@vibesdotdev/pm 0.0.0-stage → 1.0.0-rc.3

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,228 @@
-# Temporary Holding Version
+# @vibesdotdev/pm
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Process manager engine: runtime kinds, daemon, client, manager, registry, state store, CLI commands, TUI dashboard, and the `./dev` builders for co-located dev process descriptors. Powers `vibes pm`.
+
+Concrete `pm/process` descriptors live next to the thing they run — `apps/<app>/<app>.pm.process.ts`, `<pkg>/<pkg>.pm.process.ts`, etc. — and are picked up by runtime filesystem discovery. The repo-root `pm/` directory holds workspace-scoped composition: presets, workspace-shared resources, the workspace dev environment data (`pm/dev.workspace.ts`), and any genuinely orphan workspace processes.
+
+## Quickstart
+
+### Register the plugin
+
+```ts
+// vibes.config.ts (or app bootstrap)
+export default {
+  plugins: [
+    () => import('@vibesdotdev/pm/plugin'),
+    // …
+  ],
+};
+```
+
+Compose `@vibesdotdev/pm/consumer.plugin` for the daemon, built-in providers, storage and runtime-owned PM client. The existing `./plugin` entrypoint is its compatibility alias. Cloud and universal hosts use `./cloud.plugin`, which registers only host-free kinds/config. CLI and TUI composition remain explicit at `./cli/plugin` and `./tui/plugin`.
+
+### Port-forwards and launch preparation
+
+PM does not compose a port-forward integration. Hosts must explicitly register
+a `pm/launch-preparation` provider; process declarations select its descriptor
+with `launchPreparation: { adapter, config }`. The synchronous port-forward
+builders retain validated requests and supervision defaults, with a deferred
+`command: 'port-forward', args: []` preview. Existing tagged persisted argv
+declarations remain supported through the host's protocol adapter.
+Saved configs retain actual executable argv and optional schema-validated
+`launchProvenance` for declaration and prepared inputs. Unchanged declarations
+reuse their managed run; preparation inputs participate in concurrent request
+identity. Restarts prepare the declaration again, and older records without
+provenance remain supported.
+See [the composition guide](./docs/launch-preparation.md) for the Kubernetes
+bridge, legacy declarations, typed refusals and external host follow-up.
+
+### Declare a SvelteKit dev app (co-located)
+
+```ts
+// apps/auth-web/auth.pm.process.ts
+import { defineSvelteKitDev } from '@vibesdotdev/pm/dev';
+
+export default defineSvelteKitDev({
+  id: 'auth-dev',
+  name: 'Auth Dev',
+  description: 'Auth app — session management, OAuth, gateway.',
+  // No appDir: the app is this file's directory. PM anchors the descriptor's
+  // relative paths at the file discovery found it in; the descriptor never
+  // computes its own location (no import.meta.dir), so it imports under any host.
+  port: 5173,
+  // Relative to the process cwd, the app directory.
+  env: { AUTH_DATABASE_URL: 'file:.vibes/data/auth.sqlite' },
+  presets: ['dev', 'core'],
+  tags: ['core', 'app'],
+  // pm-infra-liveness-fleet (Phase 1 foundation): declare supported liveness/presence profiles
+  // in a *single* declarative site. This is the key to less consumer code (no more duplicated
+  // full descriptors for local-hmr vs fleet-mutable vs cloud-preview). `vibes pm liveness set`
+  // (and --env / --target on list/start) selects the active mode at runtime.
+  // Descriptors without the field continue to work unchanged.
+  livenessProfiles: ['local-hmr', 'fleet-mutable'],
+});
+```
+
+**New world (Phase 4 polish):** One descriptor declares support; `vibes pm liveness set full [--env=dev]` (power command) or explicit profile flips the "lens" (local full-HMR vs fleet-mutable delta-sync etc). TUI dashboard (pm-tui) now shows live active profile + fleet resources (shaped slices/records) + 'f' hotkey action. Less code + more power: no dupe files/ids for presence modes.
+
+The builder fills in the vite command, the SvelteKit pre-build hook, and the standard TCP health check. An optional app-owned workspace projection can fan shared origins out to `PUBLIC_VIBES_<APP>_ORIGIN` environment variables. It wraps in `createRuntimeAsset` so runtime discovery picks it up. `livenessProfiles` (and `livenessConfig`) are forwarded into the resulting `ProcessConfig` so the rest of the PM system (client, daemon, CLI, TUI, future sync) can treat liveness/presence as a first-class property of the process.
+
+### Declare a generic command process (workspace-authored)
+
+A workspace declares its own processes in `*.pm.process.ts` files that the
+kernel's discovery pass finds under the bound workspace. A published package
+does not: it registers its process descriptors through its plugin (the workers
+consumer is `workers/src/cli/vibes-workers-consumer.process.descriptor.ts`,
+registered by the workers CLI plugin; applet serving is
+`applets/src/cli/applet-serve.process.descriptor.ts`, registered by the applets
+CLI plugin).
+
+```ts
+// pm/processes/my-worker.pm.process.ts (in the workspace)
+import { defineCommandProcess } from '@vibesdotdev/pm/dev';
+
+export default defineCommandProcess({
+  id: 'my-worker',
+  name: 'My Worker Runtime (consumer)',
+  command: '/path/to/host-owned/vibes',
+  args: ['workers', 'serve', 'consumer'],
+  // PM binds cwd, env and the canonical consumer socket at admission.
+  workerRuntimeTarget: 'consumer',
+  healthCheck: { type: 'socket', interval: 10_000, timeout: 5_000, retries: 3, warmupMs: 30_000, gracePeriodMultiplier: 6 },
+  presets: ['dev', 'full'],
+  tags: ['workers', 'local', 'ipc', 'consumer'],
+  // Phase 4: livenessProfiles make this command process remote/fleet capable with one decl (see "vibes pm liveness set full")
+  livenessProfiles: ['local-hmr', 'fleet-mutable']
+});
+```
+
+### Declare a preset (workspace-scoped)
+
+```ts
+// pm/presets/dev.pm.preset.ts
+export default {
+  id: 'dev',
+  kind: 'pm/preset',
+  name: 'Local development',
+  default: true,
+  // No `processes:` array — it's derived from descriptor `presets: ['dev']` membership.
+  resources: ['kind-vibes-local', 'nginx-reverse-proxy'],
+  maxProcessConcurrency: 2,
+};
+```
+
+### Drive PM from code
+
+```ts
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import type { PMClient } from '@vibesdotdev/pm/client';
+
+// runtime is the host runtime handed to this code.
+const pm = await getVibesClient<PMClient>('pm', runtime);
+// The legacy runtime.context('pm/client') projects this same kernel-owned client.
+
+await pm.start({ id: 'web', command: 'bun', args: ['run', 'dev'], cwd: 'apps/app-web' });
+const status = await pm.getStatus('web');
+const logs = await pm.getLogs('web', { lines: 200, stream: 'both' });
+
+// A task: start it, then await that run's exit (one call that ends on the exit; no polling).
+const started = await pm.start({ id: 'seed', command: 'bun', args: ['run', 'seed'], task: true, runOnce: true });
+const exit = await pm.awaitExit('seed', { run: { startedAt: started.startedAt } });
+if (!exit.succeeded) console.error(`seed ${exit.status} with exit ${exit.exitCode}`);
+```
+
+`awaitExit` answers PM's one terminal record of the run (`ProcessExit`). If the
+daemon restarts or hot-reloads mid-wait, the client re-issues for the same run;
+a caller's `signal` aborts the wait and closes its connection.
+
+`PMClient` auto-launches the daemon on first call. Recursion is guarded by the `VIBES_PM_DAEMON` env var and a launch lock at `~/.vibes/pm/daemon-launch-<tooling-id>.lock`.
+
+### Run on the CLI
+
+```bash
+vibes pm start web              # start a registered process
+vibes pm status                 # all process status
+vibes pm logs web --lines 200
+vibes pm preset start dev       # start the dev preset
+vibes pm daemon status
+vibes pm dashboard              # launch the TUI dashboard
+```
+
+### Implement a resource provider
+
+A provider is a `pm/resource-provider` runtime asset whose id is the resource
+type. Register it through your plugin (or author `my-thing.pm.resource-provider.ts`
+for kernel discovery); the daemon resolves it from its runtime.
+
+```ts
+import { createRuntimeAsset, createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import { RESOURCE_PROVIDER_KIND, type ResourceProvider } from '@vibesdotdev/pm';
+
+const myProvider: ResourceProvider = {
+  type: 'my/thing',
+  async setup(config) {
+    return {
+      state: { id: config.id, type: 'my/thing', status: 'ready', lastChecked: new Date() },
+    };
+  },
+  async teardown(id, state, { config }) { /* delete; report a failure by throwing */ },
+  async status(id, { config }) { return { status: 'ready' }; },
+  validateConfig(c) { return c; },
+};
+
+export default createRuntimePlugin({
+  id: 'my-thing',
+  dependencies: ['pm'],
+  descriptors: [createRuntimeAsset({ kind: RESOURCE_PROVIDER_KIND, id: 'my/thing', name: 'My thing', description: '…' })],
+  loaders: [loader('my/thing', { kind: RESOURCE_PROVIDER_KIND }, async () => ({ impl: myProvider }))],
+});
+```
+
+Built-in providers (`shell/setup`, `local/mkcert`) are registered the same way by the pm plugin. Vendor providers (k8s, helm, kind) register their own `pm/resource-provider` descriptors through `@vibesdotdev/integrations-kubernetes/resource-providers.consumer.plugin`.
+
+## Port-forward execution
+
+Port-forward execution belongs to `@vibesdotdev/integrations-kubernetes`
+(`./port-forward`, `./port-forward.consumer.plugin`): kubectl token grammar,
+legacy argv interpretation, synchronous plan building, readiness commands, and
+argv construction. PM owns only the open `pm/launch-preparation` kind
+(`./launch-preparation`) plus the optional `monitoredPorts` /
+`matchesProcessCommand` identity hooks its port tooling resolves at call time.
+Hosts explicitly compose the integration's narrow consumer slice and the
+`pm/launch-preparation` bridge shown in the
+[composition guide](./docs/launch-preparation.md).
+A missing adapter refuses `pm-launch-preparation-unavailable`; an invalid
+implementation or plan refuses `pm-launch-preparation-invalid` (`UNAVAILABLE`
+and `INTERNAL`, respectively). Persisted declarations remain supported through
+the host bridge and the integration's compatibility adapter. Readiness failure prevents spawn and
+retains `pm-resource-tool-failed`; execution refusals propagate unchanged.
+Selection and execution stay bound to the handed runtime.
+
+## State and config locations
+
+- Daemon socket: `~/.vibes/pm/sock/pm-daemon-<tooling-id>.sock`
+- Daemon PID: `~/.vibes/pm/pm-daemon-<tooling-id>.pid`
+- Process state DB: `~/.vibes/pm-state.db` (global) or `<workspace>/.vibes/pm-state.db` (local)
+- Registered / launched process configs: the `process_configs` table of the workspace's `pm-state.db` (the `pm-registry.json` side file is gone)
+- Liveness profiles: the `pm_kv` table of the workspace's `pm-state.db` (the `.vibes/pm-liveness.json` file is gone)
+- Daemon stdio logs: `<logDir>/pm-daemon-<tooling-id>.stdout.log` / `.stderr.log`, one pair per admitted workspace; the structured daemon log is `<logDir>/pm-daemon.log`
+- Previous run of a process: `<id>.stdout.previous` / `<id>.stderr.previous` in its process log directory (`.1`..`.3` are size rotation)
+- Process descriptors: discovered by the kernel from the bound workspace's declared `package.json#workspaces` packages (any `*.pm.{process,resource,preset}.ts` at a package root, and the root package's `pm/{processes,resources,presets}/`); a host's `config.plugins.pm` in `vibes.config.*` adds inline declarations. One explicit file is registered with `vibes pm register <path>`; the old `--config <path>` flags are gone.
+
+## Verification
+
+Run from this package directory. `check` checks all TypeScript and TSX sources,
+including tests, without emitting, then checks Svelte components. `build` emits
+production core code and packages the supported Svelte exports separately;
+tests and fixtures stay out of `dist`.
+
+```bash
+bun run check
+bun run test
+bun run build
+```
+
+## Docs
+
+- [SPEC.md](./SPEC.md) — package contract, owned surfaces, hard rules, migration debt
+- [cli](../cli/SPEC.md), [cli-bin](../../../apps/cli-bin/SPEC.md), [tui](../tui/SPEC.md), [workers](../workers/SPEC.md), [workspace](../workspace/SPEC.md), [runtime](../runtime/SPEC.md)

package/dist/admission-store.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The `pm.workspaces` admission store (framework-M8, rc02-rc03 §2.4): reads
+ * and writes the one admission document through its storage manifest, which
+ * the runtime resolves (`storage/manifest` → `storage.json` under
+ * `{vibesHome}/pm`). The rule itself is pure and lives in `./admission.ts`.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type AdmittedBy, type AdmittedWorkspace } from './schemas/admission.ts';
+export { admittedWorkspacesManifestDescriptor } from './storage/workspaces.descriptor.ts';
+type AdmissionRuntime = RuntimeRef;
+/** Admitting also reads the host's captured workspace binding (its source) from its environment facts. */
+type AdmittingRuntime = AdmissionRuntime & Partial<Pick<RuntimeRef, 'localEnvironment'>>;
+/**
+ * Every admitted workspace on this machine. The JSON adapter answers `null`
+ * only when the document does not exist, which is "nothing admitted yet";
+ * every other read failure propagates.
+ */
+export declare function readAdmittedWorkspaces(runtime: AdmissionRuntime): Promise<AdmittedWorkspace[]>;
+/**
+ * The innermost admitted workspace containing `path`, or null when none does.
+ * For a caller that answers for a path other than its runtime's binding (a
+ * doctor run's `--root`); a runtime's own binding reads `pm/admitted-workspace`.
+ */
+export declare function findAdmittedWorkspace(runtime: AdmissionRuntime, path: string): Promise<AdmittedWorkspace | null>;
+/**
+ * The value of `pm/admitted-workspace`: the innermost admitted record
+ * containing the runtime's binding, else `workspace-not-admitted`.
+ */
+export declare function resolveAdmittedWorkspace(runtime: AdmissionRuntime): Promise<AdmittedWorkspace>;
+export interface AdmissionResult {
+    workspace: AdmittedWorkspace;
+    /** True when this call wrote the record; false when a record already contained the binding. */
+    admitted: boolean;
+}
+/**
+ * Admit the runtime's bound workspace. A binding already inside an admitted
+ * workspace keeps that record (a nested checkout reaches its workspace's
+ * daemon); otherwise the binding itself is recorded. The re-check and the
+ * write share the manifest's document lock, so two concurrent admissions of
+ * one root write one record.
+ */
+export declare function admitWorkspace(runtime: AdmittingRuntime, admittedBy: AdmittedBy, now?: () => Date): Promise<AdmissionResult>;
+//# sourceMappingURL=admission-store.d.ts.map

package/dist/admission-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-store.d.ts","sourceRoot":"","sources":["../src/admission-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAOvE,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,iBAAiB,EAEtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F,KAAK,gBAAgB,GAAG,UAAU,CAAC;AACnC,0GAA0G;AAC1G,KAAK,gBAAgB,GAAG,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;AA6BzF;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAGpG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAEnC;AAOD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKpG;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,+FAA+F;IAC/F,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,UAAU,EACtB,GAAG,GAAE,MAAM,IAAuB,GAChC,OAAO,CAAC,eAAe,CAAC,CA4B1B"}

package/dist/admission-store.js

@@ -0,0 +1,108 @@
+/**
+ * The `pm.workspaces` admission store (framework-M8, rc02-rc03 §2.4): reads
+ * and writes the one admission document through its storage manifest, which
+ * the runtime resolves (`storage/manifest` → `storage.json` under
+ * `{vibesHome}/pm`). The rule itself is pure and lives in `./admission.ts`.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { StorageManifest } from '@vibesdotdev/storage/manifest';
+import { innermostAdmittedWorkspace, normalizeWorkspaceRoot, workspaceNotAdmitted } from "./admission.js";
+import { AdmittedWorkspacesSchema } from "./schemas/admission.js";
+import { PM_WORKSPACES_MANIFEST_ID } from "./storage/workspaces.descriptor.js";
+export { admittedWorkspacesManifestDescriptor } from "./storage/workspaces.descriptor.js";
+/**
+ * Refuse a binding that is not a workspace (START.md agreed plan): the host's
+ * environment bound it only because no workspace marker (`.git`, a
+ * `package.json` with `workspaces`) was found above the cwd (the policy's C5
+ * `source: 'cwd'`). Recording it would make PM supervise an arbitrary
+ * directory and, as an ancestor, capture every checkout beneath it (measured:
+ * an admitted `/Users/aewing/Projects`). An explicit `--workspace-root` or a
+ * declared root, and a marked nearest root, are workspaces. A binding that is
+ * not the host's capture (a call's own workspace) is judged by its caller.
+ */
+function refuseUnmarkedBinding(runtime, binding) {
+    const captured = runtime.localEnvironment?.workspaceBinding?.();
+    if (!captured || captured.source !== 'cwd')
+        return;
+    if (normalizeWorkspaceRoot(captured.root) !== binding)
+        return;
+    throw new CapabilityError(`'${binding}' is not a workspace, so PM will not admit it.`, 'INVALID_INPUT', {
+        reason: 'pm-admission-not-a-workspace',
+        retryable: false,
+        details: { workspace: binding },
+        recoveryHint: 'Run it inside a workspace (a git checkout, or a package.json that declares workspaces), or name one with --workspace-root.'
+    });
+}
+/** A fresh handle on the `pm.workspaces` manifest of `runtime`: no cached read outlives a call. */
+function admissionManifest(runtime) {
+    return StorageManifest.fromId(PM_WORKSPACES_MANIFEST_ID, runtime);
+}
+/**
+ * Every admitted workspace on this machine. The JSON adapter answers `null`
+ * only when the document does not exist, which is "nothing admitted yet";
+ * every other read failure propagates.
+ */
+export async function readAdmittedWorkspaces(runtime) {
+    const document = await admissionManifest(runtime).load();
+    return document ? AdmittedWorkspacesSchema.parse(document).workspaces : [];
+}
+/**
+ * The innermost admitted workspace containing `path`, or null when none does.
+ * For a caller that answers for a path other than its runtime's binding (a
+ * doctor run's `--root`); a runtime's own binding reads `pm/admitted-workspace`.
+ */
+export async function findAdmittedWorkspace(runtime, path) {
+    return innermostAdmittedWorkspace(await readAdmittedWorkspaces(runtime), normalizeWorkspaceRoot(path));
+}
+/** The runtime's workspace binding: the invocation's, else the host's; `workspace-unbound` otherwise. */
+function workspaceBinding(runtime) {
+    return runtime.context('runtime/workspace-path');
+}
+/**
+ * The value of `pm/admitted-workspace`: the innermost admitted record
+ * containing the runtime's binding, else `workspace-not-admitted`.
+ */
+export async function resolveAdmittedWorkspace(runtime) {
+    const binding = normalizeWorkspaceRoot(await workspaceBinding(runtime));
+    const admitted = await findAdmittedWorkspace(runtime, binding);
+    if (!admitted)
+        throw workspaceNotAdmitted(binding);
+    return admitted;
+}
+/**
+ * Admit the runtime's bound workspace. A binding already inside an admitted
+ * workspace keeps that record (a nested checkout reaches its workspace's
+ * daemon); otherwise the binding itself is recorded. The re-check and the
+ * write share the manifest's document lock, so two concurrent admissions of
+ * one root write one record.
+ */
+export async function admitWorkspace(runtime, admittedBy, now = () => new Date()) {
+    const binding = normalizeWorkspaceRoot(await workspaceBinding(runtime));
+    const known = innermostAdmittedWorkspace(await readAdmittedWorkspaces(runtime), binding);
+    if (known)
+        return { workspace: known, admitted: false };
+    refuseUnmarkedBinding(runtime, binding);
+    let result;
+    await admissionManifest(runtime).update((current) => {
+        const workspaces = current ? AdmittedWorkspacesSchema.parse(current).workspaces : [];
+        const existing = innermostAdmittedWorkspace(workspaces, binding);
+        if (existing) {
+            result = { workspace: existing, admitted: false };
+            return { workspaces };
+        }
+        const record = {
+            root: binding,
+            admittedAt: now().toISOString(),
+            admittedBy
+        };
+        result = { workspace: record, admitted: true };
+        return { workspaces: [...workspaces, record] };
+    });
+    if (!result) {
+        throw new CapabilityError('The pm.workspaces update ran no transform.', 'INTERNAL', {
+            reason: 'admission-unrecorded'
+        });
+    }
+    return result;
+}
+//# sourceMappingURL=admission-store.js.map

package/dist/admission-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-store.js","sourceRoot":"","sources":["../src/admission-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EACN,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,wBAAwB,EAIxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAM1F;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,OAAyB,EAAE,OAAe;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,CAAC;IAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO;IACnD,IAAI,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO;IAC9D,MAAM,IAAI,eAAe,CAAC,IAAI,OAAO,gDAAgD,EAAE,eAAe,EAAE;QACvG,MAAM,EAAE,8BAA8B;QACtC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;QAC/B,YAAY,EAAE,4HAA4H;KAC1I,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,OAAyB;IACnD,OAAO,eAAe,CAAC,MAAM,CAAqB,yBAAyB,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAyB;IACrE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,OAAO,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAyB,EACzB,IAAY;IAEZ,OAAO,0BAA0B,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,yGAAyG;AACzG,SAAS,gBAAgB,CAAC,OAAyB;IAClD,OAAO,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAyB;IACvE,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ;QAAE,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAAyB,EACzB,UAAsB,EACtB,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,0BAA0B,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACzF,IAAI,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAExC,IAAI,MAAmC,CAAC;IACxC,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAsB;YACjC,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;YAC/B,UAAU;SACV,CAAC;QACF,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,UAAU,EAAE;YACnF,MAAM,EAAE,sBAAsB;SAC9B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/admission.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Workspace admission (framework-M8, D15; rc02-rc03 §2.4).
+ *
+ * PM supervises only admitted workspaces. The admission record lives in the
+ * `pm.workspaces` storage manifest under `vibesHome` (`./admission-store.ts`).
+ * Action commands that need the workspace runtime (`vibes pm start`, editor /
+ * vessel launch via `ensureWorkspaceRuntime`) write a `user` admission.
+ *
+ * The `pm/admitted-workspace` context answers, for the runtime's workspace
+ * binding (`runtime/workspace-path`), the innermost admitted record whose root
+ * is a segment-wise prefix of that binding. With none it throws
+ * `PERMISSION_DENIED` `workspace-not-admitted`. `toolingId(admitted.root)`
+ * names the PM socket, pid, lock, state and logs, the runtime daemon's
+ * sockets and pid, and the workers socket, so every nested checkout of an
+ * admitted workspace reaches that workspace's one daemon.
+ *
+ * This module is pure (no store): the context id, the rule and the error.
+ */
+import { type WorkspaceIdentity } from '@vibesdotdev/identity';
+import { CapabilityError, type CaughtFailure, type RuntimeRef } from '@vibesdotdev/kernel';
+import type { AdmittedWorkspace } from './schemas/admission.ts';
+export { AdmittedBySchema, AdmittedWorkspaceSchema, AdmittedWorkspacesSchema, type AdmittedBy, type AdmittedWorkspace, type AdmittedWorkspaces } from './schemas/admission.ts';
+export { PM_WORKSPACES_MANIFEST_ID } from './storage/workspaces.descriptor.ts';
+export declare const PM_ADMITTED_WORKSPACE_CONTEXT_ID = "pm/admitted-workspace";
+export declare const WORKSPACE_NOT_ADMITTED = "workspace-not-admitted";
+/**
+ * The identity (normalized path, slug, hash, tooling id) of an admitted root:
+ * PM's one call into `@vibesdotdev/identity`. The caller holds the root: an
+ * `AdmittedWorkspace.root`, or a root the daemon was admitted with. Nothing
+ * here decides which workspace a process is in. A blank root is refused.
+ */
+export declare function admittedWorkspaceIdentity(root: string): WorkspaceIdentity;
+/** A workspace path in the one normalized form its identity uses. */
+export declare function normalizeWorkspaceRoot(path: string): string;
+/** Whether `root` is `path` or one of its ancestors, compared segment by segment. */
+export declare function isSegmentPrefix(root: string, path: string): boolean;
+/**
+ * The innermost admitted record whose root contains `binding`, or null. Pure:
+ * the caller hands it the records it read.
+ */
+export declare function innermostAdmittedWorkspace(records: readonly AdmittedWorkspace[], binding: string): AdmittedWorkspace | null;
+export declare function workspaceNotAdmitted(binding: string): CapabilityError;
+export declare function isWorkspaceNotAdmitted(error: CaughtFailure): error is CapabilityError;
+/** The admitted workspace of `runtime`'s binding, through its `pm/admitted-workspace` context. */
+export declare function requireAdmittedWorkspace(runtime: Pick<RuntimeRef, 'context'>): Promise<AdmittedWorkspace>;
+//# sourceMappingURL=admission.d.ts.map

package/dist/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAqB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,eAAO,MAAM,gCAAgC,0BAA0B,CAAC;AACxE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAOzE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,OAAO,EAAE,MAAM,GACb,iBAAiB,GAAG,IAAI,CAQ1B;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMrE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,eAAe,CAErF;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAClC,OAAO,CAAC,iBAAiB,CAAC,CAE5B"}

package/dist/admission.js

@@ -0,0 +1,81 @@
+/**
+ * Workspace admission (framework-M8, D15; rc02-rc03 §2.4).
+ *
+ * PM supervises only admitted workspaces. The admission record lives in the
+ * `pm.workspaces` storage manifest under `vibesHome` (`./admission-store.ts`).
+ * Action commands that need the workspace runtime (`vibes pm start`, editor /
+ * vessel launch via `ensureWorkspaceRuntime`) write a `user` admission.
+ *
+ * The `pm/admitted-workspace` context answers, for the runtime's workspace
+ * binding (`runtime/workspace-path`), the innermost admitted record whose root
+ * is a segment-wise prefix of that binding. With none it throws
+ * `PERMISSION_DENIED` `workspace-not-admitted`. `toolingId(admitted.root)`
+ * names the PM socket, pid, lock, state and logs, the runtime daemon's
+ * sockets and pid, and the workers socket, so every nested checkout of an
+ * admitted workspace reaches that workspace's one daemon.
+ *
+ * This module is pure (no store): the context id, the rule and the error.
+ */
+import { resolveWorkspaceIdentity } from '@vibesdotdev/identity';
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+export { AdmittedBySchema, AdmittedWorkspaceSchema, AdmittedWorkspacesSchema } from "./schemas/admission.js";
+export { PM_WORKSPACES_MANIFEST_ID } from "./storage/workspaces.descriptor.js";
+export const PM_ADMITTED_WORKSPACE_CONTEXT_ID = 'pm/admitted-workspace';
+export const WORKSPACE_NOT_ADMITTED = 'workspace-not-admitted';
+/**
+ * The identity (normalized path, slug, hash, tooling id) of an admitted root:
+ * PM's one call into `@vibesdotdev/identity`. The caller holds the root: an
+ * `AdmittedWorkspace.root`, or a root the daemon was admitted with. Nothing
+ * here decides which workspace a process is in. A blank root is refused.
+ */
+export function admittedWorkspaceIdentity(root) {
+    if (!root.trim()) {
+        throw new CapabilityError('A PM workspace identity needs a non-empty admitted root.', 'INVALID_INPUT', {
+            reason: 'workspace-root-empty'
+        });
+    }
+    return resolveWorkspaceIdentity(root);
+}
+/** A workspace path in the one normalized form its identity uses. */
+export function normalizeWorkspaceRoot(path) {
+    return admittedWorkspaceIdentity(path).workspacePath;
+}
+/** Whether `root` is `path` or one of its ancestors, compared segment by segment. */
+export function isSegmentPrefix(root, path) {
+    const normalizedRoot = normalizeWorkspaceRoot(root);
+    const normalizedPath = normalizeWorkspaceRoot(path);
+    if (normalizedRoot === normalizedPath)
+        return true;
+    const withSeparator = normalizedRoot.endsWith('/') ? normalizedRoot : `${normalizedRoot}/`;
+    return normalizedPath.startsWith(withSeparator);
+}
+/**
+ * The innermost admitted record whose root contains `binding`, or null. Pure:
+ * the caller hands it the records it read.
+ */
+export function innermostAdmittedWorkspace(records, binding) {
+    let innermost = null;
+    for (const record of records) {
+        if (!isSegmentPrefix(record.root, binding))
+            continue;
+        const depth = normalizeWorkspaceRoot(record.root).split('/').filter(Boolean).length;
+        if (!innermost || depth > innermost.depth)
+            innermost = { record, depth };
+    }
+    return innermost?.record ?? null;
+}
+export function workspaceNotAdmitted(binding) {
+    return new CapabilityError(`The workspace '${binding}' is not admitted to PM.`, 'PERMISSION_DENIED', {
+        reason: WORKSPACE_NOT_ADMITTED,
+        recoveryHint: "Run 'vibes pm start' inside the workspace to admit it.",
+        details: { workspace: binding }
+    });
+}
+export function isWorkspaceNotAdmitted(error) {
+    return error instanceof Error && isCapabilityError(error) && error.reason === WORKSPACE_NOT_ADMITTED;
+}
+/** The admitted workspace of `runtime`'s binding, through its `pm/admitted-workspace` context. */
+export function requireAdmittedWorkspace(runtime) {
+    return runtime.context(PM_ADMITTED_WORKSPACE_CONTEXT_ID);
+}
+//# sourceMappingURL=admission.js.map

package/dist/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,wBAAwB,EAA0B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAuC,MAAM,qBAAqB,CAAC;AAG9G,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EAIxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,uBAAuB,CAAC;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACrD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,eAAe,EAAE;YACtG,MAAM,EAAE,sBAAsB;SAC9B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACzD,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,cAAc,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,CAAC;IAC3F,OAAO,cAAc,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACzC,OAAqC,EACrC,OAAe;IAEf,IAAI,SAAS,GAAwD,IAAI,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QACrD,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACpF,IAAI,CAAC,SAAS,IAAI,KAAK,GAAG,SAAS,CAAC,KAAK;YAAE,SAAS,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,EAAE,MAAM,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,OAAO,IAAI,eAAe,CAAC,kBAAkB,OAAO,0BAA0B,EAAE,mBAAmB,EAAE;QACpG,MAAM,EAAE,sBAAsB;QAC9B,YAAY,EAAE,wDAAwD;QACtE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;KAC/B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IAC1D,OAAO,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB,CAAC;AACtG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CACvC,OAAoC;IAEpC,OAAO,OAAO,CAAC,OAAO,CAAoB,gCAAgC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/admitted-workspace.context.descriptor.d.ts

@@ -0,0 +1,39 @@
+/**
+ * PM Admitted Workspace Context Descriptor
+ *
+ * `pm/admitted-workspace`: the innermost admitted workspace containing the
+ * runtime's workspace binding (framework-M8, rc02-rc03 §2.4); `PERMISSION_DENIED`
+ * `workspace-not-admitted` when none does. Its `toolingId(root)` names the PM
+ * socket, pid, lock, state and logs, the runtime daemon's sockets and pid, and
+ * the workers socket.
+ */
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=admitted-workspace.context.descriptor.d.ts.map

package/dist/admitted-workspace.context.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admitted-workspace.context.descriptor.d.ts","sourceRoot":"","sources":["../src/admitted-workspace.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,wBAMG"}

package/dist/admitted-workspace.context.descriptor.js

@@ -0,0 +1,18 @@
+/**
+ * PM Admitted Workspace Context Descriptor
+ *
+ * `pm/admitted-workspace`: the innermost admitted workspace containing the
+ * runtime's workspace binding (framework-M8, rc02-rc03 §2.4); `PERMISSION_DENIED`
+ * `workspace-not-admitted` when none does. Its `toolingId(root)` names the PM
+ * socket, pid, lock, state and logs, the runtime daemon's sockets and pid, and
+ * the workers socket.
+ */
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+import { PM_ADMITTED_WORKSPACE_CONTEXT_ID } from "./admission.js";
+export default createContextDescriptor({
+    id: PM_ADMITTED_WORKSPACE_CONTEXT_ID,
+    name: 'PM admitted workspace',
+    description: "The innermost admitted workspace containing this runtime's workspace binding; PERMISSION_DENIED workspace-not-admitted otherwise.",
+    hardware: ['consumer']
+});
+//# sourceMappingURL=admitted-workspace.context.descriptor.js.map

package/dist/admitted-workspace.context.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admitted-workspace.context.descriptor.js","sourceRoot":"","sources":["../src/admitted-workspace.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAElE,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,gCAAgC;IACpC,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACV,mIAAmI;IACpI,QAAQ,EAAE,CAAC,UAAU,CAAC;CACtB,CAAC,CAAC"}

package/dist/admitted-workspace.context.impl.consumer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `pm/admitted-workspace` provider (framework-M8, rc02-rc03 §2.4): the
+ * innermost admitted record containing the resolving runtime's
+ * `runtime/workspace-path`, read from the `pm.workspaces` manifest on every
+ * resolution; `workspace-not-admitted` when none contains it.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+declare const defaultExport: {
+    provide: (runtime: RuntimeRef) => Promise<{
+        root: string;
+        admittedAt: string;
+        admittedBy: "user" | "install";
+    }>;
+};
+export default defaultExport;
+//# sourceMappingURL=admitted-workspace.context.impl.consumer.d.ts.map

package/dist/admitted-workspace.context.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admitted-workspace.context.impl.consumer.d.ts","sourceRoot":"","sources":["../src/admitted-workspace.context.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,QAAA,MAAM,aAAa;uBACC,UAAU;;;;;CAC7B,CAAC;AAEF,eAAe,aAAa,CAAC"}