@devrouter/cli 0.5.6 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.5.6",
+  "version": "0.6.1",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",
@@ -12,12 +12,17 @@
   "files": [
     "bin",
     "dist",
-    "upgrade-prompts"
+    "upgrade-prompts",
+    "assets/preview"
   ],
   "type": "commonjs",
   "engines": {
     "node": ">=24"
   },
+  "exports": {
+    "./preview/gitlab-ingress": "./dist/devrouter-preview-gitlab-ingress.js",
+    "./*": "./*"
+  },
   "bin": {
     "devrouter": "dist/devrouter.js",
     "devrouter-process": "bin/devrouter-process"
@@ -47,6 +52,9 @@
     "dev": "tsx src/cli.ts",
     "test": "vitest run && pnpm test:process",
     "test:package": "./scripts/package-smoke.sh",
+    "qualify:preview-northflank": "node --import tsx scripts/qualify-preview-northflank.ts",
+    "qualify:preview-forge": "node --import tsx scripts/qualify-preview-forge.ts",
+    "qualify:preview-control": "node --import tsx scripts/qualify-preview-control.ts",
     "qualify:lifecycle": "node --import tsx scripts/qualify-lifecycle.ts",
     "qualify:capacity": "node --import tsx scripts/qualify-capacity.ts",
     "qualify:controller": "node --import tsx scripts/qualify-controller.ts",

package/upgrade-prompts/0.6.0.md

@@ -0,0 +1,57 @@
+# Upgrade to devrouter 0.6.0
+
+This release adds experimental, opt-in remote preview planning and installed
+controller integrations for GitHub and GitLab, with Northflank as the first
+provider. It also invalidates controller authority across short host sleeps.
+Local routing and profile configuration retain their existing behavior.
+
+## Task
+
+Install the published 0.6.0 CLI and inspect `devrouter upgrade 0.6.0`.
+There is no mandatory consumer schema migration. Bump `devrouter.version` only
+within an authorized consumer adaptation, and refresh generated agent guidance
+with `devrouter repo agents` when that repository carries it.
+
+Remote preview adoption is separate from a CLI upgrade. `.devrouter.yml` retains
+local routing and profile membership; `.devrouter.preview.yml` declares remote
+resource bindings. Read `docs/PREVIEWS.md` in the release source before adopting
+previews. Use `preview init` without `--write` to inspect a scaffold, or
+`preview plan --list --json` and `preview plan --alias <name> --json` when a
+reviewed manifest already exists. Offline planning requires no cloud credentials
+or application runtime and does not authorize deployment.
+
+Installed integrations require reviewed private policy, durable state, scoped
+credentials and installation-specific qualification. GitHub integration generation
+requires full immutable commit SHAs for both controller and policy references;
+use the release commit SHA for the controller. GitLab callers pin the controller
+commit and a controller image digest containing the reviewed policy. Before
+creating or exposing a trigger, set the controller project's pipeline-variable
+minimum role to `no_one_allowed` and verify it with
+`preview doctor --live --installation <file>`. Installing this npm package alone
+does not install a PR-comment workflow or qualify native infrastructure.
+Keep admission disabled until each required native proof and acceptance check
+passes. Provider output commands must be bounded, read-only and idempotent;
+client timeout does not terminate the remote command.
+
+## Validation
+
+1. Run `devrouter -V` in the consumer checkout and confirm installed 0.6.0.
+   Inspect the adaptation prompt and run existing static configuration checks.
+2. If preview adoption is authorized and a reviewed manifest exists, run offline
+   alias listing and planning. Account for every selected profile member and
+   intentional omission; an incomplete or unbound plan cannot authorize effects.
+3. For separately authorized controller activation, verify forge-specific
+   controller and policy pins, scoped credentials, durable state and every native
+   admission proof before allocation. Source tests and a successful offline plan
+   establish neither cloud readiness nor viewer access.
+4. Use the consumer's focused checks for any actual source adaptation. This
+   metadata upgrade and offline planning do not require an application runtime.
+   If an authorized live check touches a runtime, stop its exact checkout and
+   verify provider stopped plus zero owned routes unless explicitly kept running.
+
+## Report
+
+Report installed version and executable, consumer changes, offline plan results,
+controller and policy pins when applicable, qualification still pending, and the
+outcome of any separately authorized live checks. Distinguish CLI publication,
+installation activation and working application acceptance.

package/upgrade-prompts/0.6.1.md

@@ -0,0 +1,51 @@
+# Upgrade to devrouter 0.6.1
+
+This patch repairs managed-state persistence and explicit stop recovery after
+container replacement. It also makes interrupted or stalled ensure operations
+inspectable without waiting for the lifecycle mutation lock. Repository schemas
+and existing routing configuration remain compatible.
+
+## Task
+
+Install the published 0.6.1 CLI and inspect `devrouter upgrade 0.6.1`. Within an
+authorized consumer adaptation, bump `devrouter.version` in `.devrouter.yml`
+and refresh existing generated agent guidance with `devrouter repo agents`.
+No schema migration, application restart or consumer data reset is required by
+the metadata upgrade itself.
+
+Inspect a managed operation with `devrouter status --repo <exact-checkout>
+--json`. For explicit diagnostic output, use `devrouter logs --repo
+<exact-checkout> --tail 100`. The ensure output snapshot is private and bounded
+to 32 KiB, has no follow mode, and is unavailable when its operation evidence
+cannot be validated. Stage and output freshness do not prove liveness. Worker
+handshake and cancellation limits are distinct from execution, which has no
+implicit deadline.
+
+Ordinary stop continues to refuse changed immutable ownership. For a separately
+authorized recovery of replaced containers, use `devrouter stop <exact-checkout>
+--repair --json`. This requires complete provider, daemon, source, configuration,
+mount, population and exact-ID proof, preserves volumes and cannot combine with
+`--delete`. A service network namespace is equivalent only when live inspection
+proves the exact owned target; changed or uncertain evidence still refuses.
+`ensure --repair` remains a separate recovery operation. Do not bypass a
+refusal with raw Docker or provider mutations.
+
+## Validation
+
+1. Confirm the installed CLI and executable with `devrouter -V`, and inspect
+   this adaptation prompt. Run existing static consumer checks for actual edits.
+2. When runtime verification is separately authorized, use the exact checkout
+   for ordinary ensure, actual application work and supported recovery. Check
+   data retention and neighbour isolation rather than treating readiness as
+   proof of working application behavior.
+3. After the last runtime check, stop that exact checkout and verify its provider
+   is stopped and its owned routes are absent unless explicitly kept running.
+   An unknown worker, ownership conflict or surviving resource remains a refusal.
+
+## Report
+
+Report installed version and executable, consumer metadata changes, checks and
+producing source/package identities, any explicit recovery performed, retained
+data proof, and final provider/route state. Distinguish publication, global
+installation and consumer runtime acceptance. Keep private runtime data out of
+shared source and release artifacts.