@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/commands/package/publish.js

@@ -12,20 +12,247 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDIGNORE_FILE = exports.DATA_FILE_SUFFIXES = exports.MAX_DATA_FILE_BYTES = exports.MAX_PACKAGE_BYTES = exports.PUBLISH_EXCLUDES = void 0;
+exports.isDataFile = isDataFile;
+exports.oversizedDataFiles = oversizedDataFiles;
+exports.dataFileTooLargeMessage = dataFileTooLargeMessage;
+exports.publishHelpText = publishHelpText;
 exports.publish = publish;
+exports.readCredignore = readCredignore;
+exports.anyCase = anyCase;
+exports.createPackageArchive = createPackageArchive;
+exports.latestState = latestState;
+exports.nextVersion = nextVersion;
 require("../../polyfills/file.polyfill"); // Native support for File is only available on Node 19.2 or above
 const archiver_1 = __importDefault(require("archiver"));
+const axios_1 = __importDefault(require("axios"));
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const api_1 = require("../../client/api");
 const configuration_1 = require("../../client/configuration");
 const clientconfiguration_1 = require("../../clientconfiguration");
 const logger_1 = require("../../logger");
+const constants_1 = require("../../constants");
 const utils_1 = require("../../utils");
 const validator_1 = require("../../validator");
+const tablefile_1 = require("../table/tablefile");
 const packagesApi = new api_1.PackagesApi(new configuration_1.Configuration());
 const PACKAGE_MANIFEST_NAME = "publisher.json";
+// Error codes returned by createOrUpdatePackage (409) when the package publishes from
+// git and this upload did not come from the merge path — retrying can't fix it.
+const GIT_BACKED_REFUSAL_CODES = new Set([
+    "GIT_BACKED_PACKAGE_REQUIRES_DRAFT",
+    "GIT_BACKED_PACKAGE_REQUIRES_GIT_VERSION",
+]);
+/** Print what to do instead of retrying a git-backed publish refusal. */
+function printGitBackedRefusal(details, printedServerMessage) {
+    const haveCoordinates = (details === null || details === void 0 ? void 0 : details.gitRepositoryOwner) &&
+        (details === null || details === void 0 ? void 0 : details.gitRepositoryName) &&
+        (details === null || details === void 0 ? void 0 : details.gitBaseBranch);
+    // Without coordinates (an older server, or a repository record since cleared) the server's
+    // message is the only accurate next step, so no steps are guessed here.
+    const nextSteps = haveCoordinates
+        ? "To publish this change:\n" +
+            `  1. git clone https://github.com/${details.gitRepositoryOwner}/${details.gitRepositoryName}\n` +
+            `  2. Create a branch and commit your change\n` +
+            `  3. Open a pull request into ${details.gitBaseBranch}\n` +
+            `  4. Merging the pull request publishes the new version\n\n` +
+            "Or edit this package as a draft in Credible and publish from there.\n\n"
+        : printedServerMessage
+            ? "Follow the message above to publish it.\n\n"
+            : "Publish it through the environment's git repository, or ask an organization admin " +
+                "to check its git settings.\n\n";
+    logger_1.logger.error("Nothing was published — this package publishes from git, not from `cred publish`.\n\n" +
+        nextSteps +
+        "Do not retry this command — publishing again will not succeed.");
+}
+/**
+ * What never goes into the uploaded package.
+ *
+ * The first entry is a credential: after `cred init` adopts a local
+ * Publisher's connections, the user's original `publisher.config.json` — with
+ * the warehouse password in it — is still in the directory, and zipping the
+ * whole directory uploaded it into Credible's package store. `.mcp.json.bak` is
+ * the same class: `writeMcpConfig` leaves one behind when it could not parse an
+ * existing `.mcp.json` (numbered `.bak.1`, `.bak.2` once one exists), and that
+ * file is the user's own MCP config, headers and all. The rest are this developer's local wiring (the environment pin, agent
+ * config, skills), a checkout's `.git`, and dependencies: none of them is the
+ * model.
+ *
+ * **Every pattern is `**\/`-anchored**, and that is load-bearing rather than
+ * stylistic. A bare `publisher.config.json` is a minimatch pattern that matches
+ * only at the archive root, so a nested one — a monorepo with a second package
+ * below, a vendored example — was zipped and uploaded with the password in it,
+ * while `.git` and `node_modules` (already anchored) were correctly excluded at
+ * every depth. The exclusion that mattered most was the one anchored least.
+ *
+ * Fixed rather than read from `.gitignore`: a user without git, or with a
+ * `.gitignore` that lists their data files, would get the wrong package. And a
+ * list of what to leave out rather than of what to keep, because a model can
+ * read a data file of any extension, and a package missing its data is broken.
+ *
+ * Matched regardless of case (see {@link anyCase}): on macOS
+ * `Publisher.config.json` is the same file the Publisher reads. `.credignore`'s
+ * patterns are folded the same way, for the same reason: on macOS `secrets/`
+ * names the `Secrets/` folder, and git there (`core.ignorecase`) leaves it out.
+ */
+exports.PUBLISH_EXCLUDES = [
+    "**/publisher.config.json",
+    // Where credentials conventionally live. A package never needs one: the
+    // connections it queries through are created with `cred add connection`,
+    // not read from a file in the upload.
+    "**/.env",
+    "**/.env.*",
+    "**/*.pem",
+    "**/*.key",
+    "**/*.p12",
+    "**/*.pfx",
+    "**/*.p8", // Snowflake key-pair auth
+    "**/*credentials*.json",
+    "**/credentials", // ~/.aws/credentials, copied into a project
+    "**/.git-credentials",
+    // SSH private keys, by their default names. The `*` also drops the
+    // matching `.pub`, which is harmless but is not a model either.
+    "**/id_rsa*",
+    "**/id_ed25519*",
+    "**/id_ecdsa*",
+    "**/id_dsa*",
+    "**/profiles.yml", // dbt's warehouse logins
+    "**/*service-account*.json",
+    "**/*service_account*.json",
+    "**/.npmrc",
+    "**/.netrc",
+    "**/.pgpass",
+    "**/.credible/**",
+    "**/.git/**",
+    "**/node_modules/**",
+    "**/.mcp.json",
+    // `writeMcpConfig` numbers a second backup `.mcp.json.bak.1`, then `.2`.
+    "**/.mcp.json.bak*",
+    "**/CLAUDE.md",
+    "**/AGENTS.md",
+    "**/.claude/**",
+    "**/.agents/**",
+    "**/.cursor/**",
+    // The user's own exclusion list, at any depth: only the root one is read,
+    // and a nested one (a vendored example) is no more part of the model.
+    "**/.credignore",
+    "**/.credignore/**",
+];
+/**
+ * The largest package upload the deployed ingress accepts, in bytes.
+ *
+ * This is nginx's `proxy-body-size = "50m"` on the main ingress in
+ * infrastructure/modules/{gcp,aws}/nginx/ingress.tf, and nginx counts `m` as
+ * MiB. The controlplane's own multipart limit (1 GB) is far above it, so nginx
+ * is what refuses a large package, with a bare HTML 413 page that names no
+ * limit. Nothing reads this value from the server, so a change to the ingress
+ * must change it too.
+ */
+exports.MAX_PACKAGE_BYTES = 50 * 1024 * 1024;
+/**
+ * A size in MiB to one decimal place. The limit is in MiB, so the size is too:
+ * printing "MB" would undercount by about 5%.
+ *
+ * A size other than the limit is rounded away from the limit, so it never
+ * prints as the limit itself. Plain rounding would print 49.99 MiB as "50 MiB"
+ * next to "the limit is 50 MiB".
+ */
+function mebibytes(bytes, limit = exports.MAX_PACKAGE_BYTES) {
+    const tenths = (bytes / (1024 * 1024)) * 10;
+    const rounded = bytes > limit
+        ? Math.ceil(tenths)
+        : bytes < limit
+            ? Math.floor(tenths)
+            : tenths;
+    return `${rounded / 10} MiB`;
+}
+/**
+ * The one message for a package that is too large, used both before the upload
+ * and when the server answers 413. Only a 413 reaches the second form: the zip fits under the limit, but the
+ * multipart request around it does not.
+ */
+function tooLargeMessage(bytes) {
+    const size = bytes > exports.MAX_PACKAGE_BYTES
+        ? `Package is ${mebibytes(bytes)}; the limit is ${mebibytes(exports.MAX_PACKAGE_BYTES)}.`
+        : `Package is ${mebibytes(bytes)}, so close to the ${mebibytes(exports.MAX_PACKAGE_BYTES)} limit that the upload is over it.`;
+    return `${size} Nothing was published. Fix: remove or shrink large data files and publish again.`;
+}
+/**
+ * The largest data file a package should carry (database-design.md §12.2, D12).
+ * A package is models plus small seeds; anything bigger belongs in a database,
+ * where it is metered, shared by every package in the environment, and not
+ * copied to every worker. In phase 1 a larger file is warned about and still
+ * published; the refusal comes with the control plane's check (§12.8).
+ */
+exports.MAX_DATA_FILE_BYTES = 1024 * 1024;
+/**
+ * What a model reads with `table('data/…')`: the formats the worker's DuckDB
+ * reads by suffix (draft-data-file-upload-design.md §5.1), plus `.xls`, which
+ * it does not read but which is a data file all the same. Longest first, so
+ * `.csv.gz` is one suffix rather than `.gz`.
+ */
+exports.DATA_FILE_SUFFIXES = [
+    ".csv.gz",
+    ".tsv.gz",
+    ".parquet",
+    ".ndjson",
+    ".jsonl",
+    ".json",
+    ".xlsx",
+    ".xls",
+    ".csv",
+    ".tsv",
+];
+/**
+ * Whether a package path is a data file. A `.json` at the package root is not:
+ * `publisher.json` lives there, and §5.1 reads JSON data only below it.
+ */
+function isDataFile(relative) {
+    const lower = relative.toLowerCase();
+    const suffix = exports.DATA_FILE_SUFFIXES.find((s) => lower.endsWith(s));
+    if (!suffix)
+        return false;
+    return !(suffix === ".json" && !relative.includes("/"));
+}
+/**
+ * The data files in `included` over {@link MAX_DATA_FILE_BYTES}. Read from the
+ * archive's own list, so a file `.credignore` or the fixed excludes left out
+ * can never trip it.
+ */
+function oversizedDataFiles(included, directory) {
+    return included
+        .filter(isDataFile)
+        .map((relative) => ({
+        path: relative,
+        bytes: fs_1.default.statSync(path_1.default.join(directory, relative)).size,
+    }))
+        .filter((file) => file.bytes > exports.MAX_DATA_FILE_BYTES);
+}
+/** A shell word for a path in a suggested command. */
+function shellWord(value) {
+    return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value)
+        ? value
+        : `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** The warning for one oversized data file, naming the command that moves it into a database. */
+function dataFileTooLargeMessage(file) {
+    const table = (0, tablefile_1.defaultTableName)(file.path);
+    const tooLarge = `${file.path} is ${mebibytes(file.bytes, exports.MAX_DATA_FILE_BYTES)}; a package data file should be at most ${mebibytes(exports.MAX_DATA_FILE_BYTES, exports.MAX_DATA_FILE_BYTES)}, and a later release will refuse a larger one.`;
+    // A database reads xlsx, not the older binary .xls.
+    if (file.path.toLowerCase().endsWith(".xls")) {
+        return `${tooLarge} Save it as .xlsx or .csv, then put it in a database with cred add table credible <file> and read it as credible.table('${table}').`;
+    }
+    return `${tooLarge} Put it in a database: cred add table credible ${shellWord(file.path)}, then read it as credible.table('${table}') (the credible-publish-local-data skill does this for every file).`;
+}
+/** Warn about each data file over the cap. The publish goes ahead. */
+function warnOversizedDataFiles(included, directory) {
+    for (const file of oversizedDataFiles(included, directory)) {
+        logger_1.logger.warn(dataFileTooLargeMessage(file));
+    }
+}
 /**
  * Record a publish failure: log it (when the caller has a message of its own to give)
  * and mark the process failed.
@@ -42,32 +269,101 @@ function failPublish(message) {
     }
     process.exitCode = 1;
 }
-function publish(controlPlane, replicationCount, debug, autoConfirm, setLatest) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const clientConfig = new clientconfiguration_1.ClientConfiguration();
-        if (!clientConfig.doesConfigExists()) {
-            failPublish("Please, make sure that you are logged in");
-            return;
+/** The user's own exclusions, one pattern per line. See {@link readCredignore}. */
+exports.CREDIGNORE_FILE = ".credignore";
+/**
+ * The text after `cred publish --help`'s options. An agent learns the command
+ * from `--help` alone (the README does not ship with the CLI), so this states
+ * what it reads, what it leaves out, and what `--json` prints. The fixed list is
+ * rendered from {@link PUBLISH_EXCLUDES}, so it cannot fall behind it.
+ */
+function publishHelpText() {
+    const fixed = exports.PUBLISH_EXCLUDES.map((pattern) => pattern.replace(/^\*\*\//, "").replace(/\/\*\*$/, "/")).filter((name) => name !== exports.CREDIGNORE_FILE && name !== `${exports.CREDIGNORE_FILE}/`);
+    // Wrapped to the width of the prose around it.
+    const lines = [];
+    for (const name of fixed) {
+        const last = lines.length - 1;
+        if (last >= 0 && lines[last].length + name.length + 2 <= 72) {
+            lines[last] += `, ${name}`;
         }
-        const tokenValidation = clientConfig.isTokenValid();
-        if (!tokenValidation.valid) {
-            failPublish(tokenValidation.reason || "Please, make sure that you are logged in");
-            return;
+        else {
+            if (last >= 0)
+                lines[last] += ",";
+            lines.push(name);
+        }
+    }
+    return `
+Publishes the package in the current directory: ${PACKAGE_MANIFEST_NAME} there
+must have "name" and "version", and every file under it is uploaded except:
+
+  Always left out, at any depth and in any case:
+    ${lines.join("\n    ")}.
+  ${exports.CREDIGNORE_FILE}: one path or glob per line, beside ${PACKAGE_MANIFEST_NAME}.
+    \`notes.md\` or \`tests/\` match at any depth; \`/docs\` only at the top.
+    Matched in any case. Lines starting with \`#\` are comments. A \`!\` line
+    is ignored: it can leave files out, never put them back. Only the root
+    ${exports.CREDIGNORE_FILE} is read, and none is uploaded.
+
+A data file (csv, tsv, parquet, json, jsonl, ndjson, xlsx, xls) over 1 MiB is
+published with a warning, and a later release will refuse it: put it in a
+database with \`cred add table credible <file>\` and read it as
+credible.table('<name>').
+
+Check the list first with --dry-run (files on stdout, left-out ones on stderr).
+
+--json prints one document: organization, environment, package, version,
+url, latest ("now", "when-built" or "no"), latestVersion, excluded, and
+response (the server's reply, whose "warnings" are only there).
+With --dry-run it prints dryRun, package, version, included and excluded.
+
+Exit 1 when the publish fails, including a version that is already published
+(a version cannot be replaced: raise "version" in ${PACKAGE_MANIFEST_NAME}).
+After a publish, \`cred get version <package> <version>\` shows whether it has
+built, and \`cred get package <package>\` which version is latest.`;
+}
+function publish(controlPlane_1, replicationCount_1, debug_1, autoConfirm_1, setLatest_1) {
+    return __awaiter(this, arguments, void 0, function* (controlPlane, replicationCount, debug, autoConfirm, setLatest, 
+    // A directory `cred init` pinned to a deployment publishes there: index.ts
+    // resolves the pin and passes the store scoped to it, so the token, the
+    // organization and the control-plane URL all come from one deployment.
+    clientConfig = new clientconfiguration_1.ClientConfiguration(), 
+    // An organization and environment that override the store's, resolved by
+    // the caller so this function has one source for each.
+    identity = {}, options = {}) {
+        var _a, _b, _c, _d;
+        // A dry run skips the login checks: it uploads nothing, and a preview that
+        // demanded a login would be no preview for someone not yet signed in.
+        let organizationName = "";
+        let environmentName = "";
+        if (!options.dryRun) {
+            if (!clientConfig.doesConfigExists()) {
+                failPublish("Please, make sure that you are logged in");
+                return;
+            }
+            const tokenValidation = clientConfig.isTokenValid();
+            if (!tokenValidation.valid) {
+                failPublish(tokenValidation.reason ||
+                    "Please, make sure that you are logged in");
+                return;
+            }
         }
         if (!(0, validator_1.validateManifest)()) {
             // validateManifest logs its own reason; only the exit code is missing.
             failPublish();
             return;
         }
-        const environmentName = clientConfig.getProject();
-        const organizationName = clientConfig.getOrganization();
-        if (!organizationName) {
-            failPublish("Please, make sure that you are logged in");
-            return;
-        }
-        if (!environmentName) {
-            failPublish("Please, make sure to set an environment");
-            return;
+        if (!options.dryRun) {
+            environmentName = (_b = (_a = identity.environment) !== null && _a !== void 0 ? _a : clientConfig.getProject()) !== null && _b !== void 0 ? _b : "";
+            organizationName =
+                (_d = (_c = identity.organization) !== null && _c !== void 0 ? _c : clientConfig.getOrganization()) !== null && _d !== void 0 ? _d : "";
+            if (!organizationName) {
+                failPublish("Please, make sure that you are logged in");
+                return;
+            }
+            if (!environmentName) {
+                failPublish("Please, make sure to set an environment");
+                return;
+            }
         }
         if (!fs_1.default.existsSync(PACKAGE_MANIFEST_NAME)) {
             failPublish(`Failed to publish the package. Could not find ${PACKAGE_MANIFEST_NAME}, please ensure you are in a directory containing ${PACKAGE_MANIFEST_NAME}`);
@@ -75,29 +371,346 @@ function publish(controlPlane, replicationCount, debug, autoConfirm, setLatest)
         }
         const packageManifestJson = fs_1.default.readFileSync(PACKAGE_MANIFEST_NAME);
         const packageManifest = JSON.parse(packageManifestJson.toString());
+        // Checked here because the server does not check it for us: a manifest
+        // without a version was sent as `version undefined` and came back as an
+        // HTTP 500 with nothing to act on.
+        for (const field of ["name", "version"]) {
+            const value = packageManifest === null || packageManifest === void 0 ? void 0 : packageManifest[field];
+            if (typeof value !== "string" || !value.trim()) {
+                failPublish(`${PACKAGE_MANIFEST_NAME} has no "${field}". Fix: add "${field}": ${field === "version" ? '"0.0.1"' : '"<package-name>"'} to it and publish again.`);
+                return;
+            }
+        }
+        // The name the server publishes under, so the question asks about the
+        // package that will exist. It asked about the folder, which can differ.
+        const packageName = packageManifest.name;
+        const versionId = packageManifest.version;
         const workingDirectory = process.cwd();
-        const packageName = workingDirectory.substring(workingDirectory.lastIndexOf("/") + 1);
-        const tmpPackagePath = path_1.default.join("/tmp", packageName + ".zip");
-        if (!autoConfirm) {
-            const confirmation = yield (0, utils_1.getConfirmation)(`Are you sure you that want to publish a package named ${packageName}?`);
-            if (!confirmation) {
-                logger_1.logger.info("Operation cancelled.");
+        let extraExcludes;
+        try {
+            extraExcludes = readCredignore(workingDirectory);
+        }
+        catch (e) {
+            failPublish(e.message);
+            return;
+        }
+        // A directory of its own, not `/tmp/<name>.zip`: two publishes of the same
+        // name at once wrote, uploaded and deleted one shared file. The zip's name
+        // is fixed, never the package's: publisher.json's "name" is not checked
+        // until the server sees it, and `"../x"` would write outside this directory.
+        const tmpDirectory = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), "cred-publish-"));
+        const tmpPackagePath = path_1.default.join(tmpDirectory, "package.zip");
+        try {
+            if (options.dryRun) {
+                const { included, excluded, bytes } = yield createPackageArchive(tmpPackagePath, workingDirectory, extraExcludes);
+                reportDryRun(packageName, versionId, included, excluded, options);
+                // After the report, so the list shows what the manifest went with.
+                if (failIfNoManifest(included))
+                    return;
+                // The same checks the real publish makes, so a preview of an
+                // oversized package says so instead of passing.
+                warnOversizedDataFiles(included, workingDirectory);
+                if (bytes > exports.MAX_PACKAGE_BYTES)
+                    failPublish(tooLargeMessage(bytes));
+                return;
+            }
+            // Built before the question, so the question can say what it is about to
+            // send. It was asked first, and what was left out printed only once the
+            // upload was under way.
+            const { included, excluded, bytes } = yield createPackageArchive(tmpPackagePath, workingDirectory, extraExcludes);
+            if (excluded.length) {
+                logger_1.logger.info(`Left out of the package: ${excluded.join(", ")}.`);
+            }
+            if (failIfNoManifest(included))
+                return;
+            // Before the question, on what the archive took: the per-file warning
+            // names the fix, and the zip total is a refusal, since the ingress would
+            // refuse the upload anyway.
+            warnOversizedDataFiles(included, workingDirectory);
+            if (bytes > exports.MAX_PACKAGE_BYTES) {
+                failPublish(tooLargeMessage(bytes));
                 return;
             }
+            if (!autoConfirm) {
+                const confirmation = yield (0, utils_1.getConfirmation)(`Publish ${packageName} version ${versionId} (${included.length} file${included.length === 1 ? "" : "s"})? \`cred publish --dry-run\` lists the files.`, clientConfig);
+                if (!confirmation) {
+                    logger_1.logger.info("Operation cancelled.");
+                    return;
+                }
+            }
+            yield pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCount, organizationName, environmentName, tmpPackagePath, packageName, packageManifest.description, versionId, debug, setLatest, bytes, Object.assign(Object.assign({}, options), { excluded }));
+        }
+        finally {
+            removeTmpDirectory(tmpDirectory);
         }
-        yield createTmpPackageArchive(tmpPackagePath);
-        yield pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCount, organizationName, environmentName, tmpPackagePath, packageManifest.name, packageManifest.description, packageManifest.version, debug, setLatest);
-        yield removeTmpPackage(tmpPackagePath);
     });
 }
-function createTmpPackageArchive(packagePath) {
-    return __awaiter(this, void 0, void 0, function* () {
+/**
+ * Stop when the archive has no `publisher.json`. Only `.credignore` can cause
+ * it (the fixed list never names the manifest), and a zip without one was
+ * uploaded anyway. An empty archive is this case too.
+ */
+function failIfNoManifest(included) {
+    if (included.includes(PACKAGE_MANIFEST_NAME))
+        return false;
+    // On macOS `Publisher.json` passed the existence check above, but the
+    // server, on a case-sensitive filesystem, would not find a manifest.
+    const misnamed = included.find((file) => file.toLowerCase() === PACKAGE_MANIFEST_NAME.toLowerCase());
+    if (misnamed) {
+        failPublish(`The manifest is named ${misnamed}, and the server reads only ${PACKAGE_MANIFEST_NAME}. Fix: rename it to ${PACKAGE_MANIFEST_NAME}, and publish again.`);
+        return true;
+    }
+    failPublish(`${exports.CREDIGNORE_FILE} leaves out ${PACKAGE_MANIFEST_NAME}, so the package would have no manifest. Fix: remove the line in ${exports.CREDIGNORE_FILE} that matches ${PACKAGE_MANIFEST_NAME}, and publish again.`);
+    return true;
+}
+/** `--dry-run`'s report: the file list on stdout, the rest on stderr. */
+function reportDryRun(packageName, versionId, included, excluded, options) {
+    if (options.json) {
+        console.log(JSON.stringify({
+            dryRun: true,
+            package: packageName,
+            version: versionId,
+            included,
+            excluded,
+        }, null, 2));
+        return;
+    }
+    logger_1.logger.info(`Dry run: nothing was uploaded. ${packageName} version ${versionId} would upload ${included.length} file${included.length === 1 ? "" : "s"}:`);
+    for (const file of included)
+        console.log(file);
+    if (excluded.length) {
+        logger_1.logger.info(`Left out of the package: ${excluded.join(", ")}.`);
+    }
+}
+/**
+ * Patterns from `.credignore` in the package directory, in the archive's glob
+ * form. Each line is a path or glob relative to that directory. A line with no
+ * `/` (other than a trailing one) matches at any depth, as in `.gitignore`;
+ * `tests/` or `tests` leaves the whole directory out. A leading `/` or `./`
+ * anchors a line to the package directory. Patterns match regardless of case,
+ * like the fixed list (see {@link anyCase}). On a case-sensitive filesystem that
+ * leaves out a little more than a line names (`secrets/` also takes
+ * `Secrets/`), which is the safe direction for a list of what not to upload.
+ *
+ * It only ever adds exclusions. A `!` line cannot put back a file the fixed
+ * list leaves out (a credential, the local wiring), so it is refused with a
+ * warning rather than half-honoured.
+ *
+ * Throws when a `.credignore` exists but cannot be read.
+ */
+function readCredignore(directory) {
+    let text;
+    try {
+        text = fs_1.default.readFileSync(path_1.default.join(directory, exports.CREDIGNORE_FILE)).toString();
+    }
+    catch (e) {
+        // No file is the usual case. Any other failure is not: publishing as if
+        // there were no file would upload what the user asked to leave out.
+        if (e.code === "ENOENT")
+            return [];
+        throw new Error(`Could not read ${exports.CREDIGNORE_FILE}: ${e.message}. Fix: make it readable, or delete it, and publish again.`);
+    }
+    const patterns = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        if (line.startsWith("!")) {
+            logger_1.logger.warn(`${exports.CREDIGNORE_FILE}: ignored "${line}". It can only leave files out, not put them back.`);
+            continue;
+        }
+        const anchored = /^\.?\//.test(line);
+        let body = line.replace(/^(?:\.?\/)+/, "").replace(/\/+$/, "");
+        if (!body)
+            continue;
+        // `/!x` names a file called `!x`. Unescaped, the glob would read it as
+        // a negation (which leaves out everything but x) or `#x` as a comment.
+        if (/^[!#]/.test(body))
+            body = `\\${body}`;
+        const base = anchored || body.includes("/") ? body : `**/${body}`;
+        // Both forms: `tests` may name a file or a directory.
+        patterns.push(base, `${base}/**`);
+    }
+    return patterns;
+}
+/**
+ * `**\/.env` → `**\/.[eE][nN][vV]`. readdir-glob, which archiver matches ignore
+ * patterns with, builds its matchers with no case-insensitive option.
+ *
+ * Inside a bracket class a letter gains its other case in place (`[a-c]` →
+ * `[a-cA-C]`): wrapping it in a class of its own would close the outer one and
+ * change what the pattern means. A POSIX class (`[:alpha:]`) is copied as is.
+ */
+function anyCase(pattern) {
+    let out = "";
+    let i = 0;
+    while (i < pattern.length) {
+        const c = pattern[i];
+        if (c === "\\" && i + 1 < pattern.length) {
+            const escaped = pattern[i + 1];
+            out += isLetter(escaped) ? bothCases(escaped) : c + escaped;
+            i += 2;
+            continue;
+        }
+        const close = c === "[" ? classEnd(pattern, i) : -1;
+        if (close === -1) {
+            out += isLetter(c) ? bothCases(c) : c;
+            i += 1;
+            continue;
+        }
+        out += `[${foldClass(pattern.slice(i + 1, close))}]`;
+        i = close + 1;
+    }
+    return out;
+}
+function isLetter(c) {
+    return c !== undefined && /^[a-z]$/i.test(c);
+}
+function bothCases(letter) {
+    return `[${letter.toLowerCase()}${letter.toUpperCase()}]`;
+}
+function otherCase(letter) {
+    return letter === letter.toLowerCase()
+        ? letter.toUpperCase()
+        : letter.toLowerCase();
+}
+/** The `]` that closes the class opened at `open`, or -1 when none does. */
+function classEnd(pattern, open) {
+    let j = open + 1;
+    if (pattern[j] === "!" || pattern[j] === "^")
+        j += 1;
+    // A `]` first in a class is a literal, not its end.
+    if (pattern[j] === "]")
+        j += 1;
+    while (j < pattern.length) {
+        const posix = /^\[:[a-z]+:\]/.exec(pattern.slice(j));
+        if (posix) {
+            j += posix[0].length;
+            continue;
+        }
+        if (pattern[j] === "]")
+            return j;
+        j += 1;
+    }
+    return -1;
+}
+/** A bracket class's body, with the other case of each letter and range added. */
+function foldClass(body) {
+    let kept = "";
+    let added = "";
+    let j = 0;
+    if (body[j] === "!" || body[j] === "^")
+        kept += body[j++];
+    if (body[j] === "]")
+        kept += body[j++];
+    while (j < body.length) {
+        const posix = /^\[:[a-z]+:\]/.exec(body.slice(j));
+        if (posix) {
+            kept += posix[0];
+            j += posix[0].length;
+            continue;
+        }
+        const from = body[j];
+        const to = body[j + 2];
+        if (body[j + 1] === "-" && to !== undefined) {
+            kept += `${from}-${to}`;
+            // `a-z` → also `A-Z`. A mixed range such as `A-z` is left alone.
+            if (isLetter(from) &&
+                isLetter(to) &&
+                (from === from.toLowerCase()) === (to === to.toLowerCase())) {
+                added += `${otherCase(from)}-${otherCase(to)}`;
+            }
+            j += 3;
+            continue;
+        }
+        kept += from;
+        if (isLetter(from))
+            added += otherCase(from);
+        j += 1;
+    }
+    return kept + added;
+}
+/** Every file under `directory`, as paths relative to it. Dotfiles included. */
+function listFiles(directory, prefix = "") {
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(path_1.default.join(directory, prefix), {
+            withFileTypes: true,
+        });
+    }
+    catch (_a) {
+        return [];
+    }
+    const found = [];
+    for (const entry of entries) {
+        const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            found.push(...listFiles(directory, relative));
+        }
+        else if (entry.isFile()) {
+            found.push(relative);
+        }
+    }
+    return found;
+}
+/**
+ * Collapse excluded paths to the thing a user recognises.
+ *
+ * `.claude/skills/x/SKILL.md` and forty siblings are one fact — "your skills
+ * were not uploaded" — so a directory-style pattern reports its directory. A
+ * file-style pattern reports the path itself, at whatever depth it was found,
+ * because `sub/publisher.config.json` is exactly the case the user needs to see
+ * named rather than folded into `publisher.config.json`.
+ */
+function describeExclusions(paths) {
+    const named = new Set();
+    for (const relative of paths) {
+        // Only the fixed list's directory patterns fold: they are the ones a
+        // user did not write and would not recognise file by file.
+        const directoryPattern = exports.PUBLISH_EXCLUDES.map((pattern) => pattern.replace(/^\*\*\//, "")).find((pattern) => pattern.endsWith("/**") &&
+            relative
+                .toLowerCase()
+                .split("/")
+                .includes(pattern.slice(0, -3).toLowerCase()));
+        if (directoryPattern) {
+            const name = directoryPattern.slice(0, -3).toLowerCase();
+            const at = relative.toLowerCase().split("/").indexOf(name);
+            named.add(relative
+                .split("/")
+                .slice(0, at + 1)
+                .join("/"));
+        }
+        else {
+            named.add(relative);
+        }
+    }
+    return [...named].sort();
+}
+/**
+ * Zip `sourceDir` into `packagePath`, minus {@link PUBLISH_EXCLUDES}.
+ *
+ * Returns what was actually left out, so the caller can say so — a user who
+ * sees their `publisher.config.json` was not uploaded learns the rule; one who
+ * sees nothing assumes it was.
+ *
+ * Derived by diffing the directory against what the archive took, rather than
+ * by testing each pattern for existence at the top level. The old form could
+ * only ever report a root-level hit, so the nested `publisher.config.json` that
+ * the anchoring fix now excludes would have been dropped silently — the report
+ * would have been wrong in exactly the case it exists to cover.
+ */
+function createPackageArchive(packagePath_1, sourceDir_1) {
+    return __awaiter(this, arguments, void 0, function* (packagePath, sourceDir, 
+    /** `.credignore`'s patterns, added to {@link PUBLISH_EXCLUDES}, never replacing it. */
+    extraExcludes = []) {
         logger_1.logger.info("Creating new package version in " + packagePath);
         const output = fs_1.default.createWriteStream(packagePath);
         const archive = (0, archiver_1.default)("zip", {
             zlib: { level: 9 }, // Sets the compression level.
         });
-        return new Promise((resolve, reject) => {
+        const archived = new Set();
+        archive.on("entry", (entry) => archived.add(entry.name));
+        yield new Promise((resolve, reject) => {
             archive
                 .on("warning", function (err) {
                 reject(err);
@@ -105,18 +718,32 @@ function createTmpPackageArchive(packagePath) {
                 .on("error", function (err) {
                 reject(err);
             })
-                .directory(".", false)
+                // `dot: true` so `.malloy`-adjacent dotfiles the model needs still
+                // travel; the exclusions above are the deliberate exceptions.
+                .glob("**/*", {
+                cwd: sourceDir,
+                dot: true,
+                nodir: true,
+                ignore: [...exports.PUBLISH_EXCLUDES, ...extraExcludes].map(anyCase),
+            })
                 .pipe(output);
             output.on("close", function () {
                 logger_1.logger.info(archive.pointer() + " total bytes");
-                resolve(undefined);
+                resolve();
             });
             archive.finalize();
         });
+        const excluded = describeExclusions(listFiles(sourceDir).filter((relative) => !archived.has(relative)));
+        return {
+            included: [...archived].sort(),
+            excluded,
+            bytes: archive.pointer(),
+        };
     });
 }
-function pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCount, organizationName, environmentName, tmpPackagePath, name, description, versionId, debug, setLatest) {
-    return __awaiter(this, void 0, void 0, function* () {
+function pushTmpPackageToRemoteServer(clientConfig_1, controlPlane_1, replicationCount_1, organizationName_1, environmentName_1, tmpPackagePath_1, name_1, description_1, versionId_1, debug_1, setLatest_1, bytes_1) {
+    return __awaiter(this, arguments, void 0, function* (clientConfig, controlPlane, replicationCount, organizationName, environmentName, tmpPackagePath, name, description, versionId, debug, setLatest, bytes, options = { excluded: [] }) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
         logger_1.logger.info("Pushing package " + name + " version " + versionId);
         const packageContents = new File([fs_1.default.readFileSync(tmpPackagePath)], tmpPackagePath);
         // Build the post string from an object
@@ -145,7 +772,8 @@ function pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCou
                 logger_1.logger.debug("Package: " + JSON.stringify(_package));
                 logger_1.logger.debug("Version: " + JSON.stringify(version));
                 logger_1.logger.debug("Control plane: " + controlPlane);
-                logger_1.logger.debug("Client config: " + JSON.stringify(clientConfig.getHeaders()));
+                logger_1.logger.debug("Client config: " +
+                    JSON.stringify((0, utils_1.redactHeaders)(clientConfig.getHeaders())));
             }
             const response = yield packagesApi.createOrUpdatePackage(organizationName, environmentName, name, _package, version, packageContents, md5Hash, 
             // draftId / workspace: a zip upload has no git-backed draft, so the server
@@ -154,11 +782,72 @@ function pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCou
                 baseURL: controlPlane,
                 headers: clientConfig.getHeaders(),
             });
-            logger_1.logger.info((0, utils_1.prettifyJson)(response.data));
-            const packageUrl = path_1.default.join(organizationName, environmentName, name, versionId);
-            logger_1.logger.info(`Package available at: ${packageUrl}`);
+            // The result is data, so it goes to stdout like every other command's
+            // result; the progress lines above are logs and go to stderr. On dev
+            // both reached stdout through logger.info, and scripts read the URL line.
+            const packageUrl = options.deployment
+                ? (0, constants_1.packageVersionUrl)(options.deployment, organizationName, environmentName, name, versionId)
+                : path_1.default.join(organizationName, environmentName, name, versionId);
+            const published = response.data;
+            const latest = latestState(published, versionId, setLatest);
+            if (options.json) {
+                console.log(JSON.stringify({
+                    organization: organizationName,
+                    environment: environmentName,
+                    package: name,
+                    version: versionId,
+                    url: packageUrl,
+                    latest,
+                    latestVersion: (_a = published === null || published === void 0 ? void 0 : published.latestVersion) !== null && _a !== void 0 ? _a : null,
+                    excluded: options.excluded,
+                    response: published,
+                }, null, 2));
+                return;
+            }
+            console.log(`Package available at: ${packageUrl}`);
+            // Only the publish response carries these (a later GET returns none),
+            // so this is the one chance to show them.
+            for (const warning of (_b = published === null || published === void 0 ? void 0 : published.warnings) !== null && _b !== void 0 ? _b : []) {
+                logger_1.logger.warn(describeWarning(warning));
+            }
+            logger_1.logger.info(describeLatest(latest, name, versionId, published));
+            logger_1.logger.info(`Check its build with \`cred get version ${name} ${versionId}\`.`);
         }
         catch (e) {
+            if (axios_1.default.isAxiosError(e) &&
+                ((_c = e.response) === null || _c === void 0 ? void 0 : _c.status) === 409 &&
+                GIT_BACKED_REFUSAL_CODES.has((_d = e.response.data) === null || _d === void 0 ? void 0 : _d.code)) {
+                // A structured refusal, not a transient failure — printOutError's raw JSON
+                // dump would bury the "what to do next" block, so it's skipped here.
+                failPublish();
+                const serverMessage = (_e = e.response.data) === null || _e === void 0 ? void 0 : _e.message;
+                if (serverMessage) {
+                    logger_1.logger.error(serverMessage);
+                }
+                printGitBackedRefusal((_f = e.response.data) === null || _f === void 0 ? void 0 : _f.details, Boolean(serverMessage));
+                return;
+            }
+            // nginx refuses an oversized body before the controlplane sees it, and its
+            // reply is an HTML page with no limit in it. The size check above catches
+            // almost every case; this covers the sliver where the zip fits but the
+            // multipart envelope around it does not.
+            if (axios_1.default.isAxiosError(e) && ((_g = e.response) === null || _g === void 0 ? void 0 : _g.status) === 413) {
+                failPublish(tooLargeMessage(bytes));
+                return;
+            }
+            const conflictMessage = axios_1.default.isAxiosError(e)
+                ? String((_k = (_j = (_h = e.response) === null || _h === void 0 ? void 0 : _h.data) === null || _j === void 0 ? void 0 : _j.message) !== null && _k !== void 0 ? _k : "")
+                : "";
+            if (axios_1.default.isAxiosError(e) &&
+                ((_l = e.response) === null || _l === void 0 ? void 0 : _l.status) === 409 &&
+                conflictMessage.startsWith("VersionId already exists")) {
+                // The server's own text first, unchanged: credible-cicd-template's
+                // cred_publish.sh greps for it to skip a version already published.
+                failPublish(conflictMessage);
+                // Versions are immutable, so a retry cannot succeed; say what to change.
+                logger_1.logger.error(`${name} version ${versionId} is already published, and a version cannot be replaced. Fix: set "version" in ${PACKAGE_MANIFEST_NAME} to a new one, for example "${nextVersion(versionId)}", and publish again.`);
+                return;
+            }
             // The server rejected it: a model that does not compile, or a `#@ persist`
             // declaration the publisher refuses to load.
             failPublish("Failed to publish package");
@@ -166,15 +855,57 @@ function pushTmpPackageToRemoteServer(clientConfig, controlPlane, replicationCou
         }
     });
 }
-function removeTmpPackage(tmpPackagePath) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return new Promise((resolve) => {
-            fs_1.default.unlink(tmpPackagePath, (err) => {
-                if (err)
-                    throw err;
-                resolve(undefined);
-            });
-        });
-    });
+function removeTmpDirectory(directory) {
+    try {
+        for (const file of fs_1.default.readdirSync(directory)) {
+            fs_1.default.unlinkSync(path_1.default.join(directory, file));
+        }
+        fs_1.default.rmdirSync(directory);
+    }
+    catch (_a) {
+        // Under the OS temp directory, which it cleans; not worth failing over.
+    }
+}
+function latestState(published, versionId, setLatest) {
+    if (setLatest || (published === null || published === void 0 ? void 0 : published.latestVersion) === versionId)
+        return "now";
+    // The server arms auto-promote on publish; the version becomes latest once
+    // its indexes and materialized tables are built (VersionLifecycleService).
+    if (published === null || published === void 0 ? void 0 : published.autoPromote)
+        return "when-built";
+    return "no";
+}
+function describeLatest(latest, name, versionId, published) {
+    const current = published === null || published === void 0 ? void 0 : published.latestVersion;
+    switch (latest) {
+        case "now":
+            return `Version ${versionId} is now the latest version of ${name}.`;
+        case "when-built":
+            return (`Version ${versionId} becomes the latest version once its indexes and materialized tables are built` +
+                (current ? `; until then the latest is ${current}.` : ".") +
+                " --set-latest makes it latest now, before they are built.");
+        case "no":
+            return (`Version ${versionId} is published but is not the latest` +
+                (current ? ` (that is ${current})` : "") +
+                `: auto-promote is off for ${name}. Make it latest with \`cred update package ${name} --version ${versionId}\`.`);
+    }
+}
+/**
+ * `0.0.1` → `0.0.2`; a version with no trailing number gets `.1`. Keeps the
+ * number's zero padding: `1.0.08` → `1.0.09`, not `1.0.9`.
+ */
+function nextVersion(versionId) {
+    const match = /^(.*?)(\d+)$/.exec(versionId);
+    if (!match)
+        return `${versionId}.1`;
+    const next = String(Number(match[2]) + 1).padStart(match[2].length, "0");
+    return `${match[1]}${next}`;
+}
+/** One publish warning as a line: where it is, then what it says. */
+function describeWarning(warning) {
+    var _a;
+    const where = [warning.model, warning.subject].filter(Boolean).join(" > ");
+    const message = (_a = warning.message) !== null && _a !== void 0 ? _a : "(no message)";
+    return where ? `${where}: ${message}` : message;
 }
 //# sourceMappingURL=publish.js.map