@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/source-snapshot.js

@@ -0,0 +1,245 @@
+import { GIT_CHILD_ENV } from "@vibesdotdev/git-operations/core";
+import { settleNow } from "@vibesdotdev/kernel";
+import { infraDeployLogger } from "../../../logger.js";
+import { runRuntimeCommand, } from "../../shared/runtime-execution.js";
+import { mapWithConcurrency } from "./concurrency.js";
+import { canonicalForgeRepositoryIdentity } from "./forge-source-identity.js";
+/** The full commit hash at `HEAD` of a package's checkout. */
+export async function resolveSourceCommit(options) {
+    const result = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["rev-parse", "HEAD"],
+        cwd: options.packageDir,
+    });
+    const gitHead = result.stdout.trim();
+    if (result.code !== 0 || !/^[0-9a-f]{40,64}$/i.test(gitHead)) {
+        throw new Error(`Cannot resolve source commit for ${options.pkg.name}@${options.pkg.version}`);
+    }
+    return gitHead;
+}
+/** Generated live tables; they must not block a source snapshot. */
+export function isGeneratedWorkspaceSnapshotPath(path) {
+    return /(^|\/)VIBES\.md$/.test(path);
+}
+// NUL records preserve filename bytes; disabling rename summaries exposes both paths.
+export const REGISTRY_RELEASE_STATUS_ARGS = ["status", "--porcelain=v1", "-z", "--no-renames"];
+function snapshotDirtyPaths(porcelain) {
+    return porcelain.split("\0").filter(Boolean).map((record) => record.slice(3))
+        .filter((path) => !isGeneratedWorkspaceSnapshotPath(path));
+}
+/** True when status collected with REGISTRY_RELEASE_STATUS_ARGS has source dirt. */
+export function registryReleaseStatusBlocksSnapshot(porcelain) {
+    return snapshotDirtyPaths(porcelain).length > 0;
+}
+/** Bind one immutable, clean owning-repository snapshot to the release transaction. */
+export async function assertRegistryReleaseSnapshot(options) {
+    const head = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["rev-parse", "HEAD"],
+        cwd: options.workspaceRoot,
+    });
+    const gitHead = head.stdout.trim();
+    if (head.code !== 0 || !/^[0-9a-f]{40,64}$/i.test(gitHead)) {
+        throw new Error("Cannot resolve the canonical workspace source commit");
+    }
+    if (options.expectedGitHead && gitHead !== options.expectedGitHead) {
+        throw new Error(`Registry release source commit changed: expected ${options.expectedGitHead}, found ${gitHead}`);
+    }
+    const status = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: [
+            ...REGISTRY_RELEASE_STATUS_ARGS,
+            options.ignoreUntracked
+                ? "--untracked-files=no"
+                : "--untracked-files=all",
+        ],
+        cwd: options.workspaceRoot,
+    });
+    if (status.code !== 0) {
+        throw new Error(`Cannot verify the canonical workspace source state: ${status.stderr}`);
+    }
+    if (registryReleaseStatusBlocksSnapshot(status.stdout)) {
+        if (!options.relevantPathPrefixes?.length) {
+            throw new Error(`Registry release requires a clean canonical workspace snapshot: ${options.workspaceRoot}`);
+        }
+        const dirtyPaths = snapshotDirtyPaths(status.stdout);
+        const blocking = dirtyPaths.filter((path) => options.relevantPathPrefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)));
+        if (blocking.length > 0) {
+            throw new Error(`Registry release requires a clean canonical workspace snapshot: ${options.workspaceRoot}; release-relevant dirty paths:\n${blocking
+                .map((path) => `- ${path}`)
+                .join("\n")}`);
+        }
+        settleNow(() => infraDeployLogger(options.runtime).warn("Source dirt outside release inputs is excluded from the compose snapshot", { pathCount: dirtyPaths.length }));
+    }
+    return gitHead;
+}
+/**
+ * Repository-level files that feed every staged build: dirt here blocks the
+ * snapshot even when scoping to release-relevant package paths.
+ */
+const REPOSITORY_LEVEL_BUILD_INPUTS = [
+    "bun.lock",
+    "package.json",
+    "bunfig.toml",
+    "turbo.json",
+];
+/** Compose-root files that can change sealed release bytes. Concurrent-lane dirt elsewhere is ignored. */
+export const COMPOSE_ROOT_RELEASE_PATH_PREFIXES = [
+    "release/registry",
+    ...REPOSITORY_LEVEL_BUILD_INPUTS,
+];
+/**
+ * Bind every owning repository of the targets to one clean (and, when required,
+ * landed) commit; with `expectedGitHeads`, require exactly those commits.
+ */
+export async function assertRegistryReleaseSnapshots(options) {
+    const snapshots = new Map();
+    const sourceRoots = [
+        ...new Set(options.targets.map((target) => target.sourceRoot)),
+    ].sort();
+    const resolved = await mapWithConcurrency(sourceRoots, 8, async (sourceRoot) => {
+        try {
+            const expectedGitHead = options.expectedGitHeads?.get(sourceRoot);
+            if (options.expectedGitHeads && !expectedGitHead) {
+                throw new Error(`Registry release snapshot is missing for owner ${sourceRoot}`);
+            }
+            const gitHead = await assertRegistryReleaseSnapshot({
+                workspaceRoot: sourceRoot,
+                execution: options.execution,
+                runtime: options.runtime,
+                expectedGitHead,
+            });
+            return { sourceRoot, gitHead };
+        }
+        catch (error) {
+            return {
+                sourceRoot,
+                error: error instanceof Error ? error.message : String(error),
+                cause: error,
+            };
+        }
+    });
+    const snapshotFailures = resolved.filter((result) => "error" in result);
+    if (snapshotFailures.length > 0) {
+        throw new AggregateError(snapshotFailures.map((failure) => failure.cause), `Registry release source snapshot verification failed:\n${snapshotFailures
+            .map((failure) => `- ${failure.sourceRoot}: ${failure.error}`)
+            .join("\n")}`);
+    }
+    for (const result of resolved) {
+        if (!("error" in result))
+            snapshots.set(result.sourceRoot, result.gitHead);
+    }
+    if (options.requireLanded) {
+        const landed = await mapWithConcurrency(sourceRoots, 4, async (sourceRoot) => {
+            const target = options.targets.find((candidate) => candidate.sourceRoot === sourceRoot);
+            if (!target)
+                throw new Error(`Registry release lost source owner ${sourceRoot}`);
+            try {
+                await assertRegistryReleaseSourceLanded({
+                    sourceRoot,
+                    repository: target.workspaceProvenance.repository,
+                    expectedGitHead: snapshots.get(sourceRoot),
+                    execution: options.execution,
+                    runtime: options.runtime,
+                });
+                return { sourceRoot };
+            }
+            catch (error) {
+                return {
+                    sourceRoot,
+                    error: error instanceof Error ? error.message : String(error),
+                    cause: error,
+                };
+            }
+        });
+        const landedFailures = landed.filter((result) => "error" in result);
+        if (landedFailures.length > 0) {
+            throw new AggregateError(landedFailures.map((failure) => failure.cause), `Registry release landed-source verification failed:\n${landedFailures
+                .map((failure) => `- ${failure.sourceRoot}: ${failure.error}`)
+                .join("\n")}`);
+        }
+    }
+    return snapshots;
+}
+/** Require newly staged source at the exact advertised canonical Forge main. */
+export async function assertRegistryReleaseSourceLanded(options) {
+    const canonical = canonicalForgeRepositoryIdentity(options.repository);
+    const remote = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["ls-remote", canonical.repository, "refs/heads/main"],
+        cwd: options.sourceRoot,
+    });
+    if (remote.code !== 0) {
+        throw new Error(`Cannot verify canonical Forge main for ${options.sourceRoot}`);
+    }
+    const mainHeads = remote.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim().split(/\s+/))
+        .filter(([sha, ref]) => ref === "refs/heads/main" && sha === options.expectedGitHead);
+    if (mainHeads.length !== 1) {
+        throw new Error(`Registry release source is not at canonical Forge main: ${options.sourceRoot}@${options.expectedGitHead}`);
+    }
+}
+/** The verified commit of a target's owning repository. */
+export function expectedGitHeadForTarget(target, expectedGitHeads) {
+    const gitHead = expectedGitHeads.get(target.sourceRoot);
+    if (!gitHead) {
+        throw new Error(`Registry release snapshot is missing for ${target.name} owner ${target.sourceRoot}`);
+    }
+    return gitHead;
+}
+/** Revalidate the complete Git owner whose sealed artifact is about to publish. */
+export async function assertRegistryReleaseTargetSnapshot(options) {
+    const expectedGitHead = expectedGitHeadForTarget(options.target, options.expectedGitHeads);
+    const gitHead = await assertRegistryReleaseSnapshot({
+        workspaceRoot: options.target.sourceRoot,
+        execution: options.execution,
+        runtime: options.runtime,
+        expectedGitHead,
+    });
+    if (options.requireLanded === false)
+        return gitHead;
+    await assertRegistryReleaseSourceLanded({
+        sourceRoot: options.target.sourceRoot,
+        repository: options.target.workspaceProvenance.repository,
+        expectedGitHead,
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+    return gitHead;
+}
+/** Throw unless the package directory has no uncommitted changes. */
+export async function assertManagedSourceClean(options) {
+    const result = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: [...REGISTRY_RELEASE_STATUS_ARGS, "--untracked-files=all", "--", "."],
+        cwd: options.packageDir,
+    });
+    if (result.code !== 0) {
+        throw new Error(`Cannot verify clean Forge source for ${options.pkg.name}@${options.pkg.version}`);
+    }
+    if (registryReleaseStatusBlocksSnapshot(result.stdout)) {
+        throw new Error(`Managed Registry publish refuses dirty source for ${options.pkg.name}@${options.pkg.version}; commit and push the exact Forge release first`);
+    }
+}
+/** Require the captured source identity; ancestry cannot certify sealed bytes. */
+export function assertRegistryReleaseSourceCommit(options) {
+    if (options.observed !== options.expected)
+        throw new Error(options.message);
+}
+//# sourceMappingURL=source-snapshot.js.map

package/dist/cli/npm/publish/source-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-snapshot.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/source-snapshot.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,iBAAiB,GAChB,MAAM,mCAAmC,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAO9E,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAMzC;IACC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;QAC3B,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAU,CAAC;AAExG,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC1E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CACjD,SAAiB;IAEjB,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,OAanD;IACC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;QAC3B,GAAG,EAAE,OAAO,CAAC,aAAa;KAC3B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,oDAAoD,OAAO,CAAC,eAAe,WAAW,OAAO,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE;YACJ,GAAG,4BAA4B;YAC/B,OAAO,CAAC,eAAe;gBACrB,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,uBAAuB;SAC5B;QACD,GAAG,EAAE,OAAO,CAAC,aAAa;KAC3B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,mCAAmC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,mEAAmE,OAAO,CAAC,aAAa,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,OAAO,CAAC,oBAAqB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,mEAAmE,OAAO,CAAC,aAAa,oCAAoC,QAAQ;iBACjI,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;iBAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACrD,0EAA0E,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,CAC7G,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,UAAU;IACV,cAAc;IACd,aAAa;IACb,YAAY;CACJ,CAAC;AAEX,0GAA0G;AAC1G,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,kBAAkB;IAClB,GAAG,6BAA6B;CACxB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAOpD;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,WAAW,GAAG;QAClB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;KAC/D,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,WAAW,EACX,CAAC,EACD,KAAK,EAAE,UAAU,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,aAAa,EAAE,UAAU;gBACzB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,UAAU;gBACV,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK;aACJ,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,MAAM,EAAmE,EAAE,CAC1E,OAAO,IAAI,MAAM,CACpB,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EACvE,0DAA0D,gBAAgB;aACvE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC;YACtB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,WAAW,EACX,CAAC,EACD,KAAK,EAAE,UAAU,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CACnD,CAAC;YACF,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,iCAAiC,CAAC;oBACtC,UAAU;oBACV,UAAU,EAAE,MAAM,CAAC,mBAAmB,CAAC,UAAU;oBACjD,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAE;oBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;gBACH,OAAO,EAAE,UAAU,EAAW,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,UAAU;oBACV,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,KAAK,EAAE,KAAK;iBACJ,CAAC;YACb,CAAC;QACH,CAAC,CACF,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAClC,CAAC,MAAM,EAAiE,EAAE,CACxE,OAAO,IAAI,MAAM,CACpB,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EACrE,wDAAwD,cAAc;iBACnE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;iBAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAOvD;IACC,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC5D,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,UAAU,EAAE,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM;SAC5B,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2DAA2D,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,wBAAwB,CACtC,MAAoC,EACpC,gBAA6C;IAE7C,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,OAQzD;IACC,MAAM,eAAe,GAAG,wBAAwB,CAC9C,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,gBAAgB,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACxC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,iCAAiC,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACrC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU;QACzD,eAAe;QACf,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAM9C;IACC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,GAAG,4BAA4B,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,CAAC;QAC3E,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,mCAAmC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qDAAqD,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,iDAAiD,CAC9I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iCAAiC,CAAC,OAIjD;IACC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/npm/publish/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Shared release data shapes for `vibes infra npm publish`: the package
+ * manifest subset the publisher reads, build/publish targets, and publish results.
+ */
+import type { PublisherManifest } from "./publisher-manifest.ts";
+/** The publisher's package manifest: Registry's schema plus publisher fields. */
+export type PackageJson = PublisherManifest;
+/** Registry, access, tag and provenance a sealed artifact publishes with. */
+export type SealedPublishMetadata = {
+    registry: string;
+    access?: string;
+    tag?: string;
+    provenance: RegistryWorkspaceProvenance;
+};
+/** The outcome for one package: sealed, reused, dry-run or published. */
+export type PublishResult = {
+    name: string;
+    /** The version published or reused (assigned at publish time). */
+    version: string;
+    /** The version the source manifest declares; unchanged by assignment. */
+    sourceVersion?: string;
+    packageDir: string;
+    tarball?: string;
+    dryRun: boolean;
+    ok: boolean;
+    skipped?: boolean;
+    reason?: string;
+    attempts?: number;
+    verifiedFiles?: number;
+    verifiedExports?: number;
+    artifactIntegrity?: string;
+    gitHead: string;
+    provenance?: "source-commit" | "npm-attestation";
+    publishMetadata?: SealedPublishMetadata;
+    authority?: {
+        publish: "passed";
+        install: "passed";
+        replay: "rejected";
+        expiry: "rejected";
+        leaseId: string;
+        expiryLeaseId: string;
+    };
+};
+/** A package in the release build closure, at its source version. */
+export type RegistryReleaseBuildPackage = {
+    name: string;
+    version: string;
+    packageDir: string;
+    sourceRoot: string;
+    workspaceProvenance: RegistryWorkspaceProvenance;
+};
+/** A release output: a build package with its registry and release roles. */
+export type RegistryReleasePublishTarget = RegistryReleaseBuildPackage & {
+    registry: string;
+    roles: readonly ("root" | "runtime" | "peer" | "proof")[];
+};
+/** The repository, repository id and directory a package publishes from. */
+export type RegistryWorkspaceProvenance = {
+    repository: string;
+    repositoryId: string;
+    directory: string;
+};
+/** A source root's canonical Forge repository and id. */
+export type RegistryForgeSourceIdentity = {
+    sourceRoot: string;
+    repository: string;
+    repositoryId: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/npm/publish/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,eAAe,GAAG,iBAAiB,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,QAAQ,CAAC;QAClB,OAAO,EAAE,QAAQ,CAAC;QAClB,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,2BAA2B,CAAC;CAClD,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,4BAA4B,GAAG,2BAA2B,GAAG;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/cli/npm/publish/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cli/npm/publish/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/types.ts"],"names":[],"mappings":""}

package/dist/cli/npm/publish/workspace-discovery.d.ts

@@ -0,0 +1,48 @@
+import type { RegistryReleaseWorkspacePackage } from "@vibesdotdev/registry";
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import { type RegistryReleaseWorkspacePaths } from "./release-lock.ts";
+import type { PackageJson } from "./types.ts";
+/** Platform and architecture the runtime's environment captured. */
+export declare function hostPlatformFacts(runtime: ChildEnvRuntime): {
+    platform: string;
+    architecture: string;
+};
+/** True when the manifest's `os`/`cpu` allow this platform. */
+export declare function isPackagePlatformCompatible(manifest: Pick<PackageJson, "os" | "cpu">, platform: string, architecture: string): boolean;
+/**
+ * Absolute package directories for the requested paths. Relative paths resolve
+ * against the invocation cwd. An absent value or an empty string selects the
+ * cwd itself. Any other present value must be a string or an array of strings.
+ */
+export declare function resolvePublishPackageDirs(runtime: ChildEnvRuntime, paths: unknown, cwd: string): Promise<string[]>;
+/**
+ * The publish workspace is the bound workspace (`runtime/workspace-path`):
+ * `--workspace-root`, else the nearest workspace root above the invocation
+ * cwd. Every requested package must sit inside it; nothing walks from a
+ * package to find another root.
+ */
+export declare function resolvePublishWorkspaceRoot(runtime: ChildEnvRuntime, packageDirs: string[], workspaceRoot: string): Promise<string>;
+/**
+ * The sealed follow runs the executor inside the publish workspace itself,
+ * which must carry it at {@link RELEASE_EXECUTOR_PATH}; no ancestor is searched.
+ */
+export declare function resolveSealedFollowWorkspaceRoot(runtime: ChildEnvRuntime, workspaceRoot: string): Promise<string>;
+/** Every package the workspace manifest declares, by name. */
+export declare function collectWorkspacePackages(runtime: ChildEnvRuntime, workspaceRoot: string, workspaceManifestPath?: string): Promise<Map<string, RegistryReleaseWorkspacePackage>>;
+/**
+ * The package directories the workspace at `root` declares, root excluded,
+ * through the kernel's inventory (`listDeclaredPackages`: workspaces plus
+ * `vibes.packageRoots`), or, for a named release manifest, its `patterns`
+ * through the same rules (`listPatternPackages`).
+ */
+export declare function declaredPackageDirectories(runtime: ChildEnvRuntime, root: string, patterns: readonly string[] | undefined): Promise<readonly string[]>;
+/** Select the exact package inventory before release-set planning begins. */
+export declare function collectRegistryReleaseWorkspaceInventory(options: {
+    runtime: ChildEnvRuntime;
+    workspaceRoot: string;
+    releaseWorkspaceManifest?: string;
+}): Promise<{
+    workspace: Map<string, RegistryReleaseWorkspacePackage>;
+    releaseWorkspacePaths?: RegistryReleaseWorkspacePaths;
+}>;
+//# sourceMappingURL=workspace-discovery.d.ts.map

package/dist/cli/npm/publish/workspace-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-discovery.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/workspace-discovery.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AASzE,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe;;;EAWzD;AAED,+DAA+D;AAC/D,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,KAAK,CAAC,EACzC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,EAAE,CAAC,CAsCnB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,MAAM,EAAE,EACrB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAeD,8DAA8D;AAC9D,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,aAAa,EAAE,MAAM,EACrB,qBAAqB,SAAiB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC,CA+KvD;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAS5B;AAED,6EAA6E;AAC7E,wBAAsB,wCAAwC,CAAC,OAAO,EAAE;IACtE,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IACxD,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACvD,CAAC,CA8BD"}