@pellux/goodvibes-toolchain 1.11.1 → 1.11.3

package/dist/bin/publish-package.js

@@ -1,9 +1,16 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadToolchainConfig } from '../lib/load-config.js';
 import { consoleLogger } from '../lib/effects.js';
 import { runPublishPackage, pollPropagation } from '../lib/publish-package.js';
+/** Read the value that follows a `--flag <value>` argument, or undefined when absent. */
+function flagValue(flag) {
+    const index = process.argv.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    return process.argv[index + 1];
+}
 const root = process.cwd();
 const config = loadToolchainConfig(root);
 if (!config.publish) {
@@ -13,7 +20,28 @@ if (!config.publish) {
 const version = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')).version;
 const dryRun = process.argv.includes('--dry-run');
 const registry = process.env.GOODVIBES_PUBLISH_REGISTRY ?? config.publish.defaultRegistry;
-const result = runPublishPackage({ cwd: root, name: config.publish.packageName, version, registry, dryRun, logger: consoleLogger });
+// --tarball <path>: publish a prebuilt .tgz instead of packing cwd. Validate the
+// flag value up front — a missing/empty path is a caller error (exit 2), kept
+// distinct from a publish failure (exit 1) so a broken pack→publish handoff is
+// unambiguous in CI logs.
+const tarballPath = flagValue('--tarball');
+if (process.argv.includes('--tarball') && (tarballPath === undefined || tarballPath.length === 0)) {
+    consoleLogger.error('publish-package: --tarball requires a file path');
+    process.exit(2);
+}
+if (tarballPath !== undefined && !existsSync(resolve(root, tarballPath))) {
+    consoleLogger.error(`publish-package: --tarball path does not exist: ${tarballPath}`);
+    process.exit(2);
+}
+const result = runPublishPackage({
+    cwd: root,
+    name: config.publish.packageName,
+    version,
+    registry,
+    dryRun,
+    ...(tarballPath !== undefined ? { tarballPath } : {}),
+    logger: consoleLogger,
+});
 consoleLogger.info(`publish-package: ${result.detail}`);
 if (!result.ok)
     process.exit(1);

package/dist/lib/publish-package.d.ts

@@ -15,7 +15,17 @@ export interface PublishOptions {
     readonly version: string;
     readonly registry?: string;
     readonly dryRun?: boolean;
+    /**
+     * When set, publish this prebuilt tarball (`npm publish <tarballPath>`)
+     * instead of packing and publishing `cwd`. Used by repos whose npm bytes are
+     * produced by a separate pack job (e.g. the agent bundles a runtime before
+     * `bun pm pack`), so the publish must ship the staged .tgz rather than a bare
+     * checkout. The path must exist and be a readable `.tgz`.
+     */
+    readonly tarballPath?: string;
     readonly exec?: Exec;
+    /** File-existence seam (defaults to node `existsSync`) so tarball validation is testable. */
+    readonly fileExists?: (path: string) => boolean;
     readonly logger?: Logger;
 }
 export interface PublishResult {

package/dist/lib/publish-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-package.d.ts","sourceRoot":"","sources":["../../src/lib/publish-package.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIxD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9G;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAsBxE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7F"}
+{"version":3,"file":"publish-package.d.ts","sourceRoot":"","sources":["../../src/lib/publish-package.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIxD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9G;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAmDxE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7F"}

package/dist/lib/publish-package.js

@@ -6,6 +6,8 @@
  * (re-runs are safe). Propagation poll: after publish, wait until the registry
  * actually serves the new version before downstream jobs depend on it.
  */
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { realExec, consoleLogger, realSleep } from './effects.js';
 import { DEFAULT_REGISTRY } from '../config.js';
 /** Query the published version of name@version; null when absent (or on error). */
@@ -21,6 +23,34 @@ export function runPublishPackage(options) {
     const exec = options.exec ?? realExec;
     const logger = options.logger ?? consoleLogger;
     const registry = options.registry ?? DEFAULT_REGISTRY;
+    const fileExists = options.fileExists ?? existsSync;
+    // Resolved to absolute before it ever reaches npm: npm parses a bare
+    // relative path like `dir/pkg.tgz` as a GitHub owner/repo spec, so a
+    // caller-supplied relative path would publish the wrong thing entirely.
+    const tarball = options.tarballPath === undefined ? undefined : resolve(options.tarballPath);
+    if (tarball !== undefined) {
+        // Tarball mode: publish a prebuilt .tgz. Validate the flag value — the file
+        // must exist and be a `.tgz` — before doing anything with it. `npm pack
+        // --dry-run` is meaningless here (there is nothing to pack), so a dry run
+        // just confirms the staged tarball is present and readable.
+        if (!tarball.endsWith('.tgz') || !fileExists(tarball)) {
+            return { ok: false, skipped: false, detail: `tarball not found or not a .tgz: ${tarball}` };
+        }
+        if (options.dryRun) {
+            return { ok: true, skipped: false, detail: `dry-run: tarball present (${tarball})` };
+        }
+        const alreadyTarball = getPublishedVersion(exec, options.name, options.version, registry);
+        if (alreadyTarball === options.version) {
+            logger.info(`[publish-package] ${options.name}@${options.version} already published — skipping`);
+            return { ok: true, skipped: true, detail: 'already published' };
+        }
+        const res = exec('npm', ['publish', tarball, '--access', 'public', '--registry', registry], { cwd: options.cwd });
+        if (res.status !== 0) {
+            return { ok: false, skipped: false, detail: `npm publish failed: ${res.stderr.trim().slice(0, 400)}` };
+        }
+        logger.info(`[publish-package] published ${options.name}@${options.version} from ${tarball}`);
+        return { ok: true, skipped: false, detail: 'published' };
+    }
     if (options.dryRun) {
         const res = exec('npm', ['pack', '--json'], { cwd: options.cwd });
         return { ok: res.status === 0, skipped: false, detail: res.status === 0 ? 'dry-run pack ok' : `dry-run pack failed: ${res.stderr.trim()}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-toolchain",
-  "version": "1.11.1",
+  "version": "1.11.3",
   "engines": {
     "bun": "1.3.10",
     "node": ">=22.0.0"