAAY,CAAC,UAAU,KAAK,cAAc,CAAC,UAAU;YACrD,YAAY,CAAC,UAAU,KAAK,cAAc,CAAC,UAAU;YACrD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,mBAAmB,CAAC;gBAC9C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kFAAkF,cAAc,CAAC,IAAI,EAAE,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,KAAK;aACpB,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;aAC3C,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,IACE,SAAS,KAAK,IAAI;YAClB,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YAC3B,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,UAAU,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,kBAAkB,EAAE,MAAM,CAAC,YAAY;YACvC,SAAS,EAAE,CAAC,SAAS,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9E,IAAI,iBAAiB,IAAI,iBAAiB,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;QAClD,aAAa,EAAE,OAAO,CAAC,iBAAiB;aACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;aAC5C,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACtB,kBAAkB,EAAE,YAAY,CAAC,mBAAmB,CAAC,YAAY;YACjE,SAAS,EAAE,YAAY,CAAC,mBAAmB,CAAC,SAAS;YACrD,WAAW,EAAE,YAAY,CAAC,IAAI;YAC9B,OAAO,EAAE,YAAY,CAAC,OAAO;SAC9B,CAAC,CAAC;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAClD,kBAAkB,EAAE,cAAc,CAAC,mBAAmB,CAAC,YAAY;YACnE,SAAS,EAAE,cAAc,CAAC,mBAAmB,CAAC,SAAS;YACvD,WAAW,EAAE,cAAc,CAAC,IAAI;YAChC,OAAO,EAAE,cAAc,CAAC,OAAO;SAChC,CAAC,CAAC;QACH,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;gBAC7C,QAAQ,EAAE,gCAAgC,CACxC,OAAO,CAAC,UAAU,CAAC,UAAU,CAC9B,CAAC,UAAU;gBACZ,GAAG,EAAE,OAAO,CAAC,WAAW;aACzB;YACD,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,IAAI,iCAAiC;YACpE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,CAAC,WAAW,EAAE;YACtE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,2BAA2B;YACjE,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE;YACpD,eAAe;SAChB;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/npm/publish/sensitive-temp.d.ts

@@ -0,0 +1,90 @@
+import { type RuntimeRef } from "@vibesdotdev/kernel";
+/** Retry policy for removing credential-bearing temporary trees. */
+export declare const SENSITIVE_TEMP_CLEANUP_POLICY: Readonly<{
+    maxRetries: 5;
+    retryDelayMs: 50;
+}>;
+/** The only prefixes a release temporary root may have, by purpose. */
+export declare const SENSITIVE_TEMP_ROOT_PREFIXES: Readonly<{
+    availability: "vibes-release-availability-";
+    publish: "vibes-npm-publish-";
+    consumer: "vibes-release-consumer-";
+    artifacts: "vibes-release-artifacts-";
+    consumerSmoke: "vibes-npm-publish-smoke-";
+}>;
+/**
+ * The credential files an owned root holds: `npmrc` handed to npm as its user config, and `.npmrc`,
+ * the project config Bun and npm read from the root itself (publish writes this one since 2d3c82538).
+ */
+export declare const SENSITIVE_NPMRC_NAMES: readonly ["npmrc", ".npmrc"];
+/** Where release temporary roots live, relative to the workspace. */
+export declare const RELEASE_TEMP_ROOT_RELATIVE_PARENT = ".vibes/tmp/registry-release";
+type SensitiveTempRootPrefix = (typeof SENSITIVE_TEMP_ROOT_PREFIXES)[keyof typeof SENSITIVE_TEMP_ROOT_PREFIXES];
+/** The primary failure a cleanup must not replace. */
+export type SensitiveTempCleanupFailure = {
+    error: unknown;
+};
+type SymbolicLinkInspection = {
+    isSymbolicLink(): boolean;
+};
+type SensitiveTempCleanupAuthorities = {
+    inspectFile(path: string): Promise<SymbolicLinkInspection>;
+    overwriteFile(path: string): Promise<void>;
+    removeFile(path: string): Promise<void>;
+    removeTree(path: string): Promise<void>;
+    wait(delayMs: number): Promise<void>;
+};
+/** The single-file operations a credential scrub uses. */
+type SensitiveTempFileAuthorities = Pick<SensitiveTempCleanupAuthorities, "inspectFile" | "overwriteFile" | "removeFile">;
+/** Filesystem operations a credential file scrub uses outside tests. */
+export declare function defaultSensitiveTempFileAuthorities(runtime: RuntimeRef): SensitiveTempFileAuthorities;
+/** Filesystem operations cleanup uses outside tests; its waits run on the runtime's lifecycle. */
+export declare function createSensitiveTempCleanupAuthorities(runtime: RuntimeRef): SensitiveTempCleanupAuthorities;
+/**
+ * The release temporary parent for a prefix: an isolated-resolution root sits under the
+ * runtime's tempDir; every other root sits under the publish workspace root the caller
+ * selected from the bound workspace, taken as given, never re-derived.
+ */
+export declare function resolveReleaseTempParent(runtime: RuntimeRef, workspaceRoot: string, prefix: SensitiveTempRootPrefix): Promise<string>;
+/**
+ * A new owned temporary root under its prefix's parent, pinned as its own npm/bun project.
+ */
+export declare function createReleaseTempRoot(runtime: RuntimeRef, workspaceRoot: string, prefix: SensitiveTempRootPrefix): Promise<string>;
+/**
+ * Overwrite then remove a credential file; symlinks are removed without following.
+ */
+export declare function scrubSensitiveTempFile(path: string, authorities: SensitiveTempFileAuthorities): Promise<void>;
+/** Remove a temporary tree, retrying transient failures within policy. */
+export declare function removeSensitiveTempTree(path: string, authorities: SensitiveTempCleanupAuthorities): Promise<void>;
+/**
+ * Scrub an ephemeral Registry npm config and remove its tree without allowing
+ * any cleanup fault to hide the operation that made cleanup necessary.
+ */
+export declare function cleanupSensitiveTempRoot(options: {
+    /** The runtime whose lifecycle owns the retry waits and whose filesystem owns the temp root. */
+    runtime: RuntimeRef;
+    root: string;
+    npmrcPath: string;
+    expectedPrefix: SensitiveTempRootPrefix;
+    workspaceRoot: string;
+    primaryFailure?: SensitiveTempCleanupFailure;
+    close?: readonly (() => Promise<void>)[];
+    afterRemove?: readonly (() => Promise<void>)[];
+    redactValues?: readonly string[];
+    authorities?: Partial<SensitiveTempCleanupAuthorities>;
+}): Promise<void>;
+/**
+ * Scrub a credential file and remove a temporary tree in a `finally` that must
+ * not replace the operation's own outcome: each fault is reported through the
+ * package logger with its reason instead of being thrown or swallowed.
+ */
+export declare function reportedSensitiveTempCleanup(runtime: RuntimeRef, targets: {
+    npmrcPath?: string;
+    root?: string;
+}): Promise<void>;
+/** Replace an npmrc atomically (mode 0600) through an exclusive sibling file. */
+export declare function writeSensitiveNpmrcAtomically(npmrcPath: string, contents: string, 
+/** The runtime whose logger reports a scratch file the failed write could not scrub. */
+runtime: RuntimeRef): Promise<void>;
+export {};
+//# sourceMappingURL=sensitive-temp.d.ts.map

package/dist/cli/npm/publish/sensitive-temp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-temp.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/sensitive-temp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAUpG,oEAAoE;AACpE,eAAO,MAAM,6BAA6B;;;EAGxC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,4BAA4B;;;;;;EAMvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,8BAA8C,CAAC;AAEjF,qEAAqE;AACrE,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAY/E,KAAK,uBAAuB,GAC1B,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,OAAO,4BAA4B,CAAC,CAAC;AAEnF,sDAAsD;AACtD,MAAM,MAAM,2BAA2B,GAAG;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D,KAAK,sBAAsB,GAAG;IAC5B,cAAc,IAAI,OAAO,CAAC;CAC3B,CAAC;AAOF,KAAK,+BAA+B,GAAG;IACrC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC,CAAC;AAEF,0DAA0D;AAC1D,KAAK,4BAA4B,GAAG,IAAI,CACtC,+BAA+B,EAC/B,aAAa,GAAG,eAAe,GAAG,YAAY,CAC/C,CAAC;AAiBF,wEAAwE;AACxE,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,UAAU,GAClB,4BAA4B,CAe9B;AAED,kGAAkG;AAClG,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,UAAU,GAClB,+BAA+B,CAMjC;AA+CD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,UAAU,EACnB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,UAAU,EACnB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAgCD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,0EAA0E;AAC1E,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,+BAA+B,GAC3C,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,gGAAgG;IAChG,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,KAAK,CAAC,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACzC,WAAW,CAAC,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAC/C,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;CACxD,GAAG,OAAO,CAAC,IAAI,CAAC,CAiEhB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,iFAAiF;AACjF,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM;AAChB,wFAAwF;AACxF,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/cli/npm/publish/sensitive-temp.js

@@ -0,0 +1,351 @@
+/**
+ * Owned temporary roots for credential-bearing release work: creation under the
+ * workspace, permission normalization, scrubbing and bounded cleanup.
+ */
+import { chmodChecked, createFileExclusiveChecked, realpathChecked, resolveFileSystemAdapter, } from "@vibesdotdev/filesystem";
+import { getPathRoots, getRuntimePath } from "@vibesdotdev/paths";
+import { settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { generateShortId } from "@vibesdotdev/shared";
+import { infraDeployLogger } from "../../../logger.js";
+import { fileSystemErrorCode, isPathAbsentError, isWithinDirectory } from "./fs-paths.js";
+import { boundedCleanupFailureMessage, writeIsolatedBunfig, writeIsolatedNpmProjectManifest, } from "./npm-exec.js";
+/** Retry policy for removing credential-bearing temporary trees. */
+export const SENSITIVE_TEMP_CLEANUP_POLICY = Object.freeze({
+    maxRetries: 5,
+    retryDelayMs: 50,
+});
+/** The only prefixes a release temporary root may have, by purpose. */
+export const SENSITIVE_TEMP_ROOT_PREFIXES = Object.freeze({
+    availability: "vibes-release-availability-",
+    publish: "vibes-npm-publish-",
+    consumer: "vibes-release-consumer-",
+    artifacts: "vibes-release-artifacts-",
+    consumerSmoke: "vibes-npm-publish-smoke-",
+});
+/**
+ * The credential files an owned root holds: `npmrc` handed to npm as its user config, and `.npmrc`,
+ * the project config Bun and npm read from the root itself (publish writes this one since 2d3c82538).
+ */
+export const SENSITIVE_NPMRC_NAMES = Object.freeze(["npmrc", ".npmrc"]);
+/** Where release temporary roots live, relative to the workspace. */
+export const RELEASE_TEMP_ROOT_RELATIVE_PARENT = ".vibes/tmp/registry-release";
+/**
+ * Prefixes whose roots install packages and then import them. They live under the runtime's
+ * `paths/roots` tempDir, outside every workspace, so module resolution cannot walk up into a
+ * workspace `node_modules` and supply a package the install did not.
+ */
+const ISOLATED_RESOLUTION_ROOT_PREFIXES = [
+    SENSITIVE_TEMP_ROOT_PREFIXES.consumer,
+    SENSITIVE_TEMP_ROOT_PREFIXES.consumerSmoke,
+];
+async function hostReleaseFiles(runtime) {
+    return {
+        paths: await getRuntimePath(runtime),
+        files: await resolveFileSystemAdapter(runtime, { binding: false }),
+    };
+}
+function symlinkStat(stat) {
+    const link = stat.isSymlink || stat.kind === "symlink";
+    return { isSymbolicLink: () => link };
+}
+/** Filesystem operations a credential file scrub uses outside tests. */
+export function defaultSensitiveTempFileAuthorities(runtime) {
+    return {
+        inspectFile: async (path) => {
+            const { files } = await hostReleaseFiles(runtime);
+            return symlinkStat(await files.stat(path));
+        },
+        overwriteFile: async (path) => {
+            const { files } = await hostReleaseFiles(runtime);
+            await files.writeFile(path, "", { mode: 0o600 });
+        },
+        removeFile: async (path) => {
+            const { files } = await hostReleaseFiles(runtime);
+            await files.remove(path);
+        },
+    };
+}
+/** Filesystem operations cleanup uses outside tests; its waits run on the runtime's lifecycle. */
+export function createSensitiveTempCleanupAuthorities(runtime) {
+    return {
+        ...defaultSensitiveTempFileAuthorities(runtime),
+        removeTree: (path) => removeOwnedSensitiveTempTree(runtime, path),
+        wait: (delayMs) => runtime.lifecycle.delay(delayMs),
+    };
+}
+function isRetryableSensitiveTempCleanupError(error) {
+    return ["EBUSY", "EMFILE", "ENFILE", "ENOTEMPTY", "EPERM"].includes(fileSystemErrorCode(error) ?? "");
+}
+async function assertOwnedSensitiveTempRoot(runtime, root, expectedPrefix, workspaceRoot) {
+    if (!Object.values(SENSITIVE_TEMP_ROOT_PREFIXES).includes(expectedPrefix)) {
+        throw new Error(`Sensitive temporary cleanup received an unknown root prefix: ${expectedPrefix}`);
+    }
+    const { paths, files } = await hostReleaseFiles(runtime);
+    const absoluteRoot = paths.resolve(root);
+    const expectedParent = await resolveReleaseTempParent(runtime, workspaceRoot, expectedPrefix);
+    const rootName = paths.basename(absoluteRoot);
+    const suffix = rootName.slice(expectedPrefix.length);
+    if (paths.dirname(absoluteRoot) !== expectedParent ||
+        !rootName.startsWith(expectedPrefix) ||
+        !/^[A-Za-z0-9]{6}$/.test(suffix)) {
+        throw new Error(`Sensitive temporary cleanup refused a root outside the ${expectedPrefix}<mkdtemp> boundary: ${root}`);
+    }
+    const stated = await settle(() => files.stat(absoluteRoot));
+    if (!stated.ok) {
+        if (isPathAbsentError(stated.cause))
+            return absoluteRoot;
+        throw stated.cause;
+    }
+    const rootStat = stated.value;
+    if (rootStat.kind !== "directory" || rootStat.isSymlink) {
+        throw new Error(`Sensitive temporary cleanup requires an owned directory root: ${root}`);
+    }
+    return absoluteRoot;
+}
+/**
+ * The release temporary parent for a prefix: an isolated-resolution root sits under the
+ * runtime's tempDir; every other root sits under the publish workspace root the caller
+ * selected from the bound workspace, taken as given, never re-derived.
+ */
+export async function resolveReleaseTempParent(runtime, workspaceRoot, prefix) {
+    const { paths, files } = await hostReleaseFiles(runtime);
+    if (ISOLATED_RESOLUTION_ROOT_PREFIXES.includes(prefix)) {
+        const isolatedParent = paths.join(getPathRoots(runtime).tempDir, "registry-release");
+        await files.mkdir(isolatedParent, { recursive: true, mode: 0o700 });
+        const canonicalIsolatedParent = await realpathChecked(files, isolatedParent);
+        await chmodChecked(files, canonicalIsolatedParent, 0o700);
+        return canonicalIsolatedParent;
+    }
+    const canonicalWorkspaceRoot = await realpathChecked(files, workspaceRoot);
+    const requestedParent = paths.join(canonicalWorkspaceRoot, ".vibes", "tmp", "registry-release");
+    await files.mkdir(requestedParent, { recursive: true, mode: 0o700 });
+    const canonicalParent = await realpathChecked(files, requestedParent);
+    if (!(await isWithinDirectory(runtime, canonicalWorkspaceRoot, canonicalParent))) {
+        throw new Error(`Registry release temporary root resolves outside its workspace: ${requestedParent}`);
+    }
+    await chmodChecked(files, canonicalParent, 0o700);
+    return canonicalParent;
+}
+/**
+ * A new owned temporary root under its prefix's parent, pinned as its own npm/bun project.
+ */
+export async function createReleaseTempRoot(runtime, workspaceRoot, prefix) {
+    if (!Object.values(SENSITIVE_TEMP_ROOT_PREFIXES).includes(prefix)) {
+        throw new Error(`Registry release temporary root received an unknown prefix: ${prefix}`);
+    }
+    const parent = await resolveReleaseTempParent(runtime, workspaceRoot, prefix);
+    const { paths, files } = await hostReleaseFiles(runtime);
+    let root;
+    for (let attempt = 0; attempt < 16; attempt += 1) {
+        const candidate = paths.join(parent, `${prefix}${generateShortId(6)}`);
+        const created = await settle(() => files.mkdir(candidate, { mode: 0o700 }));
+        if (created.ok) {
+            root = candidate;
+            break;
+        }
+        if (fileSystemErrorCode(created.cause) === "EEXIST")
+            continue;
+        throw created.cause;
+    }
+    if (root === undefined) {
+        throw new Error("Registry release temporary root could not be created");
+    }
+    const wrote = await settle(async () => {
+        await writeIsolatedNpmProjectManifest(runtime, root);
+        await writeIsolatedBunfig(runtime, root);
+    });
+    if (!wrote.ok) {
+        const removed = await settle(() => removeOwnedSensitiveTempTree(runtime, root));
+        if (!removed.ok) {
+            throw new AggregateError([wrote.cause, removed.cause], "Registry release temporary root could not be created, and removing it failed.");
+        }
+        throw wrote.cause;
+    }
+    return root;
+}
+async function normalizeOwnedTempDirectoryModes(runtime, path) {
+    const { paths, files } = await hostReleaseFiles(runtime);
+    const stated = await settle(() => files.stat(path));
+    if (!stated.ok) {
+        if (isPathAbsentError(stated.cause))
+            return;
+        throw stated.cause;
+    }
+    const entryStat = stated.value;
+    if (entryStat.kind !== "directory" || entryStat.isSymlink)
+        return;
+    await chmodChecked(files, path, 0o700);
+    for (const entry of await files.list(path)) {
+        if (entry.kind === "symlink")
+            continue;
+        if (entry.kind === "directory") {
+            await normalizeOwnedTempDirectoryModes(runtime, paths.join(path, entry.name));
+        }
+    }
+}
+async function removeOwnedSensitiveTempTree(runtime, path) {
+    await normalizeOwnedTempDirectoryModes(runtime, path);
+    const { files } = await hostReleaseFiles(runtime);
+    await files.remove(path, { recursive: true });
+}
+/**
+ * Overwrite then remove a credential file; symlinks are removed without following.
+ */
+export async function scrubSensitiveTempFile(path, authorities) {
+    const failures = [];
+    const inspected = await settle(() => authorities.inspectFile(path));
+    if (!inspected.ok) {
+        if (isPathAbsentError(inspected.cause))
+            return;
+        throw inspected.cause;
+    }
+    const fileStat = inspected.value;
+    if (fileStat.isSymbolicLink()) {
+        await authorities.removeFile(path);
+        return;
+    }
+    const overwritten = await settle(() => authorities.overwriteFile(path));
+    if (!overwritten.ok && !isPathAbsentError(overwritten.cause)) {
+        failures.push(overwritten.cause);
+    }
+    const removed = await settle(() => authorities.removeFile(path));
+    if (!removed.ok && !isPathAbsentError(removed.cause)) {
+        failures.push(removed.cause);
+    }
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1) {
+        throw new AggregateError(failures, `Sensitive temporary file cleanup failed for ${path}`);
+    }
+}
+/** Remove a temporary tree, retrying transient failures within policy. */
+export async function removeSensitiveTempTree(path, authorities) {
+    let retries = 0;
+    while (true) {
+        const removed = await settle(() => authorities.removeTree(path));
+        if (removed.ok)
+            return;
+        if (!isRetryableSensitiveTempCleanupError(removed.cause) ||
+            retries >= SENSITIVE_TEMP_CLEANUP_POLICY.maxRetries) {
+            throw removed.cause;
+        }
+        retries += 1;
+        await authorities.wait(SENSITIVE_TEMP_CLEANUP_POLICY.retryDelayMs * retries);
+    }
+}
+/**
+ * Scrub an ephemeral Registry npm config and remove its tree without allowing
+ * any cleanup fault to hide the operation that made cleanup necessary.
+ */
+export async function cleanupSensitiveTempRoot(options) {
+    const authorities = {
+        ...createSensitiveTempCleanupAuthorities(options.runtime),
+        ...options.authorities,
+    };
+    const cleanupFailures = [];
+    const attempt = async (action) => {
+        const finished = await settle(action);
+        if (!finished.ok)
+            cleanupFailures.push(finished.cause);
+    };
+    for (const close of options.close ?? [])
+        await attempt(close);
+    const owned = await settle(async () => {
+        const absoluteRoot = await assertOwnedSensitiveTempRoot(options.runtime, options.root, options.expectedPrefix, options.workspaceRoot);
+        const paths = await getRuntimePath(options.runtime);
+        const resolvedNpmrc = paths.resolve(options.npmrcPath);
+        const npmrcName = paths.basename(resolvedNpmrc);
+        if (paths.dirname(resolvedNpmrc) !== absoluteRoot ||
+            !SENSITIVE_NPMRC_NAMES.some((name) => name === npmrcName)) {
+            throw new Error(`Sensitive temporary cleanup refused npmrc outside its owned root: ${options.npmrcPath}`);
+        }
+        return { root: absoluteRoot, npmrcPath: resolvedNpmrc };
+    });
+    const root = owned.ok ? owned.value.root : undefined;
+    const npmrcPath = owned.ok ? owned.value.npmrcPath : undefined;
+    if (!owned.ok)
+        cleanupFailures.push(owned.cause);
+    if (root !== undefined && npmrcPath !== undefined) {
+        const scrubbed = await settle(() => scrubSensitiveTempFile(npmrcPath, authorities));
+        const removed = await settle(() => removeSensitiveTempTree(root, authorities));
+        if (!removed.ok) {
+            if (!scrubbed.ok)
+                cleanupFailures.push(scrubbed.cause);
+            cleanupFailures.push(removed.cause);
+        }
+    }
+    for (const afterRemove of options.afterRemove ?? [])
+        await attempt(afterRemove);
+    if (cleanupFailures.length === 0)
+        return;
+    if (!options.primaryFailure && cleanupFailures.length === 1)
+        throw cleanupFailures[0];
+    const failures = options.primaryFailure
+        ? [options.primaryFailure.error, ...cleanupFailures]
+        : cleanupFailures;
+    const redactValues = options.redactValues ?? [];
+    const cleanupSummary = cleanupFailures
+        .map((error) => boundedCleanupFailureMessage(error, redactValues))
+        .join("; ");
+    throw new AggregateError(failures, options.primaryFailure
+        ? `Registry operation failed: ${boundedCleanupFailureMessage(options.primaryFailure.error, redactValues)}; sensitive temporary cleanup also failed: ${cleanupSummary}`
+        : `Sensitive temporary cleanup failed: ${cleanupSummary}`, options.primaryFailure
+        ? { cause: options.primaryFailure.error }
+        : undefined);
+}
+/**
+ * Scrub a credential file and remove a temporary tree in a `finally` that must
+ * not replace the operation's own outcome: each fault is reported through the
+ * package logger with its reason instead of being thrown or swallowed.
+ */
+export async function reportedSensitiveTempCleanup(runtime, targets) {
+    const authorities = createSensitiveTempCleanupAuthorities(runtime);
+    const report = (what, path, error) => infraDeployLogger(runtime).warn(`Sensitive temporary ${what} failed`, {
+        path,
+        reason: "sensitive-temp-cleanup-failed",
+        cause: valueFreeFailure(error),
+    });
+    const npmrcPath = targets.npmrcPath;
+    if (npmrcPath !== undefined) {
+        const scrubbed = await settle(() => scrubSensitiveTempFile(npmrcPath, authorities));
+        if (!scrubbed.ok)
+            report("credential scrub", npmrcPath, scrubbed.cause);
+    }
+    const root = targets.root;
+    if (root !== undefined) {
+        const removed = await settle(() => removeSensitiveTempTree(root, authorities));
+        if (!removed.ok)
+            report("tree removal", root, removed.cause);
+    }
+}
+/** Replace an npmrc atomically (mode 0600) through an exclusive sibling file. */
+export async function writeSensitiveNpmrcAtomically(npmrcPath, contents, 
+/** The runtime whose logger reports a scratch file the failed write could not scrub. */
+runtime) {
+    const nextPath = `${npmrcPath}.next`;
+    let moved = false;
+    try {
+        const { files } = await hostReleaseFiles(runtime);
+        const created = await createFileExclusiveChecked(files, nextPath, contents);
+        if (!created) {
+            throw new Error(`Sensitive npmrc scratch file already exists: ${nextPath}`);
+        }
+        await chmodChecked(files, nextPath, 0o600);
+        await files.rename(nextPath, npmrcPath);
+        moved = true;
+        await chmodChecked(files, npmrcPath, 0o600);
+    }
+    finally {
+        if (!moved) {
+            const scrubbed = await settle(() => scrubSensitiveTempFile(nextPath, defaultSensitiveTempFileAuthorities(runtime)));
+            if (!scrubbed.ok) {
+                infraDeployLogger(runtime).warn("Sensitive npmrc scratch file could not be scrubbed", {
+                    path: nextPath,
+                    reason: "sensitive-npmrc-scratch-scrub-failed",
+                    cause: valueFreeFailure(scrubbed.cause),
+                });
+            }
+        }
+    }
+}
+//# sourceMappingURL=sensitive-temp.js.map

package/dist/cli/npm/publish/sensitive-temp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-temp.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/sensitive-temp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAuC,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AAEvB,oEAAoE;AACpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,CAAC;IACb,YAAY,EAAE,EAAE;CACjB,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,YAAY,EAAE,6BAA6B;IAC3C,OAAO,EAAE,oBAAoB;IAC7B,QAAQ,EAAE,yBAAyB;IACnC,SAAS,EAAE,0BAA0B;IACrC,aAAa,EAAE,0BAA0B;CAC1C,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC,CAAC;AAEjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAE/E;;;;GAIG;AACH,MAAM,iCAAiC,GAAsB;IAC3D,4BAA4B,CAAC,QAAQ;IACrC,4BAA4B,CAAC,aAAa;CAC3C,CAAC;AA+BF,KAAK,UAAU,gBAAgB,CAAC,OAAmB;IAIjD,OAAO;QACL,KAAK,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC;QACpC,KAAK,EAAE,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACvD,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mCAAmC,CACjD,OAAmB;IAEnB,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qCAAqC,CACnD,OAAmB;IAEnB,OAAO;QACL,GAAG,mCAAmC,CAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC;QACjE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAoB;IAChE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CACjE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,CACjC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,OAAmB,EACnB,IAAY,EACZ,cAAuC,EACvC,aAAqB;IAErB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,gEAAgE,cAAc,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrD,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,cAAc;QAC9C,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC;QACpC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0DAA0D,cAAc,uBAAuB,IAAI,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QACzD,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAmB,EACnB,aAAqB,EACrB,MAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,iCAAiC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,uBAAuB,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC7E,MAAM,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAChC,sBAAsB,EACtB,QAAQ,EACR,KAAK,EACL,kBAAkB,CACnB,CAAC;IACF,MAAM,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,mEAAmE,eAAe,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAmB,EACnB,aAAqB,EACrB,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,IAAwB,CAAC;IAC7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,GAAG,SAAS,CAAC;YACjB,MAAM;QACR,CAAC;QACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC9D,MAAM,OAAO,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAC5B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,OAAmB,EACnB,IAAY;IAEZ,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO;QAC5C,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,SAAS;QAAE,OAAO;IAClE,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,gCAAgC,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,OAAmB,EACnB,IAAY;IAEZ,MAAM,gCAAgC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,WAAyC;IAEzC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/C,MAAM,SAAS,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC;IACjC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,QAAQ,EACR,+CAA+C,IAAI,EAAE,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,WAA4C;IAE5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO;QACvB,IACE,CAAC,oCAAoC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpD,OAAO,IAAI,6BAA6B,CAAC,UAAU,EACnD,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,WAAW,CAAC,IAAI,CACpB,6BAA6B,CAAC,YAAY,GAAG,OAAO,CACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAY9C;IACC,MAAM,WAAW,GAAG;QAClB,GAAG,qCAAqC,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,GAAG,OAAO,CAAC,WAAW;KACvB,CAAC;IACF,MAAM,eAAe,GAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,EAAE,MAA2B,EAAiB,EAAE;QACnE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,YAAY,GAAG,MAAM,4BAA4B,CACrD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,IACE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,YAAY;YAC7C,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,OAAO,CAAC,SAAS,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvD,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE;QACjD,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7B,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QACzD,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc;QACrC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC;QACpD,CAAC,CAAC,eAAe,CAAC;IACpB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,cAAc,GAAG,eAAe;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SACjE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,cAAc,CACtB,QAAQ,EACR,OAAO,CAAC,cAAc;QACpB,CAAC,CAAC,8BAA8B,4BAA4B,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,8CAA8C,cAAc,EAAE;QACtK,CAAC,CAAC,uCAAuC,cAAc,EAAE,EAC3D,OAAO,CAAC,cAAc;QACpB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE;QACzC,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAmB,EACnB,OAA8C;IAE9C,MAAM,WAAW,GAAG,qCAAqC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,KAAoB,EAAE,EAAE,CAClE,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,IAAI,SAAS,EAAE;QACpE,IAAI;QACJ,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;KAC/B,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,CAAC,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB,EACjB,QAAgB;AAChB,wFAAwF;AACxF,OAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IACrC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxC,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CACjC,sBAAsB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,OAAO,CAAC,CAAC,CAC/E,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBACpF,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,sCAAsC;oBAC9C,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/npm/publish/source-snapshot.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Source snapshot gates: every release byte comes from a clean, landed commit.
+ * Resolves the commit a package publishes from and refuses dirty or unlanded source.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { PackageJson, RegistryReleaseBuildPackage, RegistryReleasePublishTarget } from "./types.ts";
+/** The full commit hash at `HEAD` of a package's checkout. */
+export declare function resolveSourceCommit(options: {
+    pkg: PackageJson & {
+        name: string;
+        version: string;
+    };
+    packageDir: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+}): Promise<string>;
+/** Generated live tables; they must not block a source snapshot. */
+export declare function isGeneratedWorkspaceSnapshotPath(path: string): boolean;
+export declare const REGISTRY_RELEASE_STATUS_ARGS: readonly ["status", "--porcelain=v1", "-z", "--no-renames"];
+/** True when status collected with REGISTRY_RELEASE_STATUS_ARGS has source dirt. */
+export declare function registryReleaseStatusBlocksSnapshot(porcelain: string): boolean;
+/** Bind one immutable, clean owning-repository snapshot to the release transaction. */
+export declare function assertRegistryReleaseSnapshot(options: {
+    workspaceRoot: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    expectedGitHead?: string;
+    /** Compose-root check: ignore leftover notes and other untracked files. */
+    ignoreUntracked?: boolean;
+    /**
+     * Compose-lock root only: inspect the files that define the composition.
+     * Source owners always use the repository-wide check without this option.
+     */
+    relevantPathPrefixes?: readonly string[];
+}): Promise<string>;
+/** Compose-root files that can change sealed release bytes. Concurrent-lane dirt elsewhere is ignored. */
+export declare const COMPOSE_ROOT_RELEASE_PATH_PREFIXES: readonly ["release/registry", "bun.lock", "package.json", "bunfig.toml", "turbo.json"];
+/**
+ * Bind every owning repository of the targets to one clean (and, when required,
+ * landed) commit; with `expectedGitHeads`, require exactly those commits.
+ */
+export declare function assertRegistryReleaseSnapshots(options: {
+    targets: readonly RegistryReleaseBuildPackage[];
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    expectedGitHeads?: ReadonlyMap<string, string>;
+    requireLanded?: boolean;
+}): Promise<Map<string, string>>;
+/** Require newly staged source at the exact advertised canonical Forge main. */
+export declare function assertRegistryReleaseSourceLanded(options: {
+    sourceRoot: string;
+    repository: string;
+    expectedGitHead: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+}): Promise<void>;
+/** The verified commit of a target's owning repository. */
+export declare function expectedGitHeadForTarget(target: RegistryReleasePublishTarget, expectedGitHeads: ReadonlyMap<string, string>): string;
+/** Revalidate the complete Git owner whose sealed artifact is about to publish. */
+export declare function assertRegistryReleaseTargetSnapshot(options: {
+    target: RegistryReleasePublishTarget;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    expectedGitHeads: ReadonlyMap<string, string>;
+    /** False only under the ADR-0017 RC major-version exception. */
+    requireLanded?: boolean;
+}): Promise<string>;
+/** Throw unless the package directory has no uncommitted changes. */
+export declare function assertManagedSourceClean(options: {
+    pkg: PackageJson & {
+        name: string;
+        version: string;
+    };
+    packageDir: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+}): Promise<void>;
+/** Require the captured source identity; ancestry cannot certify sealed bytes. */
+export declare function assertRegistryReleaseSourceCommit(options: {
+    expected: string;
+    observed: string;
+    message: string;
+}): void;
+//# sourceMappingURL=source-snapshot.d.ts.map

package/dist/cli/npm/publish/source-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-snapshot.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/source-snapshot.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQtE,OAAO,KAAK,EACV,WAAW,EACX,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAEpB,8DAA8D;AAC9D,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED,oEAAoE;AACpE,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAGD,eAAO,MAAM,4BAA4B,6DAA8D,CAAC;AAOxG,oFAAoF;AACpF,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,MAAM,GAChB,OAAO,CAET;AAED,uFAAuF;AACvF,wBAAsB,6BAA6B,CAAC,OAAO,EAAE;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,MAAM,CAAC,CA4DlB;AAaD,0GAA0G;AAC1G,eAAO,MAAM,kCAAkC,wFAGrC,CAAC;AAEX;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE;IAC5D,OAAO,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAChD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsF/B;AAED,gFAAgF;AAChF,wBAAsB,iCAAiC,CAAC,OAAO,EAAE;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,2DAA2D;AAC3D,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,4BAA4B,EACpC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5C,MAAM,CAQR;AAED,mFAAmF;AACnF,wBAAsB,mCAAmC,CAAC,OAAO,EAAE;IACjE,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBlB;AAED,qEAAqE;AACrE,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,GAAG,EAAE,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBhB;AAED,kFAAkF;AAClF,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,IAAI,CAEP"}