@pellux/goodvibes-toolchain 1.11.0 → 1.11.2

package/dist/bin/publish-package.js

@@ -1,9 +1,16 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadToolchainConfig } from '../lib/load-config.js';
 import { consoleLogger } from '../lib/effects.js';
 import { runPublishPackage, pollPropagation } from '../lib/publish-package.js';
+/** Read the value that follows a `--flag <value>` argument, or undefined when absent. */
+function flagValue(flag) {
+    const index = process.argv.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    return process.argv[index + 1];
+}
 const root = process.cwd();
 const config = loadToolchainConfig(root);
 if (!config.publish) {
@@ -13,7 +20,28 @@ if (!config.publish) {
 const version = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')).version;
 const dryRun = process.argv.includes('--dry-run');
 const registry = process.env.GOODVIBES_PUBLISH_REGISTRY ?? config.publish.defaultRegistry;
-const result = runPublishPackage({ cwd: root, name: config.publish.packageName, version, registry, dryRun, logger: consoleLogger });
+// --tarball <path>: publish a prebuilt .tgz instead of packing cwd. Validate the
+// flag value up front — a missing/empty path is a caller error (exit 2), kept
+// distinct from a publish failure (exit 1) so a broken pack→publish handoff is
+// unambiguous in CI logs.
+const tarballPath = flagValue('--tarball');
+if (process.argv.includes('--tarball') && (tarballPath === undefined || tarballPath.length === 0)) {
+    consoleLogger.error('publish-package: --tarball requires a file path');
+    process.exit(2);
+}
+if (tarballPath !== undefined && !existsSync(resolve(root, tarballPath))) {
+    consoleLogger.error(`publish-package: --tarball path does not exist: ${tarballPath}`);
+    process.exit(2);
+}
+const result = runPublishPackage({
+    cwd: root,
+    name: config.publish.packageName,
+    version,
+    registry,
+    dryRun,
+    ...(tarballPath !== undefined ? { tarballPath } : {}),
+    logger: consoleLogger,
+});
 consoleLogger.info(`publish-package: ${result.detail}`);
 if (!result.ok)
     process.exit(1);

package/dist/bin/toolchain.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=toolchain.d.ts.map

package/dist/bin/toolchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain.d.ts","sourceRoot":"","sources":["../../src/bin/toolchain.ts"],"names":[],"mappings":""}

package/dist/bin/toolchain.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * Dispatcher bin, named after the package itself (`goodvibes-toolchain`).
+ *
+ * `bunx @pellux/goodvibes-toolchain <tool> [flags]` resolves the bin whose
+ * name matches the package's final path segment. Without this dispatcher the
+ * package exposed only the eleven `goodvibes-*` tool bins, and bunx silently
+ * fell back to the FIRST bin in the map (sdk-pin-gate) with the intended tool
+ * name as a stray argument — crashing in workspaces without a toolchain
+ * config, and worse, "passing" while running the wrong tool in workspaces
+ * with one. Every tool stays directly invocable by its own bin name; this
+ * entry only adds the package-name route.
+ *
+ * The tool argument accepts both the bare tool name (`per-job-green`) and the
+ * bin-prefixed form (`goodvibes-per-job-green`) so existing invocation
+ * strings work unchanged.
+ */
+const TOOLS = {
+    'sdk-pin-gate': './sdk-pin-gate.js',
+    'build-binaries': './build-binaries.js',
+    'release-cut': './release-cut.js',
+    'coverage-gate': './coverage-gate.js',
+    'verification-ledger': './verification-ledger.js',
+    'post-build-smoke': './post-build-smoke.js',
+    'package-install-check': './package-install-check.js',
+    'publish-package': './publish-package.js',
+    'per-job-green': './per-job-green.js',
+    'changelog-gate': './changelog-gate.js',
+    'sha256sums': './sha256sums.js',
+};
+const [tool, ...rest] = process.argv.slice(2);
+const key = tool?.replace(/^goodvibes-/, '') ?? '';
+const target = TOOLS[key];
+if (!target) {
+    const usage = [
+        `goodvibes-toolchain: ${tool ? `unknown tool '${tool}'` : 'a tool name is required'}.`,
+        'Usage: goodvibes-toolchain <tool> [flags]',
+        `Tools: ${Object.keys(TOOLS).join(', ')}`,
+    ].join('\n');
+    console.error(usage);
+    process.exit(2);
+}
+// Tool bins read flags positionally from process.argv; splice the dispatcher
+// hop out so their view is identical to a direct bin invocation.
+process.argv = [process.argv[0], process.argv[1], ...rest];
+await import(target);
+export {};

package/dist/lib/publish-package.d.ts

@@ -15,7 +15,17 @@ export interface PublishOptions {
     readonly version: string;
     readonly registry?: string;
     readonly dryRun?: boolean;
+    /**
+     * When set, publish this prebuilt tarball (`npm publish <tarballPath>`)
+     * instead of packing and publishing `cwd`. Used by repos whose npm bytes are
+     * produced by a separate pack job (e.g. the agent bundles a runtime before
+     * `bun pm pack`), so the publish must ship the staged .tgz rather than a bare
+     * checkout. The path must exist and be a readable `.tgz`.
+     */
+    readonly tarballPath?: string;
     readonly exec?: Exec;
+    /** File-existence seam (defaults to node `existsSync`) so tarball validation is testable. */
+    readonly fileExists?: (path: string) => boolean;
     readonly logger?: Logger;
 }
 export interface PublishResult {

package/dist/lib/publish-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-package.d.ts","sourceRoot":"","sources":["../../src/lib/publish-package.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIxD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9G;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAsBxE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7F"}
+{"version":3,"file":"publish-package.d.ts","sourceRoot":"","sources":["../../src/lib/publish-package.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIxD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9G;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAgDxE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7F"}

package/dist/lib/publish-package.js

@@ -6,6 +6,7 @@
  * (re-runs are safe). Propagation poll: after publish, wait until the registry
  * actually serves the new version before downstream jobs depend on it.
  */
+import { existsSync } from 'node:fs';
 import { realExec, consoleLogger, realSleep } from './effects.js';
 import { DEFAULT_REGISTRY } from '../config.js';
 /** Query the published version of name@version; null when absent (or on error). */
@@ -21,6 +22,31 @@ export function runPublishPackage(options) {
     const exec = options.exec ?? realExec;
     const logger = options.logger ?? consoleLogger;
     const registry = options.registry ?? DEFAULT_REGISTRY;
+    const fileExists = options.fileExists ?? existsSync;
+    const tarball = options.tarballPath;
+    if (tarball !== undefined) {
+        // Tarball mode: publish a prebuilt .tgz. Validate the flag value — the file
+        // must exist and be a `.tgz` — before doing anything with it. `npm pack
+        // --dry-run` is meaningless here (there is nothing to pack), so a dry run
+        // just confirms the staged tarball is present and readable.
+        if (!tarball.endsWith('.tgz') || !fileExists(tarball)) {
+            return { ok: false, skipped: false, detail: `tarball not found or not a .tgz: ${tarball}` };
+        }
+        if (options.dryRun) {
+            return { ok: true, skipped: false, detail: `dry-run: tarball present (${tarball})` };
+        }
+        const alreadyTarball = getPublishedVersion(exec, options.name, options.version, registry);
+        if (alreadyTarball === options.version) {
+            logger.info(`[publish-package] ${options.name}@${options.version} already published — skipping`);
+            return { ok: true, skipped: true, detail: 'already published' };
+        }
+        const res = exec('npm', ['publish', tarball, '--access', 'public', '--registry', registry], { cwd: options.cwd });
+        if (res.status !== 0) {
+            return { ok: false, skipped: false, detail: `npm publish failed: ${res.stderr.trim().slice(0, 400)}` };
+        }
+        logger.info(`[publish-package] published ${options.name}@${options.version} from ${tarball}`);
+        return { ok: true, skipped: false, detail: 'published' };
+    }
     if (options.dryRun) {
         const res = exec('npm', ['pack', '--json'], { cwd: options.cwd });
         return { ok: res.status === 0, skipped: false, detail: res.status === 0 ? 'dry-run pack ok' : `dry-run pack failed: ${res.stderr.trim()}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-toolchain",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "engines": {
     "bun": "1.3.10",
     "node": ">=22.0.0"
@@ -21,6 +21,7 @@
     "./package.json": "./package.json"
   },
   "bin": {
+    "goodvibes-toolchain": "./dist/bin/toolchain.js",
     "goodvibes-sdk-pin-gate": "./dist/bin/sdk-pin-gate.js",
     "goodvibes-build-binaries": "./dist/bin/build-binaries.js",
     "goodvibes-release-cut": "./dist/bin/release-cut.js",