@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/shared/infer-apex-zone.d.ts

@@ -0,0 +1,18 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+export declare function extractApexZone(hostname: string): string;
+/** The bound workspace, and the runtime its deployment config is evaluated under. */
+export type ApexZoneRuntime = RuntimeRef & {
+    context<T = unknown>(id: string): Promise<T>;
+};
+/**
+ * Infer the apex DNS zone from the bound workspace's own deployment.config
+ * origins (an app checkout binds as its own workspace) when --zone is
+ * omitted. Nothing walks up for a config. A workspace with no deployment
+ * config, an unbound host, or a config that declares itself non-deployable
+ * infers no zone; a config that fails to load fails the command.
+ */
+export declare function inferApexZoneFromWorkspace(runtime: ApexZoneRuntime, options?: {
+    /** The resolved Cloudflare projection; identity-only reads default to an empty one. */
+    projectionEnvironment?: Readonly<Record<string, string>>;
+}): Promise<string | undefined>;
+//# sourceMappingURL=infer-apex-zone.d.ts.map

package/dist/cli/shared/infer-apex-zone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-apex-zone.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/infer-apex-zone.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAU/E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMxD;AAKD,qFAAqF;AACrF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IAC1C,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7C,CAAC;AAqCF;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE;IACR,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD,GACJ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkB7B"}

package/dist/cli/shared/infer-apex-zone.js

@@ -0,0 +1,75 @@
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { loadDeploymentConfig, NonDeployableDeploymentConfigError, resolveConfigLoadHost } from "../../config-loader.js";
+import { declaresDeployment } from "../../deployment-settings.js";
+export function extractApexZone(hostname) {
+    const parts = hostname.split('.');
+    if (parts.length >= 2) {
+        return parts.slice(-2).join('.');
+    }
+    return hostname;
+}
+/** One admitted deployment origin: the hostname is the only field zone inference reads. */
+const OriginHostnameSchema = z.object({ hostname: z.string().min(1) }).loose();
+/** The host I/O one zone inference resolves once: host-owned config probes. */
+async function resolveApexZoneHost(runtime) {
+    // The config loader's host handle is exactly the view a load performs its
+    // workspace deployment.config probes through.
+    return resolveConfigLoadHost(runtime);
+}
+/** The first origin hostname from a loaded deployment, skipping malformed entries. */
+function firstOriginHostname(origins) {
+    const entries = z.array(z.unknown()).safeParse(origins);
+    if (!entries.success)
+        return undefined;
+    for (const origin of entries.data) {
+        const admitted = OriginHostnameSchema.safeParse(origin);
+        if (admitted.success)
+            return extractApexZone(admitted.data.hostname);
+    }
+    return undefined;
+}
+/**
+ * The bound workspace, or null for a host bound to none. Only
+ * `workspace-unbound` (a confirmed absence) means "no workspace".
+ */
+async function boundWorkspace(runtime) {
+    const outcome = await settle(() => runtime.context('runtime/workspace-path'));
+    if (!outcome.ok) {
+        // Only the confirmed unbound absence answers "no workspace"; any other
+        // failure surfaces unchanged.
+        if (outcome.cause instanceof CapabilityError && outcome.cause.reason === 'workspace-unbound') {
+            return null;
+        }
+        throw outcome.cause;
+    }
+    return outcome.value;
+}
+/**
+ * Infer the apex DNS zone from the bound workspace's own deployment.config
+ * origins (an app checkout binds as its own workspace) when --zone is
+ * omitted. Nothing walks up for a config. A workspace with no deployment
+ * config, an unbound host, or a config that declares itself non-deployable
+ * infers no zone; a config that fails to load fails the command.
+ */
+export async function inferApexZoneFromWorkspace(runtime, options = {}) {
+    const workspaceRoot = await boundWorkspace(runtime);
+    if (!workspaceRoot)
+        return undefined;
+    const host = await resolveApexZoneHost(runtime);
+    if (!(await declaresDeployment(runtime, host, workspaceRoot)))
+        return undefined;
+    const loadOutcome = await settle(() => loadDeploymentConfig(workspaceRoot, {
+        runtime,
+        projectionEnvironment: options.projectionEnvironment ?? {}
+    }));
+    if (!loadOutcome.ok) {
+        // A config that declares itself non-deployable infers no zone; any other
+        // load failure fails the command unchanged.
+        if (loadOutcome.cause instanceof NonDeployableDeploymentConfigError)
+            return undefined;
+        throw loadOutcome.cause;
+    }
+    return firstOriginHostname(loadOutcome.value.deployment.origins ?? []);
+}
+//# sourceMappingURL=infer-apex-zone.js.map

package/dist/cli/shared/infer-apex-zone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infer-apex-zone.js","sourceRoot":"","sources":["../../../src/cli/shared/infer-apex-zone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,oBAAoB,EACpB,kCAAkC,EAClC,qBAAqB,EAErB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAO/E,+EAA+E;AAC/E,KAAK,UAAU,mBAAmB,CAAC,OAAwB;IAC1D,0EAA0E;IAC1E,8CAA8C;IAC9C,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,OAAgB;IAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,8BAA8B;QAC9B,IAAI,OAAO,CAAC,KAAK,YAAY,eAAe,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC9F,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAAwB,EACxB,UAGI,EAAE;IAEN,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAmB,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CACrC,oBAAoB,CAAC,aAAa,EAAE;QACnC,OAAO;QACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;KAC1D,CAAC,CACF,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,WAAW,CAAC,KAAK,YAAY,kCAAkC;YAAE,OAAO,SAAS,CAAC;QACtF,MAAM,WAAW,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/cli/shared/option-strings.d.ts

@@ -0,0 +1,2 @@
+export declare function readString(value: unknown): string | undefined;
+//# sourceMappingURL=option-strings.d.ts.map

package/dist/cli/shared/option-strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"option-strings.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/option-strings.ts"],"names":[],"mappings":"AAUA,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG7D"}

package/dist/cli/shared/option-strings.js

@@ -0,0 +1,13 @@
+/**
+ * One home for CLI option string readers. `readString` is the non-trimming
+ * reader: an option value that is a non-empty string, otherwise `undefined`.
+ * Commands whose options need trimming (npm publish) keep their own reader
+ * because trimming changes parsing semantics.
+ */
+import * as z from 'zod/v4';
+const NonEmptyStringSchema = z.string().min(1);
+export function readString(value) {
+    const parsed = NonEmptyStringSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+//# sourceMappingURL=option-strings.js.map

package/dist/cli/shared/option-strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"option-strings.js","sourceRoot":"","sources":["../../../src/cli/shared/option-strings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE/C,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC"}

package/dist/cli/shared/repository-collection.d.ts

@@ -0,0 +1,42 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type RuntimePath } from '@vibesdotdev/paths';
+import type { FileSystemAdapterInterface } from '@vibesdotdev/filesystem/interfaces/adapter';
+import { type RepositoryCollectionGroup, type RepositoryCollectionManifest } from '@vibesdotdev/config/repository-collection';
+/** The one runtime read this module makes: the bound workspace. */
+export interface WorkspaceBoundRuntime {
+    context<T = unknown>(id: string): Promise<T>;
+}
+/** The host I/O one collection read resolves once: the manifest read plus path mechanics. */
+export interface CollectionReadHost {
+    readonly files: FileSystemAdapterInterface;
+    readonly paths: RuntimePath;
+}
+/** Resolve the collection read host from the handed runtime. */
+export declare function resolveCollectionReadHost(runtime: RuntimeRef): Promise<CollectionReadHost>;
+/** A repository collection: the bound workspace root and its checkout manifest. */
+export interface RepositoryCollection {
+    readonly root: string;
+    readonly manifestPath: string;
+    readonly manifest: RepositoryCollectionManifest;
+}
+/**
+ * The Developer repository collection is the bound workspace
+ * (`runtime/workspace-path`) when that workspace declares
+ * `config/repositories.json`. Nothing walks up for the manifest: a nested
+ * checkout binds as its own workspace, so deploy tooling that needs the
+ * collection runs from its root or passes `--workspace-root <root>`.
+ */
+export declare function readBoundRepositoryCollection(runtime: WorkspaceBoundRuntime & RuntimeRef): Promise<RepositoryCollection>;
+/**
+ * Read the checkout manifest at `root` with the Config owner's schema. A root
+ * without one is `NOT_FOUND` `repository-collection-missing`; a manifest that
+ * cannot be read or parsed is a typed failure, never "no collection".
+ */
+export declare function readRepositoryCollection(host: CollectionReadHost, root: string): Promise<RepositoryCollection>;
+/** One registered checkout of `group`, named by the caller; no layout is inferred. */
+export declare function registeredCheckout(host: CollectionReadHost, collection: RepositoryCollection, group: RepositoryCollectionGroup, name: string): string;
+/** One registered split app's checkout (the manifest's `apps` group). */
+export declare function registeredAppCheckout(host: CollectionReadHost, collection: RepositoryCollection, appName: string): string;
+/** Every registered split app's checkout, in manifest order. */
+export declare function registeredAppCheckouts(host: CollectionReadHost, collection: RepositoryCollection): string[];
+//# sourceMappingURL=repository-collection.d.ts.map

package/dist/cli/shared/repository-collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-collection.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/repository-collection.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAIN,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,MAAM,2CAA2C,CAAC;AAEnD,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC5B;AAED,gEAAgE;AAChE,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAOhG;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAClD,OAAO,EAAE,qBAAqB,GAAG,UAAU,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAkBD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,oBAAoB,CAAC,CA6C/B;AAgCD,sFAAsF;AACtF,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,oBAAoB,EAChC,KAAK,EAAE,yBAAyB,EAChC,IAAI,EAAE,MAAM,GACV,MAAM,CAcR;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,MAAM,GACb,MAAM,CAER;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,oBAAoB,GAC9B,MAAM,EAAE,CAIV"}

package/dist/cli/shared/repository-collection.js

@@ -0,0 +1,111 @@
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem/client/resolve-adapter';
+import { REPOSITORY_COLLECTION_MANIFEST_PATH, RepositoryCollectionManifestSchema, repositoryGroupRoot } from '@vibesdotdev/config/repository-collection';
+/** Resolve the collection read host from the handed runtime. */
+export async function resolveCollectionReadHost(runtime) {
+    return {
+        // The collection root is named by the caller, not by the caller's
+        // workspace binding, so the manifest read goes through the host-owned view.
+        files: await resolveFileSystemAdapter(runtime, { binding: false }),
+        paths: await getRuntimePath(runtime)
+    };
+}
+/**
+ * The Developer repository collection is the bound workspace
+ * (`runtime/workspace-path`) when that workspace declares
+ * `config/repositories.json`. Nothing walks up for the manifest: a nested
+ * checkout binds as its own workspace, so deploy tooling that needs the
+ * collection runs from its root or passes `--workspace-root <root>`.
+ */
+export async function readBoundRepositoryCollection(runtime) {
+    // The bound root is read first so an unbound host refuses with
+    // workspace-unbound before any host kind is needed.
+    const root = await runtime.context('runtime/workspace-path');
+    return readRepositoryCollection(await resolveCollectionReadHost(runtime), root);
+}
+/** True when a read failure is the confirmed absence of the probed path. */
+function isMissingPathFailure(failure) {
+    if (failure instanceof CapabilityError)
+        return failure.code === 'NOT_FOUND';
+    // A raw host error carries its errno on the error itself.
+    const facts = MissingPathCodeSchema.safeParse(failure);
+    return facts.success && (facts.data.code === 'ENOENT' || facts.data.code === 'ENOTDIR');
+}
+/** The errno facts a raw host absence carries. */
+const MissingPathCodeSchema = z.object({ code: z.string().optional() }).loose();
+/** A host read as text: an unencoded read is bytes; a text read passes through. */
+function textOf(contents) {
+    return contents instanceof Uint8Array ? new TextDecoder().decode(contents) : contents;
+}
+/**
+ * Read the checkout manifest at `root` with the Config owner's schema. A root
+ * without one is `NOT_FOUND` `repository-collection-missing`; a manifest that
+ * cannot be read or parsed is a typed failure, never "no collection".
+ */
+export async function readRepositoryCollection(host, root) {
+    const collectionRoot = host.paths.resolve(root);
+    const manifestPath = host.paths.join(collectionRoot, REPOSITORY_COLLECTION_MANIFEST_PATH);
+    const read = await settle(async () => {
+        const raw = await host.files.readFile(manifestPath, 'utf8');
+        return textOf(raw);
+    });
+    if (!read.ok) {
+        if (isMissingPathFailure(read.cause)) {
+            throw new CapabilityError(`The workspace ${collectionRoot} is not a repository collection: ${manifestPath} does not exist.`, 'NOT_FOUND', {
+                reason: 'repository-collection-missing',
+                recoveryHint: 'Run from the repository collection root, or pass --workspace-root <collection root>.',
+                details: { root: collectionRoot, manifestPath }
+            });
+        }
+        throw new CapabilityError(`The repository checkout manifest ${manifestPath} cannot be read.`, 'PERMISSION_DENIED', { reason: 'fs-denied', details: { manifestPath }, cause: read.cause });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(read.value);
+    }
+    catch (error) {
+        throw new CapabilityError(`The repository checkout manifest ${manifestPath} is not valid JSON.`, 'INTERNAL', { reason: 'data-corrupt', details: { manifestPath }, cause: error });
+    }
+    const manifest = RepositoryCollectionManifestSchema.safeParse(parsed);
+    if (!manifest.success) {
+        throw new CapabilityError(`The repository checkout manifest ${manifestPath} does not match its schema.`, 'INTERNAL', { reason: 'data-corrupt', details: { manifestPath }, cause: manifest.error });
+    }
+    return { root: collectionRoot, manifestPath, manifest: manifest.data };
+}
+const REGISTERED_CHECKOUT_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** The checkout of a declared entry: its group's root (the manifest's layout) plus its name. */
+function groupCheckout(host, collection, group, name) {
+    const checkout = host.paths.resolve(collection.root, repositoryGroupRoot(collection.manifest, group), name);
+    const checkoutRelative = toPosix(host.paths.relative(collection.root, checkout));
+    if (!checkoutRelative || checkoutRelative === '..' || checkoutRelative.startsWith('../')) {
+        throw new CapabilityError(`Registered checkout escapes the repository collection root: ${checkout}`, 'INVALID_INPUT', { reason: 'checkout-escapes-collection', details: { checkout, root: collection.root } });
+    }
+    return checkout;
+}
+/** A relative path normalized to posix separators, so containment checks are host-neutral. */
+function toPosix(path) {
+    return path.split('\\').join('/');
+}
+/** One registered checkout of `group`, named by the caller; no layout is inferred. */
+export function registeredCheckout(host, collection, group, name) {
+    if (!REGISTERED_CHECKOUT_NAME.test(name)) {
+        throw new CapabilityError(`Invalid registered checkout name: ${name}`, 'INVALID_INPUT', {
+            reason: 'checkout-name-invalid'
+        });
+    }
+    if (!collection.manifest.repositories[group].some((entry) => entry.name === name)) {
+        throw new CapabilityError(`${name} is not registered under ${group} in ${collection.manifestPath}.`, 'NOT_FOUND', { reason: 'checkout-not-registered', details: { group, name, manifestPath: collection.manifestPath } });
+    }
+    return groupCheckout(host, collection, group, name);
+}
+/** One registered split app's checkout (the manifest's `apps` group). */
+export function registeredAppCheckout(host, collection, appName) {
+    return registeredCheckout(host, collection, 'apps', appName);
+}
+/** Every registered split app's checkout, in manifest order. */
+export function registeredAppCheckouts(host, collection) {
+    return collection.manifest.repositories.apps.map((entry) => groupCheckout(host, collection, 'apps', entry.name));
+}
+//# sourceMappingURL=repository-collection.js.map

package/dist/cli/shared/repository-collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-collection.js","sourceRoot":"","sources":["../../../src/cli/shared/repository-collection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAuC,MAAM,qBAAqB,CAAC;AACnG,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAE1F,OAAO,EACN,mCAAmC,EACnC,kCAAkC,EAClC,mBAAmB,EAGnB,MAAM,2CAA2C,CAAC;AAanD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAmB;IAClE,OAAO;QACN,kEAAkE;QAClE,4EAA4E;QAC5E,KAAK,EAAE,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClE,KAAK,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC;KACpC,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,OAA2C;IAE3C,+DAA+D;IAC/D,oDAAoD;IACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;IACrE,OAAO,wBAAwB,CAAC,MAAM,yBAAyB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,OAAsB;IACnD,IAAI,OAAO,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;IAC5E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACzF,CAAC;AAED,kDAAkD;AAClD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAEhF,mFAAmF;AACnF,SAAS,MAAM,CAAC,QAA6B;IAC5C,OAAO,QAAQ,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,IAAwB,EACxB,IAAY;IAEZ,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CACxB,iBAAiB,cAAc,oCAAoC,YAAY,kBAAkB,EACjG,WAAW,EACX;gBACC,MAAM,EAAE,+BAA+B;gBACvC,YAAY,EACX,sFAAsF;gBACvF,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE;aAC/C,CACD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,eAAe,CACxB,oCAAoC,YAAY,kBAAkB,EAClE,mBAAmB,EACnB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CACrE,CAAC;IACH,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACxB,oCAAoC,YAAY,qBAAqB,EACrE,UAAU,EACV,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CACnE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,kCAAkC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACxB,oCAAoC,YAAY,6BAA6B,EAC7E,UAAU,EACV,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC5E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAE9D,gGAAgG;AAChG,SAAS,aAAa,CACrB,IAAwB,EACxB,UAAgC,EAChC,KAAgC,EAChC,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAClC,UAAU,CAAC,IAAI,EACf,mBAAmB,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC/C,IAAI,CACJ,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,eAAe,CACxB,+DAA+D,QAAQ,EAAE,EACzE,eAAe,EACf,EAAE,MAAM,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CACjC,IAAwB,EACxB,UAAgC,EAChC,KAAgC,EAChC,IAAY;IAEZ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,qCAAqC,IAAI,EAAE,EAAE,eAAe,EAAE;YACvF,MAAM,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,eAAe,CACxB,GAAG,IAAI,4BAA4B,KAAK,OAAO,UAAU,CAAC,YAAY,GAAG,EACzE,WAAW,EACX,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,EAAE,CACtG,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACpC,IAAwB,EACxB,UAAgC,EAChC,OAAe;IAEf,OAAO,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CACrC,IAAwB,EACxB,UAAgC;IAEhC,OAAO,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1D,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CACnD,CAAC;AACH,CAAC"}

package/dist/cli/shared/runtime-execution.d.ts

@@ -0,0 +1,78 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ExecutionOutputLine, type RuntimeExecution } from '@vibesdotdev/kernel/execution';
+export { resolveRuntimeExecution } from '../../runtime-execution.ts';
+export type { ExecutionOutputLine } from '@vibesdotdev/kernel/execution';
+/**
+ * The runtime a child runs on: its environment is composed from it
+ * (`composeChildEnv`), its deadlines are its lifecycle's, and a failure the
+ * call continues past is reported through its logger (C083a).
+ */
+export type ChildEnvRuntime = RuntimeRef;
+/**
+ * bun, npm and node on the release rail and in builds receive the Registry
+ * token only as a declared variable the caller resolved as a credential
+ * ({@link registryTokenEnv}); the compose-root npmrc interpolates it
+ * (`//packages.vibes.dev/:_authToken=${VIBES_REGISTRY_TOKEN}`, npm-exec.ts)
+ * and bunfig scopes read it (`token = "$VIBES_REGISTRY_TOKEN"`). It is never
+ * inherited from the host, so an ambient `VIBES_REGISTRY_TOKEN` cannot reach a
+ * child. No NPM_CONFIG_* or BUN_* is inherited: isolated npm runs declare
+ * their own (npm-exec.ts `isolatedNpmPackEnv`).
+ */
+export declare function registryTokenEnv(runtime: Pick<RuntimeRef, 'resolveCredential'>): Promise<Record<string, string>>;
+/**
+ * The Registry token when the runtime resolves one, and no declaration when it
+ * cannot. For children that never authenticate to the Vibes Registry — a
+ * wrangler/D1 child resolves its program from public npm — the token is an
+ * optional pass-through, so a host with no Registry credential (any public
+ * end-user) still runs `vibes infra db --local` (SPEC: local D1 execution
+ * needs no credentials). Children that authenticate to the Registry keep using
+ * {@link registryTokenEnv}, which fails typed on a missing credential.
+ */
+export declare function optionalRegistryTokenEnv(runtime: Pick<RuntimeRef, 'resolveCredential'>): Promise<Record<string, string>>;
+/** Apple tooling (xcrun, codesign, ditto, hdiutil): the selected developer directory. The keychain resolves through the user session and HOME. */
+export declare const APPLE_TOOL_ENV: readonly ["DEVELOPER_DIR"];
+/**
+ * docker and kubectl: their context selectors and config, and the SSH agent an
+ * `ssh://` docker context dials through (release/shared/declared-child.ts,
+ * workers/infra-workers-logs.cli-command.impl.ts).
+ */
+export declare const CONTAINER_TOOL_ENV: readonly ["DOCKER_HOST", "DOCKER_CONFIG", "DOCKER_CONTEXT", "KUBECONFIG", "SSH_AUTH_SOCK"];
+/** Budget for `SIGKILL` to be accepted by the execution provider. */
+export declare const RUNTIME_COMMAND_KILL_BUDGET_MS = 5000;
+/** Budget for a killed child's output pipes to close and its stdin delivery to settle. */
+export declare const RUNTIME_COMMAND_DRAIN_BUDGET_MS = 5000;
+export declare function runRuntimeCommand(input: {
+    /** The runtime the child's environment is composed from. */
+    runtime: ChildEnvRuntime;
+    execution: Pick<RuntimeExecution, 'spawn'>;
+    command: string;
+    args?: string[];
+    cwd?: string;
+    /** Variables the child declares; they win over inherited ones. */
+    env?: Record<string, string>;
+    /** Host variables the child names (one of the declarations above). */
+    inheritEnv?: readonly string[];
+    /** Keys removed after the environment is composed. */
+    unsetEnv?: string[];
+    /** Bound the child lifetime (spawn included) through the runtime lifecycle. */
+    timeout?: number;
+    /** Signal descendants when the command handle is killed, even without a timeout. */
+    killTree?: boolean;
+    /** Bound the `SIGKILL` after a timeout or failure. Defaults to {@link RUNTIME_COMMAND_KILL_BUDGET_MS}. */
+    killBudgetMs?: number;
+    /** Bound the join of the output pipes after a kill. Defaults to {@link RUNTIME_COMMAND_DRAIN_BUDGET_MS}. */
+    drainBudgetMs?: number;
+    /**
+     * Text piped to the child's stdin then closed (e.g. `docker login
+     * --password-stdin`). Never logged — callers must not also pass a
+     * credential via `args`/`onLine`. Omit for the previous `stdin: 'ignore'`
+     * behavior.
+     */
+    stdin?: string;
+    onLine?: ExecutionOutputLine;
+}): Promise<{
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}>;
+//# sourceMappingURL=runtime-execution.d.ts.map

package/dist/cli/shared/runtime-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-execution.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/runtime-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,YAAY,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC;AAezC;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAGjC;AAED,kJAAkJ;AAClJ,eAAO,MAAM,cAAc,4BAA6B,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,4FAA6F,CAAC;AAE7H,qEAAqE;AACrE,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,0FAA0F;AAC1F,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAQrD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC9C,4DAA4D;IAC5D,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sEAAsE;IACtE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0GAA0G;IAC1G,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4GAA4G;IAC5G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmInE"}

package/dist/cli/shared/runtime-execution.js

@@ -0,0 +1,182 @@
+import { CapabilityError, composeChildEnv, settle } from '@vibesdotdev/kernel';
+import { collectProcessOutput } from '@vibesdotdev/kernel/execution';
+import { getLogger } from '@vibesdotdev/logging';
+export { resolveRuntimeExecution } from "../../runtime-execution.js";
+/*
+ * Every child runs with `envMode: 'replace'` and exactly the kernel's composed
+ * environment (rc02-rc03 C15): the host base set (search path, home, locale,
+ * temp, the host's re-entry facts and roots), the host variables its caller
+ * names below, and the variables it declares. Nothing else from the host, and
+ * no Vibes credential, reaches git hooks, package lifecycle scripts or docker.
+ */
+/*
+ * git children name `GIT_CHILD_ENV`, the one git declaration, owned by
+ * `@vibesdotdev/git-operations/core`.
+ */
+/**
+ * bun, npm and node on the release rail and in builds receive the Registry
+ * token only as a declared variable the caller resolved as a credential
+ * ({@link registryTokenEnv}); the compose-root npmrc interpolates it
+ * (`//packages.vibes.dev/:_authToken=${VIBES_REGISTRY_TOKEN}`, npm-exec.ts)
+ * and bunfig scopes read it (`token = "$VIBES_REGISTRY_TOKEN"`). It is never
+ * inherited from the host, so an ambient `VIBES_REGISTRY_TOKEN` cannot reach a
+ * child. No NPM_CONFIG_* or BUN_* is inherited: isolated npm runs declare
+ * their own (npm-exec.ts `isolatedNpmPackEnv`).
+ */
+export async function registryTokenEnv(runtime) {
+    const resolved = await runtime.resolveCredential({ source: 'secret', key: 'VIBES_REGISTRY_TOKEN' });
+    if (!resolved.ok)
+        throw resolved.error;
+    return { VIBES_REGISTRY_TOKEN: resolved.value };
+}
+/**
+ * The Registry token when the runtime resolves one, and no declaration when it
+ * cannot. For children that never authenticate to the Vibes Registry — a
+ * wrangler/D1 child resolves its program from public npm — the token is an
+ * optional pass-through, so a host with no Registry credential (any public
+ * end-user) still runs `vibes infra db --local` (SPEC: local D1 execution
+ * needs no credentials). Children that authenticate to the Registry keep using
+ * {@link registryTokenEnv}, which fails typed on a missing credential.
+ */
+export async function optionalRegistryTokenEnv(runtime) {
+    const resolved = await runtime.resolveCredential({ source: 'secret', key: 'VIBES_REGISTRY_TOKEN' });
+    return resolved.ok ? { VIBES_REGISTRY_TOKEN: resolved.value } : {};
+}
+/** Apple tooling (xcrun, codesign, ditto, hdiutil): the selected developer directory. The keychain resolves through the user session and HOME. */
+export const APPLE_TOOL_ENV = ['DEVELOPER_DIR'];
+/**
+ * docker and kubectl: their context selectors and config, and the SSH agent an
+ * `ssh://` docker context dials through (release/shared/declared-child.ts,
+ * workers/infra-workers-logs.cli-command.impl.ts).
+ */
+export const CONTAINER_TOOL_ENV = ['DOCKER_HOST', 'DOCKER_CONFIG', 'DOCKER_CONTEXT', 'KUBECONFIG', 'SSH_AUTH_SOCK'];
+/** Budget for `SIGKILL` to be accepted by the execution provider. */
+export const RUNTIME_COMMAND_KILL_BUDGET_MS = 5_000;
+/** Budget for a killed child's output pipes to close and its stdin delivery to settle. */
+export const RUNTIME_COMMAND_DRAIN_BUDGET_MS = 5_000;
+function isWaitTimeout(error) {
+    return error instanceof CapabilityError && error.code === 'TIMEOUT' && error.reason === 'wait-timeout';
+}
+export async function runRuntimeCommand(input) {
+    const { lifecycle } = input.runtime;
+    // Validation before any side effect: an invalid environment fails here, before spawn.
+    const declaration = { env: input.env ?? {} };
+    if (input.inheritEnv)
+        declaration.inheritEnv = [...input.inheritEnv];
+    const env = composeChildEnv(input.runtime, declaration);
+    const killBudgetMs = input.killBudgetMs ?? RUNTIME_COMMAND_KILL_BUDGET_MS;
+    const drainBudgetMs = input.drainBudgetMs ?? RUNTIME_COMMAND_DRAIN_BUDGET_MS;
+    let spawning;
+    let spawned;
+    let output;
+    let inputDelivery;
+    const work = async () => {
+        spawning = Promise.resolve().then(() => input.execution.spawn({
+            command: input.command,
+            args: input.args,
+            cwd: input.cwd,
+            env,
+            envMode: 'replace',
+            unsetEnv: input.unsetEnv,
+            killTree: input.killTree ?? (input.timeout !== undefined),
+            stdin: input.stdin !== undefined ? 'pipe' : 'ignore',
+            stdout: 'pipe',
+            stderr: 'pipe'
+        }));
+        const child = await spawning;
+        spawned = child;
+        const collected = collectProcessOutput(child, input.onLine);
+        output = collected;
+        inputDelivery = (async () => {
+            if (input.stdin !== undefined && child.stdin) {
+                const writer = child.stdin.getWriter();
+                try {
+                    await writer.write(new TextEncoder().encode(input.stdin));
+                    await writer.close();
+                }
+                finally {
+                    writer.releaseLock();
+                }
+            }
+        })();
+        const [, result] = await Promise.all([inputDelivery, collected]);
+        return result;
+    };
+    /** Kill the child and join its output, each bounded; typed failures never hang. */
+    const reap = async () => {
+        const child = spawned;
+        if (!child) {
+            // A hung spawn: the deadline already failed the call. If the provider
+            // ever hands the child back, kill it then.
+            // Non-blocking by design: the caller already has its typed failure. Both
+            // outcomes are reported through the package logger, never dropped.
+            const log = getLogger('infra-deploy', input.runtime);
+            void (async () => {
+                const lateOutcome = await settle(async () => {
+                    const late = await spawning;
+                    // SAFETY: a resolved spawn answers the child handle; the promise's
+                    // own type marks it possibly undefined only for the void path.
+                    if (!late)
+                        throw new Error('no child to reap');
+                    return late;
+                });
+                if (!lateOutcome.ok) {
+                    log.warn('Spawn failed after its deadline; no child to reap', { error: lateOutcome.cause });
+                    return;
+                }
+                const killOutcome = await settle(() => lateOutcome.value.kill('SIGKILL'));
+                if (!killOutcome.ok) {
+                    log.warn('Late-spawned child refused SIGKILL after its deadline', { error: killOutcome.cause });
+                }
+            })();
+            return;
+        }
+        const killOutcome = await settle(() => lifecycle.wait(async () => { await child.kill('SIGKILL'); }, {
+            timeoutMs: killBudgetMs,
+            reason: `SIGKILL of ${input.command}`
+        }));
+        if (!killOutcome.ok) {
+            if (!isWaitTimeout(killOutcome.cause)) {
+                // The kill itself failed (for example ESRCH on a child that already
+                // exited). That is secondary to the failure that brought us here: report
+                // it, then still join the pipes so the primary failure is what surfaces.
+                const log = getLogger('infra-deploy', input.runtime);
+                log.warn(`SIGKILL of ${input.command} failed while reaping`, { error: killOutcome.cause });
+                return joinOutput();
+            }
+            throw new CapabilityError(`Runtime command ${input.command} did not accept SIGKILL within ${killBudgetMs}ms.`, 'TIMEOUT', { reason: 'kill-timeout', details: { command: input.command, killBudgetMs }, cause: killOutcome.cause });
+        }
+        await joinOutput();
+    };
+    /** Join the output pipes and stdin delivery, bounded; typed failure when they never close. */
+    const joinOutput = async () => {
+        const pending = [inputDelivery, output].filter((join) => join !== undefined);
+        try {
+            // Rejections here are the killed child's expected stream teardown; the caller
+            // gets the primary failure, and this join only proves the pipes closed.
+            await lifecycle.wait(async () => { await Promise.allSettled(pending); }, {
+                timeoutMs: drainBudgetMs,
+                reason: `output of ${input.command} to close`
+            });
+        }
+        catch (error) {
+            if (!isWaitTimeout(error))
+                throw error;
+            throw new CapabilityError(`Runtime command ${input.command} output did not close within ${drainBudgetMs}ms of SIGKILL.`, 'TIMEOUT', { reason: 'output-drain-timeout', details: { command: input.command, drainBudgetMs } });
+        }
+    };
+    try {
+        if (input.timeout === undefined)
+            return await work();
+        // The deadline is armed before `spawn` is called, so a hung spawn also times out.
+        return await lifecycle.wait(work, { timeoutMs: input.timeout, reason: `command ${input.command}` });
+    }
+    catch (error) {
+        if (!isWaitTimeout(error))
+            throw error;
+        const failure = new CapabilityError(`Runtime command timed out after ${input.timeout}ms: ${input.command}`, 'TIMEOUT', { reason: 'command-timeout', details: { command: input.command, timeoutMs: input.timeout }, cause: error });
+        await reap();
+        throw failure;
+    }
+}
+//# sourceMappingURL=runtime-execution.js.map

package/dist/cli/shared/runtime-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-execution.js","sourceRoot":"","sources":["../../../src/cli/shared/runtime-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACN,oBAAoB,EAGpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAUrE;;;;;;GAMG;AAEH;;;GAGG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA8C;IAE9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpG,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,eAAe,CAAU,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,CAAU,CAAC;AAE7H,qEAAqE;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AACpD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAIrD,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KA6BvC;IACA,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,sFAAsF;IACtF,MAAM,WAAW,GAA0C,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;IACpF,IAAI,KAAK,CAAC,UAAU;QAAE,WAAW,CAAC,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,8BAA8B,CAAC;IAC1E,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAC7E,IAAI,QAA6C,CAAC;IAClD,IAAI,OAAmC,CAAC;IACxC,IAAI,MAAoC,CAAC;IACzC,IAAI,aAAwC,CAAC;IAE7C,MAAM,IAAI,GAAG,KAAK,IAAsE,EAAE;QACzF,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CACtC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YACrB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG;YACH,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACpD,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACd,CAAC,CACF,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC;QAC7B,OAAO,GAAG,KAAK,CAAC;QAChB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,GAAG,SAAS,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACJ,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC1D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC;wBAAS,CAAC;oBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC;YACpC,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IAEF,mFAAmF;IACnF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,sEAAsE;YACtE,2CAA2C;YAC3C,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrD,KAAK,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;oBAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;oBAC5B,mEAAmE;oBACnE,+DAA+D;oBAC/D,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;oBAC/C,OAAO,IAAI,CAAC;gBACb,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC5F,OAAO;gBACR,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1E,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;gBACjG,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;YACL,OAAO;QACR,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CACrC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,SAAS,EAAE,YAAY;YACvB,MAAM,EAAE,cAAc,KAAK,CAAC,OAAO,EAAE;SACrC,CAAC,CACF,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACrB,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,oEAAoE;gBACpE,yEAAyE;gBACzE,yEAAyE;gBACzE,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,OAAO,uBAAuB,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3F,OAAO,UAAU,EAAE,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,eAAe,CACxB,mBAAmB,KAAK,CAAC,OAAO,kCAAkC,YAAY,KAAK,EACnF,SAAS,EACT,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CACvG,CAAC;QACH,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,8FAA8F;IAC9F,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAA4B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACvG,IAAI,CAAC;YACJ,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACxE,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,aAAa,KAAK,CAAC,OAAO,WAAW;aAC7C,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACvC,MAAM,IAAI,eAAe,CACxB,mBAAmB,KAAK,CAAC,OAAO,gCAAgC,aAAa,gBAAgB,EAC7F,SAAS,EACT,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,CACtF,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IAEF,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,MAAM,IAAI,EAAE,CAAC;QACrD,kFAAkF;QAClF,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,eAAe,CAClC,mCAAmC,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,OAAO,EAAE,EACtE,SAAS,EACT,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAC1G,CAAC;QACF,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,CAAC;IACf,CAAC;AACF,CAAC"}

package/dist/cli/shared/workspace-artifact-lock.d.ts

@@ -0,0 +1,17 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type HeldOwnerLock } from '@vibesdotdev/filesystem';
+import type { ExecutionOutputLine } from './runtime-execution.ts';
+export declare const WORKSPACE_ARTIFACT_LOCK_PARTS: readonly [".cache", "infra-deploy", "workspace-artifacts.lock"];
+/** A deployment carries its existing claim through nested build callbacks. */
+export interface WorkspaceArtifactLock {
+    readonly workspaceRoot: string;
+    readonly held: HeldOwnerLock;
+}
+/** Keep one workspace's emitted dependencies stable until their consumer finishes. */
+export declare function withWorkspaceArtifactLock<T>(input: {
+    runtime: RuntimeRef;
+    workspaceRoot: string;
+    artifactLock?: WorkspaceArtifactLock;
+    onLine?: ExecutionOutputLine;
+}, operation: (lock: WorkspaceArtifactLock) => Promise<T>): Promise<T>;
+//# sourceMappingURL=workspace-artifact-lock.d.ts.map

package/dist/cli/shared/workspace-artifact-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-artifact-lock.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/workspace-artifact-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAEN,KAAK,aAAa,EAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,eAAO,MAAM,6BAA6B,iEAAkE,CAAC;AAG7G,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC7B;AAED,sFAAsF;AACtF,wBAAsB,yBAAyB,CAAC,CAAC,EAChD,KAAK,EAAE;IACN,OAAO,EAAE,UAAU,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC7B,EACD,SAAS,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,CAAC,CAAC,GACpD,OAAO,CAAC,CAAC,CAAC,CA8BZ"}