@dzhechkov/harness-cli 0.8.21 → 0.8.22

package/dist/known-flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"known-flags.d.ts","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EA2T5C,CAAC"}
+{"version":3,"file":"known-flags.d.ts","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EA4T5C,CAAC"}

package/dist/known-flags.js

@@ -324,5 +324,6 @@ export const KNOWN_CLI_FLAGS = [
     'write',
     'year',
     'yes',
+    'mirror-cmd', // dz publish epilogue (mirror-push-on-publish)
 ];
 //# sourceMappingURL=known-flags.js.map

package/dist/known-flags.js.map

@@ -1 +1 @@
-{"version":3,"file":"known-flags.js","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,KAAK;IACL,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,UAAU;IACV,IAAI;IACJ,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;IACV,MAAM;IACN,UAAU;IACV,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,2CAA2C;IAC3C,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,cAAc;IACd,WAAW;IACX,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,UAAU;IACV,YAAY;IACZ,SAAS;IACT,SAAS;IACT,OAAO;IACP,aAAa;IACb,YAAY;IACZ,KAAK;IACL,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,cAAc;IACd,SAAS;IACT,WAAW;IACX,cAAc;IACd,aAAa;IACb,eAAe;IACf,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,aAAa;IACb,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,aAAa;IACb,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,SAAS;IACT,oBAAoB;IACpB,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,OAAO;IACP,YAAY;IACZ,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,WAAW;IACX,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,gBAAgB;IAChB,eAAe;IACf,MAAM;IACN,YAAY;IACZ,aAAa,EAAE,yDAAyD;IACxE,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,YAAY;IACZ,MAAM;IACN,OAAO;IACP,GAAG;IACH,cAAc;IACd,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,GAAG;IACH,MAAM;IACN,WAAW;IACX,OAAO;IACP,UAAU;IACV,aAAa;IACb,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,eAAe;IACf,WAAW;IACX,aAAa;IACb,wBAAwB;IACxB,UAAU;IACV,WAAW;IACX,GAAG;IACH,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,UAAU;IACV,KAAK;IACL,SAAS;IACT,QAAQ;IACR,eAAe;IACf,UAAU;IACV,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,MAAM;IACN,eAAe;IACf,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,SAAS;IACT,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,mBAAmB;IACnB,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,WAAW;IACX,aAAa;IACb,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,cAAc;IACd,OAAO;IACP,eAAe;IACf,UAAU;IACV,OAAO;IACP,OAAO;IACP,YAAY;IACZ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,eAAe;IACf,aAAa;IACb,eAAe;IACf,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,IAAI;IACJ,WAAW;IACX,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,iBAAiB,EAAE,sBAAsB;IACzC,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,MAAM;IACN,KAAK;CACN,CAAC"}
+{"version":3,"file":"known-flags.js","sourceRoot":"","sources":["../src/known-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,KAAK;IACL,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;IACL,UAAU;IACV,IAAI;IACJ,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;IACV,MAAM;IACN,UAAU;IACV,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,2CAA2C;IAC3C,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,cAAc;IACd,WAAW;IACX,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,WAAW;IACX,UAAU;IACV,YAAY;IACZ,SAAS;IACT,SAAS;IACT,OAAO;IACP,aAAa;IACb,YAAY;IACZ,KAAK;IACL,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,cAAc;IACd,SAAS;IACT,WAAW;IACX,cAAc;IACd,aAAa;IACb,eAAe;IACf,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,MAAM;IACN,aAAa;IACb,MAAM;IACN,aAAa;IACb,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,aAAa;IACb,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,SAAS;IACT,oBAAoB;IACpB,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,OAAO;IACP,YAAY;IACZ,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,WAAW;IACX,WAAW;IACX,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,gBAAgB;IAChB,eAAe;IACf,MAAM;IACN,YAAY;IACZ,aAAa,EAAE,yDAAyD;IACxE,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,MAAM;IACN,YAAY;IACZ,MAAM;IACN,OAAO;IACP,GAAG;IACH,cAAc;IACd,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,GAAG;IACH,MAAM;IACN,WAAW;IACX,OAAO;IACP,UAAU;IACV,aAAa;IACb,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,eAAe;IACf,WAAW;IACX,aAAa;IACb,wBAAwB;IACxB,UAAU;IACV,WAAW;IACX,GAAG;IACH,MAAM;IACN,SAAS;IACT,MAAM;IACN,IAAI;IACJ,UAAU;IACV,KAAK;IACL,SAAS;IACT,QAAQ;IACR,eAAe;IACf,UAAU;IACV,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,MAAM;IACN,eAAe;IACf,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,WAAW;IACX,SAAS;IACT,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,mBAAmB;IACnB,UAAU;IACV,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,KAAK;IACL,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,WAAW;IACX,aAAa;IACb,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,cAAc;IACd,OAAO;IACP,eAAe;IACf,UAAU;IACV,OAAO;IACP,OAAO;IACP,YAAY;IACZ,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,eAAe;IACf,aAAa;IACb,eAAe;IACf,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,IAAI;IACJ,WAAW;IACX,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,iBAAiB,EAAE,sBAAsB;IACzC,OAAO;IACP,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,MAAM;IACN,KAAK;IACL,YAAY,EAAE,+CAA+C;CAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.8.21",
+  "version": "0.8.22",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 87 commands, 14 presets, 10 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -42,16 +42,16 @@
     "src"
   ],
   "dependencies": {
-    "@dzhechkov/harness-core": "^0.8.29",
+    "@dzhechkov/harness-core": "^0.8.30",
     "@dzhechkov/harness-presets": "^0.5.18",
-    "@dzhechkov/skills-mcp": "^0.3.10",
-    "@dzhechkov/scout": "^0.8.11",
     "@dzhechkov/skills-devops": "^0.3.17",
+    "@dzhechkov/scout": "^0.8.11",
+    "@dzhechkov/skills-mcp": "^0.3.10",
     "@dzhechkov/skills-web3": "^0.2.9",
-    "@dzhechkov/skills-meta": "^0.9.55",
     "@dzhechkov/skills-qe": "^0.3.14",
     "@dzhechkov/skills-academic": "^0.3.7",
     "@dzhechkov/skills-ecc": "^0.1.12",
+    "@dzhechkov/skills-meta": "^0.9.55",
     "@dzhechkov/skills-news": "^0.1.16",
     "@dzhechkov/skills-pm": "^0.1.5",
     "@dzhechkov/skills-taste": "^0.1.5",
@@ -83,6 +83,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "tsc -p tsconfig.json --noEmit"

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a3c1e1f9f922913c45df3482f2055ac2efc726108e1d4377195739e026a4034"
+          "content": "469aec881b39fe2b3e032bf75354fb7e998a08695327a74a69e0de90ad36a934"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a4f6ad121c0e81336e517b10ba656af428cc07d9f41fdc00967d1cd0122be1ee"
+          "content": "9c58b7696526c47244bf5933ddc7ae3d7d43f025f1e74096cd90bfbe5aaada53"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ef3852bb748f37d4e78a9a973505c3993eae2b996cc0cdd0659f531aa76621f4"
+          "content": "613f870e75033657b8f68ee4650c4699dce036c08393b588b2ff7ca399dd688f"
         }
       ]
     },
@@ -135,7 +135,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9d0a6cc044810b31d261b36913e3f63445f5e96550176fedd0faf606d8cbcd75"
+          "content": "112231fa1707bde97a6529c9cf2ad5c81e9d5e382b3a2b1fae89782b9918748a"
         }
       ]
     },
@@ -145,7 +145,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3049258ffd0972b6a748eda703221911dd33e3450486c1dec0f598a431faa038"
+          "content": "dae7aacba3d82f15c882ebadaca268161159e5b9dfd278ace4e8b802e12d858e"
         }
       ]
     },
@@ -325,7 +325,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "703058c8bbf0307ab29f12f8355c8984508f38214c32ab85da790446f0cb9699"
+          "content": "6b514318ec7c607ce7c6e9f7faccc98f2ddde0f2949aec4b730f0f104ef476c6"
         }
       ]
     },
@@ -335,7 +335,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6bae6e7f551b6024e3212655f4c5a8f9e426ae0858ff3e65f08d0539bb617028"
+          "content": "a787a333c01e1e0c323581ac605884546011f9d2dbcbc1a0e8cadadb62e70695"
         }
       ]
     },
@@ -345,7 +345,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9edabc481a2545ac56ddfdfba82623cd3ac1cf8a37551b5ff43930bf5f2ef48f"
+          "content": "8d182f4b1175c8b89cf48fe2cea671f060dc89850b9564669efd4e516b9e61bf"
         }
       ]
     },
@@ -379,7 +379,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "52e0e71990b14cf8dc5b07046c30d6d9807f7cec1cdef4463ac6bd155b0312d4"
+          "value": "dd1df9b570449d53d4ec48e40df48cc23d78aefd0d2724cbf4aaede96645ebb6"
         }
       ]
     },
@@ -409,7 +409,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f34208b28b53697118db5370f82c6aaab883bb7be10d99789a96a39a06acfac7"
+          "content": "695b4d6e3d50b78c8ff388a935a8f80634c7f92f64ab9f27d83eac4c7fe02bba"
         }
       ]
     },
@@ -459,7 +459,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f00496dde83db529d8dde54cf1a5a0048c4c08c49c085e035ad1c90d6a602b30"
+          "content": "d55cf907dda7b0357ffa66e374825f13ab99de69eecf49384f732f443160e76f"
         }
       ]
     }

package/src/cli.ts

@@ -669,7 +669,7 @@ Usage:
   dz upgrade [--target <name>] [--pubkey <path>] [--require-signing]   (a TAMPERED pack aborts the upgrade)
   dz sign   --pack <dir> --key <path-outside-repo>          (Ed25519 manifest + CycloneDX SBOM for a pack)
   dz verify-pack --pack <dir> [--pubkey <path>]             (signature check; fail-closed; key from the repo, never the pack)
-  dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
+  dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--mirror-cmd <cmd>|--no-mirror] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
   dz release [--filter <name>] [--tag] [--publish] [--json] [--dry-run] [--no-issue]   (VERIFIED release: 4 HARD gates in FRONT of dz publish — full package test suites, audit >=high, node --check of every dist/bin file, bin smoke-boot via "node <bin> --help" — any red gate STOPS the release (exit 1) + best-effort gh issue; all green ⇒ re-sign reminder, then prints the ready dz publish command (or chains with --publish); never duplicates publish's own gates)
   dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
   dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
@@ -841,6 +841,8 @@ export interface CliIo {
    * without spawning anything.
    */
   readonly releaseRunner?: ReleaseExecRunner;
+  /** Post-publish mirror command seam; production uses synchronous shell execution. */
+  readonly publishMirrorRunner?: PublishMirrorRunner;
   /**
    * Test seam for `dz install`: overrides the `npm install` subprocess (production leaves
    * it unset → real `execSync`, stdio piped). A stub runner that pre-stages a fixture
@@ -860,6 +862,21 @@ export type ReleaseExecRunner = (
   opts: { readonly cwd: string; readonly timeoutMs: number },
 ) => { exitCode: number; stdout: string; stderr: string; timedOut?: boolean };
 
+export type PublishMirrorRunner = (
+  command: string,
+  options: { readonly cwd: string; readonly env: NodeJS.ProcessEnv },
+) => string;
+
+type PublishMirrorState = {
+  readonly status: 'confirmed' | 'unconfirmed' | 'skipped' | 'not-configured';
+  readonly command: string;
+  readonly commit?: string;
+  readonly receipt?: { readonly manifestUrl: string; readonly confirmedAt: string; readonly waitedMs: number };
+  readonly error?: string;
+  readonly reason?: string;
+  readonly warning?: string;
+};
+
 interface ParsedArgs {
   readonly command: string;
   readonly options: Map<string, string>;
@@ -2988,6 +3005,8 @@ function cmdStatusline(
     } else if (data.storeHealth?.verdict === 'unreadable') {
       line += ` ⛔ STORE UNREADABLE${data.storeHealth.unreadableFiles !== undefined && data.storeHealth.unreadableFiles.length > 0
         ? `: ${data.storeHealth.unreadableFiles.join(', ')}` : ''}`;
+    } else if (data.storeHealth?.verdict === 'busy') {
+      line += ' ⏳ STORE BUSY';
     } else if (data.storeHealth?.verdict === 'source-changed') {
       line += ' ⚠ store source changed';
     }
@@ -3636,13 +3655,16 @@ function learningStoreLine(
   ) + (reason ? '  [' + reason + ']' : '');
 }
 
-function inspectLearningStore(projectRoot: string): {
+function inspectLearningStore(
+  projectRoot: string,
+  countOptions?: { readonly busyTimeoutMs?: number; readonly attempts?: number },
+): {
   mark: StoreMark | undefined;
   health: StoreHealth;
   rows: ReturnType<typeof countLearningStoreRowsReadonly>;
 } {
   const mark = readStoreMark(projectRoot);
-  const rows = countLearningStoreRowsReadonly(projectRoot);
+  const rows = countLearningStoreRowsReadonly(projectRoot, countOptions);
   return { mark, rows, health: checkStoreHealth({ projectRoot, ...rows, mark }) };
 }
 
@@ -3739,7 +3761,8 @@ function refreshLearningStoreMark(
     const rows = countLearningStoreRowsReadonly(projectRoot);
     const counts = observedRows(rows);
     if (counts === undefined) {
-      writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark was not updated — a store tier is unreadable`);
+      const busy = rows.lexicalRows === 'busy' || rows.vectorRows === 'busy';
+      writeErr(`⚠ dz store guard: ${options.reader ? 'reader observation' : 'store operation'} completed but the external mark was not updated — ${busy ? 'store busy; health not measured this run' : 'a store tier is unreadable'}`);
       return;
     }
     writeStoreMark(projectRoot, {
@@ -3773,7 +3796,7 @@ function allowLearningStoreWrite(
 ): boolean {
   let inspection: ReturnType<typeof inspectLearningStore>;
   try {
-    inspection = inspectLearningStore(projectRoot);
+    inspection = inspectLearningStore(projectRoot, { busyTimeoutMs: 250, attempts: 3 });
   } catch (error) {
     const health: StoreHealth = {
       verdict: 'unreadable',
@@ -3789,6 +3812,10 @@ function allowLearningStoreWrite(
     // own row had landed.
     return true;
   }
+  if (inspection.health.verdict === 'busy') {
+    writeErr(`dz store guard: NOT MEASURED — ${inspection.health.reason}`);
+    return true;
+  }
   if (inspection.health.verdict === 'source-changed') {
     const counts = observedRows(inspection.rows);
     if (counts === undefined) return false;
@@ -3828,6 +3855,7 @@ function warnLearningStoreRead(projectRoot: string, writeErr: WriteErr, command:
       for (const line of lexicalSourceLines(rows)) writeErr(line);
       return;
     }
+    if (health.verdict === 'busy') return;
     const counts = observedRows(rows);
     if (counts !== undefined && counts.lexicalRows + counts.vectorRows > 0
       && (mark === undefined || mark.lexicalLast !== counts.lexicalRows || mark.vectorLast !== counts.vectorRows
@@ -6857,7 +6885,37 @@ function cmdSbom(options: Map<string, string>, flags: Set<string>, cwd: string,
   return 0;
 }
 
-function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: string, writeOutput: Write): number {
+function mirrorCommandFromConfig(cwd: string): { command?: string; warning?: string } {
+  const configPath = join(cwd, '.dz', 'config.json');
+  if (!existsSync(configPath)) return {};
+  try {
+    const config = JSON.parse(readFileSync(configPath, 'utf8')) as { publish?: { mirrorCommand?: unknown } };
+    const command = typeof config.publish?.mirrorCommand === 'string' ? config.publish.mirrorCommand.trim() : '';
+    return command === '' ? {} : { command };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { warning: `.dz/config.json unreadable — ${reason}` };
+  }
+}
+
+function mirrorShellToken(value: string): string {
+  if (value === '') return "''";
+  if (!/^[A-Za-z0-9@/.,+_-]+$/.test(value)) throw new Error('published package/version list is not shell-safe');
+  return value;
+}
+
+function mirrorFailureMessage(error: unknown): string {
+  if (error instanceof Error && error.message.trim() !== '') return error.message.trim().split(/\r?\n/, 1)[0] ?? 'mirror command failed';
+  return String(error);
+}
+
+function cmdPublish(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  writeOutput: Write,
+  mirrorRunner?: PublishMirrorRunner,
+): number {
   const json = flags.has('json');
   // Under --json stdout carries exactly one JSON document, so every human line — guard notes, refusals,
   // progress — goes to stderr instead of being dropped: a refusal that prints nothing is the silent
@@ -6865,9 +6923,9 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
   const write: Write = json ? (line) => { process.stderr.write(`${line}\n`); } : writeOutput;
   // Reject unknown flags/options so a typo (e.g. `--dry-rum`) can NEVER be
   // silently swallowed and flip the command into live-publish mode.
-  const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json']);
-  const allowedOptions = new Set(['filter', 'claim-check', 'no-guard', 'sign-key']);
-  const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --no-guard "<reason>" (skip the guard pre-flight; logged)';
+  const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json', 'no-mirror']);
+  const allowedOptions = new Set(['filter', 'claim-check', 'no-guard', 'sign-key', 'mirror-cmd']);
+  const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --mirror-cmd <cmd>, --no-mirror, --no-guard "<reason>" (skip the guard pre-flight; logged)';
   for (const flag of flags) {
     if (!allowedFlags.has(flag)) {
       write(`dz publish: unknown option --${flag}`);
@@ -7047,7 +7105,7 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
   // longer exist. Default to the same path `dz sign --init` writes, so the ordinary operator needs no
   // new flag; `--sign-key` overrides it.
   const signKey = (options.get('sign-key') ?? join(homedir(), '.dz', 'keys', 'dz.key')).trim();
-  const report = publishPackages(cwd, {
+  const publishReport = publishPackages(cwd, {
     provenance,
     dryRun,
     filter,
@@ -7127,9 +7185,82 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
     },
   });
 
+  const configMirror = mirrorCommandFromConfig(cwd);
+  const configuredCommand = (options.get('mirror-cmd') ?? configMirror.command ?? '').trim();
+  const publishedVersions = publishReport.packages
+    .filter((pkg) => pkg.status === 'published')
+    .map((pkg) => `${pkg.name}@${pkg.newVersion}`);
+  const expected = publishedVersions.join(',');
+  const fullMirrorCommand = configuredCommand === ''
+    ? ''
+    : `${configuredCommand} --expect ${mirrorShellToken(expected)} --json`;
+  let mirror: PublishMirrorState;
+
+  // This exact conjunction is the Step-7/8 mutation anchor: an epilogue is eligible only after a
+  // live sweep that actually landed at least one package. Other explicit skip states are handled
+  // before command resolution so each reason remains distinguishable in text and JSON.
+  const mirrorEligible = !dryRun && publishReport.published >= 1;
+  if (bumpOnly) {
+    mirror = { status: 'skipped', command: fullMirrorCommand, reason: 'bump-only' };
+  } else if (!mirrorEligible) {
+    mirror = {
+      status: 'skipped',
+      command: fullMirrorCommand,
+      reason: dryRun ? 'dry-run' : 'published=0',
+    };
+  } else if (flags.has('no-mirror')) {
+    mirror = { status: 'skipped', command: fullMirrorCommand, reason: '--no-mirror' };
+  } else if (configMirror.warning !== undefined && options.get('mirror-cmd') === undefined) {
+    mirror = { status: 'not-configured', command: '', warning: configMirror.warning };
+  } else if (configuredCommand === '') {
+    mirror = { status: 'not-configured', command: '' };
+  } else {
+    const runMirror: PublishMirrorRunner = mirrorRunner
+      ?? ((command, runnerOptions) => execSync(command, {
+        cwd: runnerOptions.cwd,
+        env: runnerOptions.env,
+        encoding: 'utf8',
+        stdio: 'pipe',
+      }));
+    try {
+      const stdout = runMirror(fullMirrorCommand, {
+        cwd,
+        env: { ...process.env, DZ_PUBLISHED: expected },
+      });
+      const parsed = JSON.parse(stdout) as {
+        ok?: unknown;
+        commit?: unknown;
+        receipt?: { manifestUrl?: unknown; confirmedAt?: unknown; waitedMs?: unknown };
+        error?: unknown;
+      };
+      if (parsed.ok !== true) throw new Error(typeof parsed.error === 'string' ? parsed.error : 'mirror command returned ok:false');
+      if (typeof parsed.commit !== 'string' || parsed.commit === '') throw new Error('mirror command returned no commit');
+      if (typeof parsed.receipt?.manifestUrl !== 'string'
+        || typeof parsed.receipt.confirmedAt !== 'string'
+        || typeof parsed.receipt.waitedMs !== 'number') {
+        throw new Error('mirror command returned no live-manifest receipt');
+      }
+      mirror = {
+        status: 'confirmed',
+        command: fullMirrorCommand,
+        commit: parsed.commit,
+        receipt: {
+          manifestUrl: parsed.receipt.manifestUrl,
+          confirmedAt: parsed.receipt.confirmedAt,
+          waitedMs: parsed.receipt.waitedMs,
+        },
+      };
+    } catch (error) {
+      mirror = { status: 'unconfirmed', command: fullMirrorCommand, error: mirrorFailureMessage(error) };
+    }
+  }
+
+  const report = { ...publishReport, mirror };
+  const exitCode = report.errors > 0 ? 1 : mirror.status === 'unconfirmed' ? 3 : 0;
+
   if (json) {
     writeOutput(JSON.stringify(report));
-    return report.errors > 0 ? 1 : 0;
+    return exitCode;
   }
 
   write(`\ndz publish${dryRun ? ' --dry-run' : ''}${bumpOnly ? ' --bump-only' : ''}${claimCheckOpt !== 'warn' ? ` --claim-check ${claimCheckOpt}` : ''}`);
@@ -7181,7 +7312,19 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
   }
   for (const warning of report.warnings ?? []) write(`  ⚠ warning: ${warning}`);
   for (const path of report.releaseLineSynced ?? []) write(`  ↳ release line synced: ${path}`);
-  return report.errors > 0 ? 1 : 0;
+  if (mirror.status === 'confirmed') {
+    write(`  ✓ mirror: confirmed — ${mirror.commit} (${mirror.receipt?.manifestUrl})`);
+  } else if (mirror.status === 'not-configured') {
+    if (mirror.warning !== undefined) write(`  ⚠ mirror: ${mirror.warning}`);
+    else write('  ℹ mirror: not configured');
+  } else if (mirror.status === 'skipped') {
+    write(`  ℹ mirror: skipped (${mirror.reason})`);
+  } else {
+    write(`  ✗ mirror: unconfirmed — ${mirror.error}`);
+    const rerun = mirror.command || 'configure publish.mirrorCommand, then run it';
+    write(`dz publish: published, mirror NOT confirmed — ${mirror.error}; re-run: ${rerun}`);
+  }
+  return exitCode;
 }
 
 /* ------------------------------------------------------------------ */
@@ -18107,7 +18250,10 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   // `dz recap` — a refusal built on either list would reject working commands, which is a worse
   // failure than the one being fixed. Goes to STDERR so a `--json` consumer's stdout stays clean.
   if (command !== 'contract-check') {
-    for (const notice of unknownFlagNotice([...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')), KNOWN_CLI_FLAGS)) {
+    for (const notice of unknownFlagNotice(
+      [...flags, ...options.keys()].filter((k) => !k.startsWith('_positional_')),
+      KNOWN_CLI_FLAGS,
+    )) {
       writeErr(notice.line);
     }
   }
@@ -18264,7 +18410,7 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'auto-canonicalize':
         return await cmdAutoCanonicalize(options, cwd, write);
       case 'publish':
-        return cmdPublish(options, flags, cwd, write);
+        return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner);
       case 'release':
         return cmdRelease(options, flags, cwd, write, io.releaseRunner);
       case 'parity':

package/src/known-flags.ts

@@ -324,4 +324,5 @@ export const KNOWN_CLI_FLAGS: readonly string[] = [
   'write',
   'year',
   'yes',
+  'mirror-cmd', // dz publish epilogue (mirror-push-on-publish)
 ];