@vibesdotdev/plugins 0.0.0-stage → 1.0.0-rc.1

package/dist/cli/plugins.unlink.cli-command.impl.consumer.d.ts

@@ -0,0 +1,76 @@
+import type { CommandExecutionStartInfo } from '@vibesdotdev/cli/schemas/surface';
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/types';
+import { CapabilityError, type RuntimePackagePlugins } from '@vibesdotdev/kernel';
+import { type WorkspacePluginListing } from '@vibesdotdev/kernel/bootstrap';
+import { PluginsCLICommand, type PluginsCLIContext } from './context.ts';
+import type { StrandedMember } from './schemas/unlink.ts';
+/**
+ * Which members of the glob about to be dropped are still selected.
+ *
+ * Pure and exported: the refusal below is the difference between a command
+ * that says no and a command that bricks the scope, so it is a unit test
+ * rather than a claim about a code path nobody re-runs. A specifier's package
+ * is the host's package-plugin rule (`packages.getPackageName`).
+ */
+export declare function findStrandedMembers(input: {
+    members: readonly string[];
+    plugins: readonly string[];
+    dependencies: Readonly<Record<string, string>>;
+}, packages: Pick<RuntimePackagePlugins, 'getPackageName'>): StrandedMember[];
+/**
+ * The refusal when the scope's plugin declarations could not be read (a
+ * `vibes.config.ts` that throws on import, a `package.json` that is not JSON).
+ * The enabled list is then unknown, so the safety check cannot run: the
+ * command fails closed, naming every file that failed, and never falls back to
+ * the manifest list or to "nothing enabled".
+ */
+export declare function unreadableSelectionsRefusal(listing: WorkspacePluginListing): CapabilityError;
+/** The refusal `vibes plugins unlink` prints instead of wedging the scope. */
+export declare function formatStrandedRefusal(input: {
+    glob: string;
+    scope: string;
+    root: string;
+    stranded: readonly StrandedMember[];
+}): string;
+/**
+ * `vibes plugins unlink <glob>` — drop a link glob and re-install the scope.
+ *
+ * ### The check happens BEFORE the write, because the remedy has to be reachable
+ *
+ * The draft removed the glob, ran `bun install`, and printed the still-selected
+ * members afterwards. Measured: the install FAILS (`error: Workspace dependency
+ * "@fx/local" not found`), so the line naming the remedy was never reached, the
+ * manifest was left with a dangling `workspace:*` dependency, and neither
+ * `vibes update` nor `vibes update --repair` could re-install the scope. A
+ * diagnostic printed after the step that cannot survive is not a diagnostic.
+ *
+ * So a glob that still supplies an ENABLED specifier or a `workspace:`
+ * dependency is refused up front, with `vibes plugins remove` as the exact next
+ * command — including under `--dry-run`, because "Would unlink" for an
+ * operation the real run refuses is the same lie in a quieter voice. We still
+ * do not silently disable anything: which of "unlink" and "remove" the user
+ * meant is their decision, and quietly editing the plugin list to make a
+ * command succeed is exactly the silent repair this program is removing.
+ */
+export default class PluginsUnlinkCLICommand extends PluginsCLICommand {
+    constructor(descriptor: CLICommandAssetDescriptor, context: PluginsCLIContext);
+    execute(args: CommandExecutionStartInfo['args'], options: CommandExecutionStartInfo['options']): Promise<void>;
+    /**
+     * Specifiers the scope currently has ENABLED (the plugin list, not the deps).
+     *
+     * Read through the same resolution the workspace composition reads
+     * (`vibes.config.{ts,js,json}#plugins` primary,
+     * `package.json#vibes.plugins` fallback): Runtime's one reader over the
+     * handed runtime's selected `runtime/loader`. This is a SAFETY read: it is what
+     * stops `vibes plugins unlink` from dropping a glob that still supplies an
+     * enabled plugin. Resolving it through the writer's target resolver
+     * (`resolveWorkspaceListTarget`) reported an empty list for a
+     * `vibes.config.ts`, so the refusal could not fire for exactly the workspaces
+     * that use the documented surface. A declaration that failed to load
+     * refuses (`workspace-selections-unreadable`): an unknown list is never read
+     * as the manifest's or as empty.
+     */
+    private selectionsFor;
+    private report;
+}
+//# sourceMappingURL=plugins.unlink.cli-command.impl.consumer.d.ts.map

package/dist/cli/plugins.unlink.cli-command.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.unlink.cli-command.impl.consumer.d.ts","sourceRoot":"","sources":["../../src/cli/plugins.unlink.cli-command.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EACN,eAAe,EAIf,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEzG,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ1D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE;IACN,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC/C,EACD,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAY5F;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CACpC,GAAG,MAAM,CAkBT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,iBAAiB;gBACzD,UAAU,EAAE,yBAAyB,EAAE,OAAO,EAAE,iBAAiB;IAIvE,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsEpH;;;;;;;;;;;;;;OAcG;YACW,aAAa;IAW3B,OAAO,CAAC,MAAM;CAuBd"}

package/dist/cli/plugins.unlink.cli-command.impl.consumer.js

@@ -0,0 +1,190 @@
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { CapabilityError, getRuntimePackagePlugins } from '@vibesdotdev/kernel';
+import { readWorkspacePluginSurfaces } from '@vibesdotdev/kernel/bootstrap';
+import { z } from 'zod/v4';
+import { PluginsCLICommand } from "./context.js";
+import { runBunOrThrow } from "./package-manager.consumer.js";
+import { resolveSingleScope } from "./scopes.js";
+/** The command's inputs, each read on its own: a missing or non-text glob is empty, a missing flag is off. */
+const UnlinkInputSchema = z.object({
+    glob: z.string().trim().catch(''),
+    dryRun: z.boolean().catch(false)
+});
+/**
+ * Which members of the glob about to be dropped are still selected.
+ *
+ * Pure and exported: the refusal below is the difference between a command
+ * that says no and a command that bricks the scope, so it is a unit test
+ * rather than a claim about a code path nobody re-runs. A specifier's package
+ * is the host's package-plugin rule (`packages.getPackageName`).
+ */
+export function findStrandedMembers(input, packages) {
+    const stranded = [];
+    for (const name of input.members) {
+        const enabledBy = input.plugins.filter((specifier) => packages.getPackageName(specifier) === name);
+        const range = input.dependencies[name];
+        const declaredAs = range?.startsWith('workspace:') ? range : null;
+        if (enabledBy.length === 0 && declaredAs === null)
+            continue;
+        stranded.push({ name, enabledBy, declaredAs });
+    }
+    return stranded;
+}
+/**
+ * The refusal when the scope's plugin declarations could not be read (a
+ * `vibes.config.ts` that throws on import, a `package.json` that is not JSON).
+ * The enabled list is then unknown, so the safety check cannot run: the
+ * command fails closed, naming every file that failed, and never falls back to
+ * the manifest list or to "nothing enabled".
+ */
+export function unreadableSelectionsRefusal(listing) {
+    const files = listing.failures.map((failure) => failure.path);
+    const [first] = listing.failures;
+    const cause = listing.failures.length === 1 && first
+        ? first.error
+        : new AggregateError(listing.failures.map((failure) => failure.error), 'Workspace plugin declarations failed to load');
+    return new CapabilityError(`Cannot read the plugin selections of ${listing.root}: ${files.join(', ')} failed to load. ` +
+        'Nothing was changed; fix the file and re-run.', 'INVALID_INPUT', { reason: 'workspace-selections-unreadable', retryable: false, details: { root: listing.root, files }, cause });
+}
+/** The refusal `vibes plugins unlink` prints instead of wedging the scope. */
+export function formatStrandedRefusal(input) {
+    const detail = input.stranded
+        .map((member) => {
+        const parts = [
+            ...(member.enabledBy.length ? [`enabled by ${member.enabledBy.join(', ')}`] : []),
+            ...(member.declaredAs ? [`declared '${member.declaredAs}'`] : [])
+        ];
+        return `${member.name} (${parts.join('; ')})`;
+    })
+        .join(', ');
+    const names = input.stranded.map((member) => member.name).join(' ');
+    return (`Refusing to unlink '${input.glob}' from the ${input.scope} scope (${input.root}): it still ` +
+        `supplies ${input.stranded.length} selected member(s) — ${detail}. Dropping the glob now ` +
+        `leaves a declaration bun cannot resolve, so the next install fails with ` +
+        `'Workspace dependency not found' and the scope stops booting. Disable them first, then ` +
+        `re-run this unlink:\n  vibes plugins remove --${input.scope} ${names}`);
+}
+/**
+ * `vibes plugins unlink <glob>` — drop a link glob and re-install the scope.
+ *
+ * ### The check happens BEFORE the write, because the remedy has to be reachable
+ *
+ * The draft removed the glob, ran `bun install`, and printed the still-selected
+ * members afterwards. Measured: the install FAILS (`error: Workspace dependency
+ * "@fx/local" not found`), so the line naming the remedy was never reached, the
+ * manifest was left with a dangling `workspace:*` dependency, and neither
+ * `vibes update` nor `vibes update --repair` could re-install the scope. A
+ * diagnostic printed after the step that cannot survive is not a diagnostic.
+ *
+ * So a glob that still supplies an ENABLED specifier or a `workspace:`
+ * dependency is refused up front, with `vibes plugins remove` as the exact next
+ * command — including under `--dry-run`, because "Would unlink" for an
+ * operation the real run refuses is the same lie in a quieter voice. We still
+ * do not silently disable anything: which of "unlink" and "remove" the user
+ * meant is their decision, and quietly editing the plugin list to make a
+ * command succeed is exactly the silent repair this program is removing.
+ */
+export default class PluginsUnlinkCLICommand extends PluginsCLICommand {
+    constructor(descriptor, context) {
+        super(descriptor, context);
+    }
+    async execute(args, options) {
+        const flags = { ...args, ...options };
+        const input = UnlinkInputSchema.parse({ ...flags, glob: args.glob });
+        const raw = input.glob;
+        if (!raw)
+            throw new Error('plugins unlink requires the exact glob to remove');
+        const scope = await resolveSingleScope(this.runtime, flags, { fallback: 'global' });
+        const plugins = await getRuntimePackagePlugins(this.runtime);
+        const paths = await getRuntimePath(this.runtime);
+        const current = plugins.readWorkspaceGlobs(scope.root);
+        // Accept the glob as written, or as the caller happens to have typed the
+        // path (absolute where the manifest is relative and vice versa).
+        const candidates = new Set([
+            raw,
+            paths.isAbsolute(raw) ? paths.relative(scope.root, raw) : paths.resolve(scope.root, raw)
+        ]);
+        const glob = current.find((entry) => candidates.has(entry));
+        if (!glob) {
+            throw new Error(`the ${scope.kind} scope (${scope.root}) does not link '${raw}'. ` +
+                `Linked globs: ${current.join(', ') || 'none'}`);
+        }
+        const members = [...plugins.expandWorkspaceMembers(scope.root, [glob]).keys()].sort();
+        const stranded = findStrandedMembers({
+            members,
+            plugins: await this.selectionsFor(plugins, scope),
+            dependencies: plugins.readScopeDependencies(scope.root)
+        }, plugins);
+        if (stranded.length) {
+            throw new Error(formatStrandedRefusal({ glob, scope: scope.kind, root: scope.root, stranded }));
+        }
+        if (input.dryRun) {
+            this.report(plugins, { scope: scope.kind, root: scope.root, glob, members, removed: false, dryRun: true });
+            return;
+        }
+        const removed = await plugins.removeWorkspaceGlob(scope.root, glob);
+        try {
+            await runBunOrThrow({ runtime: this.runtime, action: 'install', cwd: scope.root });
+        }
+        catch (error) {
+            // Nothing selected this glob's members (checked above), so an install
+            // failure here is something else — a foreign declaration, a broken
+            // sibling glob. Re-state what was already written and how to undo it,
+            // because the manifest has changed and the bun error alone does not
+            // say so. The install failure itself stays the cause.
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new CapabilityError(`${detail}\n` +
+                `'${glob}' was already removed from ${scope.root}/package.json` +
+                `${members.length ? ` (members: ${members.join(', ')})` : ''}. ` +
+                `Restore it with: vibes plugins link '${glob}' --${scope.kind}`, 'UNAVAILABLE', {
+                reason: 'plugin-unlink-install-failed',
+                retryable: false,
+                details: { root: scope.root, glob, members },
+                cause: error
+            });
+        }
+        this.report(plugins, { scope: scope.kind, root: scope.root, glob, members, removed });
+    }
+    /**
+     * Specifiers the scope currently has ENABLED (the plugin list, not the deps).
+     *
+     * Read through the same resolution the workspace composition reads
+     * (`vibes.config.{ts,js,json}#plugins` primary,
+     * `package.json#vibes.plugins` fallback): Runtime's one reader over the
+     * handed runtime's selected `runtime/loader`. This is a SAFETY read: it is what
+     * stops `vibes plugins unlink` from dropping a glob that still supplies an
+     * enabled plugin. Resolving it through the writer's target resolver
+     * (`resolveWorkspaceListTarget`) reported an empty list for a
+     * `vibes.config.ts`, so the refusal could not fire for exactly the workspaces
+     * that use the documented surface. A declaration that failed to load
+     * refuses (`workspace-selections-unreadable`): an unknown list is never read
+     * as the manifest's or as empty.
+     */
+    async selectionsFor(plugins, scope) {
+        if (scope.kind === 'global')
+            return plugins.readGlobalPluginScope(scope.root).plugins;
+        const loader = await this.runtime
+            .query('runtime/loader')
+            .enabled()
+            .resolve();
+        const listing = await readWorkspacePluginSurfaces(scope.root, { loader });
+        if (listing.failures.length > 0)
+            throw unreadableSelectionsRefusal(listing);
+        return listing.effective?.plugins ?? [];
+    }
+    report(plugins, payload) {
+        if (this.format === 'json') {
+            this.ui.json({ ...payload, globs: plugins.readWorkspaceGlobs(payload.root) });
+            return;
+        }
+        const verb = payload.dryRun ? 'Would unlink' : payload.removed ? 'Unlinked' : 'Not linked:';
+        this.ui.success(`${verb} ${payload.glob} from the ${payload.scope} scope (${payload.root})`);
+        if (payload.members.length) {
+            this.ui.warn(`${payload.members.length} member(s) are no longer supplied by a link glob: ` +
+                `${payload.members.join(', ')}. None of them is enabled or declared in this scope ` +
+                `(that is checked before the write), but another root that expects them will not ` +
+                `resolve them from here.`);
+        }
+    }
+}
+//# sourceMappingURL=plugins.unlink.cli-command.impl.consumer.js.map

package/dist/cli/plugins.unlink.cli-command.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.unlink.cli-command.impl.consumer.js","sourceRoot":"","sources":["../../src/cli/plugins.unlink.cli-command.impl.consumer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACN,eAAe,EACf,wBAAwB,EAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAA+B,MAAM,+BAA+B,CAAC;AACzG,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAA0B,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAIjD,8GAA8G;AAC9G,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAIC,EACD,QAAuD;IAEvD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA+B;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK;QACnD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,8CAA8C,CAAC,CAAC;IACxH,OAAO,IAAI,eAAe,CACzB,wCAAwC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAC3F,+CAA+C,EAChD,eAAe,EACf,EAAE,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAC9G,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAKrC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;SAC3B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,KAAK,GAAG;YACb,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,CACN,uBAAuB,KAAK,CAAC,IAAI,cAAc,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,IAAI,cAAc;QAC7F,YAAY,KAAK,CAAC,QAAQ,CAAC,MAAM,yBAAyB,MAAM,0BAA0B;QAC1F,0EAA0E;QAC1E,yFAAyF;QACzF,iDAAiD,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CACvE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,iBAAiB;IACrE,YAAY,UAAqC,EAAE,OAA0B;QAC5E,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAuC,EAAE,OAA6C;QACnG,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvD,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;YAC1B,GAAG;YACH,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;SACxF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACd,OAAO,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,oBAAoB,GAAG,KAAK;gBACjE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAChD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,mBAAmB,CACnC;YACC,OAAO;YACP,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC;YACjD,YAAY,EAAE,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC;SACvD,EACD,OAAO,CACP,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,qBAAqB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAC9E,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3G,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC;YACJ,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,eAAe,CACxB,GAAG,MAAM,IAAI;gBACZ,IAAI,IAAI,8BAA8B,KAAK,CAAC,IAAI,eAAe;gBAC/D,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;gBAChE,wCAAwC,IAAI,OAAO,KAAK,CAAC,IAAI,EAAE,EAChE,aAAa,EACb;gBACC,MAAM,EAAE,8BAA8B;gBACtC,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;gBAC5C,KAAK,EAAE,KAAK;aACZ,CACD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,aAAa,CAAC,OAA8B,EAAE,KAAoB;QAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO;aAC/B,KAAK,CAAiD,gBAAgB,CAAC;aACvE,OAAO,EAAE;aACT,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,OAA8B,EAAE,OAO9C;QACA,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,oDAAoD;gBAC5E,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD;gBACnF,kFAAkF;gBAClF,yBAAyB,CAC1B,CAAC;QACH,CAAC;IACF,CAAC;CACD"}

package/dist/cli/registry-sign-in.consumer.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Registry sign-in for host-side installs (`vibes update`, `vibes plugins`).
+ *
+ * packages.vibes.dev 404-hides a missing or rejected credential rather than
+ * returning 401, so a signed-out install fails with
+ * `GET https://packages.vibes.dev/@vibesdotdev%2f… - 404` and reads like an
+ * unpublished package. Two measures close that:
+ *
+ * - Before bun runs, a person at a terminal with no install credential is
+ *   signed in through `auth.login`, resolved as a `cli/command` through the
+ *   runtime. After it, the caller's bearer resolves from the device session.
+ * - After bun fails, a registry 404 with no install credential is re-stated as
+ *   the sign-in it actually is.
+ *
+ * The install credential is resolved for the runtime the install was handed
+ * (rc01 §3 "Child credentials"): a named `VIBES_REGISTRY_TOKEN` in the host's
+ * declared secrets store, else the caller's bearer from auth's
+ * `resolveCallerBearer` (registry reads authenticate as the caller, rc05
+ * §2.2). Nothing is read from the environment.
+ *
+ * Both run inside `runBunOrThrow`, the one choke point every install path uses.
+ * What they say goes to stderr through `cli/ui`, never into a command's output.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+export type RegistrySignIn = 'bound' | 'signed-in' | 'unbound';
+/** The registry that 404-hides a signed-out request: the one the global home is seeded with. */
+/** The one variable bun's scoped-registry config reads (`VIBES_REGISTRY_JWT` folded into it). */
+export declare const REGISTRY_TOKEN_KEY = "VIBES_REGISTRY_TOKEN";
+/**
+ * The credential a registry install presents, in a declared order:
+ *
+ * 1. a named `VIBES_REGISTRY_TOKEN` the host's declared secrets store holds (a
+ *    lease `vibes secrets exec` or a CI step published, or a token stored with
+ *    `vibes secrets set`), through `runtime.resolveCredential`;
+ * 2. else the caller's bearer, through auth's `resolveCallerBearer`.
+ *
+ * Only a typed absence moves on or ends in `null`: `credential-not-set` for the
+ * named token, `not-signed-in` or an anonymous caller for the bearer. Every
+ * other failure throws.
+ */
+export declare function resolveRegistryInstallCredential(runtime: VibesRuntime): Promise<string | null>;
+/** The install credential as child-only env for Bun. Callers never pass a token. */
+export declare function registryInstallEnv(runtime: VibesRuntime): Promise<Record<string, string>>;
+export declare function registryCredentialBound(runtime: VibesRuntime): Promise<boolean>;
+/**
+ * Sign in when nothing is bound and a person can answer. Never prompts a
+ * supervisor.
+ *
+ * A broken `auth.login` is reported with its cause and the install goes on
+ * signed out. Stopping here would block `vibes update --global`, the command
+ * that reinstalls a broken auth package, and installs that fetch nothing
+ * private. If bun then meets a hidden package, `explainRegistryFailure` names
+ * the sign-in.
+ */
+export declare function ensureRegistrySignIn(runtime: VibesRuntime, options: {
+    interactive: boolean;
+}): Promise<RegistrySignIn>;
+/** One registry request bun reported as failed. */
+export interface BunRequestFailure {
+    method: string;
+    url: URL;
+    status: number;
+}
+/**
+ * The registry requests bun reports as failed in its stderr.
+ *
+ * `bun install` has no machine-readable reporter: a failed request exists
+ * only as the line `error: GET <url> - <status>` (measured on Bun 1.4.0
+ * against a registry answering 404). This is the one place that reads that
+ * line; callers decide on the fields it returns.
+ */
+export declare function bunRequestFailures(stderr: string): BunRequestFailure[];
+/**
+ * Re-state a signed-out registry 404 as the sign-in it is. Other failures pass
+ * through. The decision reads `bunStderr`, bun's own output, not the summary
+ * in `failure`: that summary is trimmed for a person to read, so it is not a
+ * record to classify from.
+ */
+export declare function explainRegistryFailure(runtime: VibesRuntime, failure: Error, bunStderr: string): Promise<Error>;
+//# sourceMappingURL=registry-sign-in.consumer.d.ts.map

package/dist/cli/registry-sign-in.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-sign-in.consumer.d.ts","sourceRoot":"","sources":["../../src/cli/registry-sign-in.consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAA+E,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMrI,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAO/D,gGAAgG;AAEhG,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAGzD;;;;;;;;;;;GAWG;AACH,wBAAsB,gCAAgC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASpG;AAWD,oFAAoF;AACpF,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQ/F;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AA+CD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,GAC/B,OAAO,CAAC,cAAc,CAAC,CAgBzB;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;CACf;AAeD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAStE;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,KAAK,EACd,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC,CAehB"}

package/dist/cli/registry-sign-in.consumer.js

@@ -0,0 +1,199 @@
+/**
+ * Registry sign-in for host-side installs (`vibes update`, `vibes plugins`).
+ *
+ * packages.vibes.dev 404-hides a missing or rejected credential rather than
+ * returning 401, so a signed-out install fails with
+ * `GET https://packages.vibes.dev/@vibesdotdev%2f… - 404` and reads like an
+ * unpublished package. Two measures close that:
+ *
+ * - Before bun runs, a person at a terminal with no install credential is
+ *   signed in through `auth.login`, resolved as a `cli/command` through the
+ *   runtime. After it, the caller's bearer resolves from the device session.
+ * - After bun fails, a registry 404 with no install credential is re-stated as
+ *   the sign-in it actually is.
+ *
+ * The install credential is resolved for the runtime the install was handed
+ * (rc01 §3 "Child credentials"): a named `VIBES_REGISTRY_TOKEN` in the host's
+ * declared secrets store, else the caller's bearer from auth's
+ * `resolveCallerBearer` (registry reads authenticate as the caller, rc05
+ * §2.2). Nothing is read from the environment.
+ *
+ * Both run inside `runBunOrThrow`, the one choke point every install path uses.
+ * What they say goes to stderr through `cli/ui`, never into a command's output.
+ */
+import { DefaultCLICommandImplementation } from '@vibesdotdev/cli/kinds';
+import { CapabilityError, CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+import { LoggedErrorSchema } from '@vibesdotdev/logging';
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+import { resolveCallerBearer } from '@vibesdotdev/auth/caller-bearer';
+import { resolveSeedRegistryUrl } from "./seed.js";
+const LOGIN_COMMAND_ID = 'auth.login';
+/** The registry that 404-hides a signed-out request: the one the global home is seeded with. */
+/** The one variable bun's scoped-registry config reads (`VIBES_REGISTRY_JWT` folded into it). */
+export const REGISTRY_TOKEN_KEY = 'VIBES_REGISTRY_TOKEN';
+const BUN_CONFIG_TOKEN_KEY = 'BUN_CONFIG_TOKEN';
+/**
+ * The credential a registry install presents, in a declared order:
+ *
+ * 1. a named `VIBES_REGISTRY_TOKEN` the host's declared secrets store holds (a
+ *    lease `vibes secrets exec` or a CI step published, or a token stored with
+ *    `vibes secrets set`), through `runtime.resolveCredential`;
+ * 2. else the caller's bearer, through auth's `resolveCallerBearer`.
+ *
+ * Only a typed absence moves on or ends in `null`: `credential-not-set` for the
+ * named token, `not-signed-in` or an anonymous caller for the bearer. Every
+ * other failure throws.
+ */
+export async function resolveRegistryInstallCredential(runtime) {
+    const named = await runtime.resolveCredential({ source: 'secret', key: REGISTRY_TOKEN_KEY });
+    if (named.ok)
+        return named.value;
+    if (named.error.reason !== 'credential-not-set')
+        throw named.error;
+    const bearer = await bearerOutcome(runtime);
+    if (bearer.ok)
+        return bearer.value;
+    // Only the typed absence of a session is "no credential"; every other failure is carried.
+    if (isCapabilityError(bearer.failure) && bearer.failure.reason === 'not-signed-in')
+        return null;
+    throw bearer.failure;
+}
+/** The caller's bearer, or the failure resolving it raised, captured once. */
+async function bearerOutcome(runtime) {
+    try {
+        return { ok: true, value: await resolveCallerBearer(runtime) };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** The install credential as child-only env for Bun. Callers never pass a token. */
+export async function registryInstallEnv(runtime) {
+    const token = await resolveRegistryInstallCredential(runtime);
+    return token
+        ? {
+            [REGISTRY_TOKEN_KEY]: token,
+            [BUN_CONFIG_TOKEN_KEY]: token
+        }
+        : {};
+}
+export async function registryCredentialBound(runtime) {
+    return (await resolveRegistryInstallCredential(runtime)) !== null;
+}
+/**
+ * `auth.login` as this runtime composes it. `absent` when no auth plugin
+ * registered a real one, which is an ordinary composition. That includes the
+ * `DefaultCLICommandImplementation` the kind hands back for a descriptor with
+ * no loader: the CLI owner reads that stub as "nothing real is registered in
+ * this scope" (`register-commands.ts`), and so does this. `broken` is a
+ * registered command whose loader threw, kept apart so it is never passed off
+ * as "no auth here".
+ */
+async function resolveLogin(runtime) {
+    if (!runtime.hasKind('cli/command'))
+        return { state: 'absent' };
+    const query = runtime
+        .query('cli/command')
+        .withId(LOGIN_COMMAND_ID);
+    if (!(await query.existsAsync()))
+        return { state: 'absent' };
+    let login;
+    try {
+        login = await query.resolve();
+    }
+    catch (cause) {
+        return { state: 'broken', cause: CaughtFailureSchema.parse(cause) };
+    }
+    if (login instanceof DefaultCLICommandImplementation)
+        return { state: 'absent' };
+    return { state: 'ready', login };
+}
+/** The runtime's own refusal reasons that wrap an asset's failure (as `cause`) in its `kind:id` context. */
+const RUNTIME_WRAPPED_REASONS = new Set(['dependency-absent', 'load-failed', 'provide-failed']);
+function brokenLoginNotice(cause) {
+    // The runtime's message names the failed asset only; the module's own failure is its cause.
+    const own = isCapabilityError(cause) && RUNTIME_WRAPPED_REASONS.has(cause.reason) ? cause.cause : cause;
+    // Logging's total describer reads the message once and never throws; the excerpt is bounded and credential-free.
+    const reason = redactedExcerpt(LoggedErrorSchema.parse(own).message);
+    return (`Sign-in ('${LOGIN_COMMAND_ID}') failed to load, so this install runs signed out: ${reason}\n` +
+        '  Private Vibes packages need a credential: store VIBES_REGISTRY_TOKEN with `vibes secrets set`, ' +
+        'or pass --non-interactive to skip sign-in.');
+}
+/**
+ * Sign in when nothing is bound and a person can answer. Never prompts a
+ * supervisor.
+ *
+ * A broken `auth.login` is reported with its cause and the install goes on
+ * signed out. Stopping here would block `vibes update --global`, the command
+ * that reinstalls a broken auth package, and installs that fetch nothing
+ * private. If bun then meets a hidden package, `explainRegistryFailure` names
+ * the sign-in.
+ */
+export async function ensureRegistrySignIn(runtime, options) {
+    if (await registryCredentialBound(runtime))
+        return 'bound';
+    if (!options.interactive)
+        return 'unbound';
+    const resolution = await resolveLogin(runtime);
+    if (resolution.state === 'absent')
+        return 'unbound';
+    // `warn` is the CLI toolkit's stderr channel; `info` writes to stdout, where
+    // it would land in front of a `-o yaml` payload.
+    const ui = await runtime.context('cli/ui');
+    if (resolution.state === 'broken') {
+        ui.warn(brokenLoginNotice(resolution.cause));
+        return 'unbound';
+    }
+    ui.warn('Private Vibes packages need a sign-in first.');
+    // The command takes its runtime from its context, like any CLI action.
+    await resolution.login.execute({}, { interactive: true }, { runtime, ui });
+    return (await registryCredentialBound(runtime)) ? 'signed-in' : 'unbound';
+}
+const BUN_REQUEST_FAILURE = /^error: ([A-Z]+) (\S+) - (\d{3})$/;
+/** ANSI/VT control sequences (CSI, OSC, and two-byte escapes), which bun colours its errors with. */
+const ESC = String.fromCodePoint(27);
+const BEL = String.fromCodePoint(7);
+const CSI = String.fromCodePoint(155);
+const TERMINAL_CONTROL = new RegExp(`${ESC}(?:\\[[0-?]*[ -/]*[@-~]|\\][^${BEL}${ESC}]*(?:${BEL}|${ESC}\\\\)|[@-Z\\\\-_])|${CSI}[0-?]*[ -/]*[@-~]`, 'g');
+/** `text` without terminal control sequences. */
+function stripTerminalControls(text) {
+    return text.replace(TERMINAL_CONTROL, '');
+}
+/**
+ * The registry requests bun reports as failed in its stderr.
+ *
+ * `bun install` has no machine-readable reporter: a failed request exists
+ * only as the line `error: GET <url> - <status>` (measured on Bun 1.4.0
+ * against a registry answering 404). This is the one place that reads that
+ * line; callers decide on the fields it returns.
+ */
+export function bunRequestFailures(stderr) {
+    const failures = [];
+    for (const line of stripTerminalControls(stderr).split('\n')) {
+        const match = BUN_REQUEST_FAILURE.exec(line.trim());
+        const url = match?.[2] ? URL.parse(match[2]) : null;
+        if (!match?.[1] || !match[3] || !url)
+            continue;
+        failures.push({ method: match[1], url, status: Number(match[3]) });
+    }
+    return failures;
+}
+/**
+ * Re-state a signed-out registry 404 as the sign-in it is. Other failures pass
+ * through. The decision reads `bunStderr`, bun's own output, not the summary
+ * in `failure`: that summary is trimmed for a person to read, so it is not a
+ * record to classify from.
+ */
+export async function explainRegistryFailure(runtime, failure, bunStderr) {
+    if (await registryCredentialBound(runtime))
+        return failure;
+    const hidingRegistryHost = new URL(await resolveSeedRegistryUrl(runtime)).host;
+    const hidden = bunRequestFailures(bunStderr).some((request) => request.status === 404 && request.url.host === hidingRegistryHost);
+    if (!hidden)
+        return failure;
+    return new CapabilityError('Private Vibes packages were hidden because this machine is not signed in.\n' +
+        '  run: vibes auth login\n' +
+        '  then: vibes update --global\n' +
+        'Unattended hosts: store a `vibes registry token create` token as VIBES_REGISTRY_TOKEN with `vibes secrets set`.', 'AUTH_REQUIRED', { reason: 'registry-sign-in-required', retryable: false, cause: failure });
+}
+//# sourceMappingURL=registry-sign-in.consumer.js.map

package/dist/cli/registry-sign-in.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-sign-in.consumer.js","sourceRoot":"","sources":["../../src/cli/registry-sign-in.consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAyC,MAAM,qBAAqB,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAOnD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC,gGAAgG;AAEhG,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAAqB;IAC3E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB;QAAE,MAAM,KAAK,CAAC,KAAK,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACnC,0FAA0F;IAC1F,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAChG,MAAM,MAAM,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAqB;IAC7D,MAAM,KAAK,GAAG,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,KAAK;QACX,CAAC,CAAC;YACA,CAAC,kBAAkB,CAAC,EAAE,KAAK;YAC3B,CAAC,oBAAoB,CAAC,EAAE,KAAK;SAC7B;QACF,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAqB;IAClE,OAAO,CAAC,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC;AAOD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,OAAqB;IAChD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,OAAO;SACnB,KAAK,CAAwC,aAAa,CAAC;SAC3D,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,YAAY,+BAA+B;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,4GAA4G;AAC5G,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEhG,SAAS,iBAAiB,CAAC,KAAoB;IAC9C,4FAA4F;IAC5F,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACxG,iHAAiH;IACjH,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,CACN,aAAa,gBAAgB,uDAAuD,MAAM,IAAI;QAC9F,mGAAmG;QACnG,4CAA4C,CAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAqB,EACrB,OAAiC;IAEjC,IAAI,MAAM,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3D,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,EAAE,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO,CAAC,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AASD,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,qGAAqG;AACrG,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AACrC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AACpC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,gCAAgC,GAAG,GAAG,GAAG,QAAQ,GAAG,IAAI,GAAG,sBAAsB,GAAG,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAExJ,iDAAiD;AACjD,SAAS,qBAAqB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAChD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;YAAE,SAAS;QAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAqB,EACrB,OAAc,EACd,SAAiB;IAEjB,IAAI,MAAM,uBAAuB,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,IAAI,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,CAC9E,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,IAAI,eAAe,CACzB,6EAA6E;QAC5E,2BAA2B;QAC3B,iCAAiC;QACjC,iHAAiH,EAClH,eAAe,EACf,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CACzE,CAAC;AACH,CAAC"}