@marcusrbrown/infra 0.13.11 → 0.13.12

package/dist/cli.js

@@ -6949,7 +6949,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.13.11",
+  version: "0.13.12",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -9356,6 +9356,36 @@ import { z as z13 } from "zod";
 var REPO2 = "marcusrbrown/infra";
 var WORKFLOW_NAME2 = "Deploy Dashboard";
 var WORKFLOW_URL2 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
+var CALVER_RE = /^\d{4}\.\d{2}\.\d+$/;
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+function validateReleaseFlags(options) {
+  const { imageVersion, digest, local } = options;
+  if (local && (imageVersion !== undefined || digest !== undefined)) {
+    throw new Error("--image-version and --digest are remote-only flags and cannot be used with --local. " + "Remove --local to dispatch the GitHub Actions workflow with release flags.");
+  }
+  if (imageVersion !== undefined && !CALVER_RE.test(imageVersion)) {
+    throw new Error(`Invalid version ${JSON.stringify(imageVersion)}: must match YYYY.MM.N (e.g. 2026.06.47). ` + "Rejected: 'latest', semver, and injection strings are not accepted.");
+  }
+  if (digest !== undefined && imageVersion === undefined) {
+    throw new Error("--digest requires --image-version. Either omit all release flags (no-version fallback) or provide --image-version (+ optional --digest).");
+  }
+  if (digest !== undefined && !DIGEST_RE.test(digest)) {
+    throw new Error(`Invalid digest ${JSON.stringify(digest)}: must match sha256:<64 hex chars> (e.g. sha256:abc...def). ` + "Rejected: malformed digests are not accepted.");
+  }
+}
+function buildRemoteArgv(options) {
+  const argv = ["gh", "workflow", "run", WORKFLOW_NAME2, "--repo", REPO2];
+  if (options.imageVersion !== undefined) {
+    argv.push("-f", `version=${options.imageVersion}`);
+  }
+  if (options.digest !== undefined) {
+    argv.push("-f", `digest=${options.digest}`);
+  }
+  return argv;
+}
+function formatArgv(argv) {
+  return argv.map((arg) => /^[\w./:=@-]+$/.test(arg) ? arg : JSON.stringify(arg)).join(" ");
+}
 function getDashboardDeployEnv() {
   const path = process.env.PATH;
   const home = process.env.HOME;
@@ -9384,7 +9414,8 @@ function validateDashboardRemotePreconditions() {
   }
 }
 function registerDashboardDeploy(cli) {
-  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z13.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z13.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z13.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z13.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z13.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z13.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+    validateReleaseFlags({ imageVersion: options.imageVersion, digest: options.digest, local: options.local });
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/dashboard", "deploy"];
       if (options.dryRun) {
@@ -9405,13 +9436,14 @@ function registerDashboardDeploy(cli) {
       return;
     }
     validateDashboardRemotePreconditions();
+    const remoteArgv = buildRemoteArgv({ imageVersion: options.imageVersion, digest: options.digest });
     if (options.dryRun) {
       console.log("Dry run: remote dashboard deploy");
-      console.log(`- command: gh workflow run "${WORKFLOW_NAME2}" --repo ${REPO2}`);
+      console.log(`- command: ${formatArgv(remoteArgv)}`);
       console.log(`- workflow URL: ${WORKFLOW_URL2}`);
       return;
     }
-    const child = Bun.spawn(["gh", "workflow", "run", WORKFLOW_NAME2, "--repo", REPO2], {
+    const child = Bun.spawn(remoteArgv, {
       stdout: "inherit",
       stderr: "inherit"
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.13.11",
+  "version": "0.13.12",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",