@percher/core 0.4.12 → 0.4.14

package/dist/commands/publish-inline.js

@@ -0,0 +1,267 @@
+import { isDeployAlreadyInProgress, PercherApiError } from "@percher/client";
+import { MAX_INLINE_PUBLISH_BYTES } from "@percher/shared";
+import { PercherTomlError, parse } from "@percher/toml";
+import { z } from "zod";
+import { recoveryAsk, recoveryFixConfig, recoveryWait, } from "../recovery.js";
+import { createTarballFromFiles } from "../tarball.js";
+import { tomlErrorToRecoveryProblems } from "../toml-recovery.js";
+import { finalizeDeploy } from "./publish.js";
+import { classifyPublishApiError, DEPLOY_GATE_CODES } from "./publish-api-error.js";
+export const publishInlineInputSchema = z.object({
+    name: z
+        .string()
+        .optional()
+        .describe("Override the app name from percher.toml. Optional when percher.toml sets [app].name."),
+    files: z
+        .array(z.object({
+        path: z.string().min(1).describe("Repo-relative path (no leading / and no ..)."),
+        content: z.string().describe("UTF-8 file contents."),
+    }))
+        .min(1)
+        .describe("Inline source files. MUST include a percher.toml."),
+    preview: z
+        .boolean()
+        .optional()
+        .describe("Deploy as a preview (does not replace the live version)."),
+    message: z.string().optional().describe("Deploy note (visible in deploy history)."),
+    noCache: z.boolean().optional().describe("Skip the image cache and force a fresh build."),
+    waitForLive: z
+        .boolean()
+        .optional()
+        .describe("If true (default), block until the deploy is live or failed. If false, return as soon as it is queued so the agent can resume with percher_wait_for_deploy."),
+});
+const TOML_FILENAME = "percher.toml";
+/** Total decoded `content` bytes across all inline files. */
+function totalContentBytes(files) {
+    let total = 0;
+    for (const f of files)
+        total += Buffer.byteLength(f.content, "utf8");
+    return total;
+}
+/**
+ * Hosted "publish from inline source" — the filesystem-free counterpart
+ * to {@link publish}. An assistant passes the source files it just
+ * generated (including a `percher.toml`) as a tool argument; this builds
+ * a tarball entirely in memory and ships it through the curated
+ * `POST /apps/publish` endpoint (the only publish surface an OAuth token
+ * may reach). It NEVER reads `ctx.cwd`.
+ *
+ * Returns the same {@link PublishResult} shape + recovery contract as
+ * `publish` so an agent's `wait_for_deploy` chain works identically.
+ */
+export async function publishInline(ctx, input) {
+    try {
+        return await publishInlineInner(ctx, input);
+    }
+    catch (err) {
+        // Business-rule 403s / gate codes (plan limits, rate limits,
+        // quota) classify into a structured failure with the right title +
+        // suggestion. Anything else becomes a generic structured failure so
+        // an agent always gets JSON, never a raw stack.
+        const classified = classifyPublishApiError(err, {
+            configPath: TOML_FILENAME,
+            bundle: { fileCount: 0, bytes: 0 },
+        });
+        if (classified)
+            return classified;
+        const message = err instanceof Error ? err.message : String(err);
+        const hint = err instanceof PercherApiError ? `API returned ${err.status}: ${err.message}` : undefined;
+        return failure({
+            title: "Unexpected error",
+            explanation: hint ?? message,
+            suggestion: "This may be a network issue or a Percher bug. If it persists, run percher_doctor for diagnostics.",
+            recovery: recoveryAsk({
+                prompt: `Unexpected inline-publish failure: ${hint ?? message}. Surface this to the user or run percher_doctor.`,
+                reasonCode: "unknown",
+            }),
+            summary: `Unexpected error: ${hint ?? message}`,
+        });
+    }
+}
+async function publishInlineInner(ctx, input) {
+    const t0 = Date.now();
+    // ── 0. Size guard (defense in depth; the tool + API also enforce) ──
+    const contentBytes = totalContentBytes(input.files);
+    if (contentBytes > MAX_INLINE_PUBLISH_BYTES) {
+        return failure({
+            title: "Inline source too large",
+            explanation: `The inline files total ${(contentBytes / 1024 / 1024).toFixed(1)} MB, which exceeds the ${MAX_INLINE_PUBLISH_BYTES / 1024 / 1024} MB inline-publish limit.`,
+            suggestion: "Inline publishing is for small apps generated in-session. For a larger app, connect a GitHub/Forgejo repo and deploy with percher_deploy.",
+            recovery: recoveryAsk({
+                prompt: `Inline source is ${(contentBytes / 1024 / 1024).toFixed(1)} MB (limit ${MAX_INLINE_PUBLISH_BYTES / 1024 / 1024} MB). Use the connected-repo deploy path (percher_deploy) for a large app.`,
+                reasonCode: "unknown",
+            }),
+        });
+    }
+    // ── 1. Config — read percher.toml out of the inline files ──────────
+    ctx.status("[1/3] Reading inline percher.toml...");
+    const tomlFile = input.files.find((f) => normalizeForMatch(f.path) === TOML_FILENAME);
+    if (!tomlFile) {
+        return failure({
+            title: "percher.toml missing from inline source",
+            explanation: "Inline publishing requires a percher.toml among the files — it declares the app's runtime/framework and is read from the uploaded bundle.",
+            suggestion: "Add a percher.toml file (with at least [app] name and runtime) to the files array. See the percher.toml docs.",
+            recovery: recoveryFixConfig({
+                problems: [
+                    {
+                        file: TOML_FILENAME,
+                        message: "Include a percher.toml in the files array (with at least [app] name and runtime) — see the percher.toml docs.",
+                    },
+                ],
+                reasonCode: "config_missing",
+            }),
+        });
+    }
+    let config;
+    try {
+        config = parse(tomlFile.content);
+    }
+    catch (err) {
+        if (err instanceof PercherTomlError) {
+            const problems = tomlErrorToRecoveryProblems(err);
+            const isParse = err.code === "PARSE_ERROR";
+            return failure({
+                title: isParse
+                    ? "percher.toml has invalid TOML syntax"
+                    : "percher.toml failed schema validation",
+                explanation: err.message,
+                suggestion: isParse
+                    ? "Fix the syntax error and retry."
+                    : "Fix the schema issues (check the percher.toml spec) and retry.",
+                recovery: recoveryFixConfig({ problems, reasonCode: "config_invalid" }),
+            });
+        }
+        throw err;
+    }
+    // `name` arg overrides the percher.toml app name when supplied.
+    if (input.name) {
+        config.app.name = input.name;
+    }
+    // ── 2. Tarball — built entirely in memory from the inline files ────
+    ctx.status("[2/3] Packaging inline files...");
+    let tarball;
+    try {
+        tarball = createTarballFromFiles(input.files.map((f) => ({ path: f.path, data: new TextEncoder().encode(f.content) })), config);
+    }
+    catch (err) {
+        // createTarballFromFiles rejects traversal / absolute / duplicate
+        // paths — an untrusted-input problem, not a Percher bug.
+        const message = err instanceof Error ? err.message : String(err);
+        return failure({
+            title: "Invalid file path in inline source",
+            explanation: message,
+            suggestion: "Use repo-relative forward-slash paths only — no leading /, no .., no drive letters, no duplicates.",
+            recovery: recoveryFixConfig({
+                problems: [{ file: "files", message }],
+                reasonCode: "config_invalid",
+            }),
+        });
+    }
+    const packageMs = Date.now() - t0;
+    // ── 3. Upload via the curated /apps/publish endpoint ───────────────
+    ctx.status("[3/3] Uploading & deploying...");
+    const uploadStart = Date.now();
+    const tarballBytes = new Uint8Array(await new Response(tarball.stream).arrayBuffer());
+    let deployment;
+    try {
+        deployment = await ctx.client.apps.publishInline({
+            name: config.app.name,
+            runtime: config.app.runtime,
+            framework: config.app.framework,
+            tarball: tarballBytes,
+            type: input.preview ? "preview" : undefined,
+            note: input.message,
+            noCache: input.noCache,
+            tarballHash: tarball.contentHash,
+        });
+    }
+    catch (err) {
+        if (err instanceof PercherApiError && DEPLOY_GATE_CODES.has(err.code)) {
+            const classified = classifyPublishApiError(err, {
+                configPath: TOML_FILENAME,
+                bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes },
+            });
+            if (classified)
+                return classified;
+        }
+        throw err;
+    }
+    // The curated endpoint returns a serialized Deployment; the
+    // already_in_progress short-circuit comes back through the same
+    // type-union guard the upload path uses.
+    if (isDeployAlreadyInProgress(deployment)) {
+        const active = deployment;
+        return {
+            status: "already_in_progress",
+            fileCount: tarball.fileCount,
+            bytes: tarball.bytes,
+            recovery: recoveryWait({
+                app: config.app.name,
+                deployId: active.deployId,
+                reasonCode: active.deployStatus === "queued"
+                    ? "deploy_queued"
+                    : active.deployStatus === "building"
+                        ? "deploy_building"
+                        : "deploy_deploying",
+            }),
+            summary: `${config.app.name} already has a deploy in progress (${active.deployId}) — wait for it instead of queueing a duplicate.`,
+            configPath: TOML_FILENAME,
+            bundle: { fileCount: tarball.fileCount, bytes: tarball.bytes },
+        };
+    }
+    const uploadMs = Date.now() - uploadStart;
+    // The app object isn't returned by the publish endpoint; synthesize a
+    // minimal one from what we know (name + runtime + the deploy's url) so
+    // finalizeDeploy can shape the result. The deployment row carries the
+    // live/preview URL once polled, which is what the summary actually uses.
+    const app = {
+        id: deployment.appId,
+        name: config.app.name,
+        runtime: config.app.runtime,
+        framework: config.app.framework ?? null,
+        url: deployment.url ?? `https://${config.app.name}.percher.run`,
+    };
+    return finalizeDeploy({
+        ctx,
+        config,
+        input: {
+            preview: input.preview,
+            message: input.message,
+            noCache: input.noCache,
+            waitForLive: input.waitForLive,
+        },
+        app,
+        firstDeploy: false,
+        tarball: { fileCount: tarball.fileCount, bytes: tarball.bytes },
+        deployment,
+        t0,
+        packageMs,
+        uploadMs,
+        missingBuildEnvKeys: [],
+    });
+}
+/** Forward-slash + lowercase a path so a `./percher.toml` or `PERCHER.TOML`
+ *  still matches. Only used to LOCATE the toml; the tarball keeps exact paths. */
+function normalizeForMatch(path) {
+    return path.replace(/\\/g, "/").replace(/^\.\//, "").toLowerCase();
+}
+/** Shared structured-failure shape for the inline path. `configPath` is the
+ *  inline toml filename (there's no cwd), and bundle stats are zeroed when the
+ *  failure preceded packaging. */
+function failure(opts) {
+    return {
+        status: "failed",
+        fileCount: 0,
+        bytes: 0,
+        error: {
+            title: opts.title,
+            explanation: opts.explanation,
+            suggestion: opts.suggestion,
+        },
+        recovery: opts.recovery,
+        summary: opts.summary ?? `${opts.title} — ${opts.explanation}`,
+        configPath: TOML_FILENAME,
+        bundle: { fileCount: 0, bytes: 0 },
+    };
+}
+//# sourceMappingURL=publish-inline.js.map

package/dist/commands/publish-inline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-inline.js","sourceRoot":"","sources":["../../src/commands/publish-inline.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAsB,gBAAgB,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,WAAW,EACX,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAsB,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sFAAsF,CACvF;IACH,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAChF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACrD,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,mDAAmD,CAAC;IAChE,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IACzF,WAAW,EAAE,CAAC;SACX,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,6JAA6J,CAC9J;CACJ,CAAC,CAAC;AAGH,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,6DAA6D;AAC7D,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAY,EACZ,KAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE;YAC9C,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GACR,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,OAAO,OAAO,CAAC;YACb,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,IAAI,IAAI,OAAO;YAC5B,UAAU,EACR,mGAAmG;YACrG,QAAQ,EAAE,WAAW,CAAC;gBACpB,MAAM,EAAE,sCAAsC,IAAI,IAAI,OAAO,mDAAmD;gBAChH,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,OAAO,EAAE,qBAAqB,IAAI,IAAI,OAAO,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,KAAyB;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtB,sEAAsE;IACtE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,YAAY,GAAG,wBAAwB,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,0BAA0B,CAAC,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,wBAAwB,GAAG,IAAI,GAAG,IAAI,2BAA2B;YACzK,UAAU,EACR,2IAA2I;YAC7I,QAAQ,EAAE,WAAW,CAAC;gBACpB,MAAM,EAAE,oBAAoB,CAAC,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,wBAAwB,GAAG,IAAI,GAAG,IAAI,4EAA4E;gBACnM,UAAU,EAAE,SAAS;aACtB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,GAAG,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,OAAO,CAAC;YACb,KAAK,EAAE,yCAAyC;YAChD,WAAW,EACT,2IAA2I;YAC7I,UAAU,EACR,+GAA+G;YACjH,QAAQ,EAAE,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,aAAa;wBACnB,OAAO,EACL,+GAA+G;qBAClH;iBACF;gBACD,UAAU,EAAE,gBAAgB;aAC7B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAsB,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;YAC3C,OAAO,OAAO,CAAC;gBACb,KAAK,EAAE,OAAO;oBACZ,CAAC,CAAC,sCAAsC;oBACxC,CAAC,CAAC,uCAAuC;gBAC3C,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO;oBACjB,CAAC,CAAC,iCAAiC;oBACnC,CAAC,CAAC,gEAAgE;gBACpE,QAAQ,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,sEAAsE;IACtE,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC9C,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EACrF,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;YACb,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EAAE,OAAO;YACpB,UAAU,EACR,oGAAoG;YACtG,QAAQ,EAAE,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACtC,UAAU,EAAE,gBAAgB;aAC7B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAElC,sEAAsE;IACtE,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAEtF,IAAI,UAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;YAC/C,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO;YAC3B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS;YAC/B,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC3C,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE;gBAC9C,UAAU,EAAE,aAAa;gBACzB,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;aAC/D,CAAC,CAAC;YACH,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,4DAA4D;IAC5D,gEAAgE;IAChE,yCAAyC;IACzC,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,qBAAqB;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,YAAY,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EACR,MAAM,CAAC,YAAY,KAAK,QAAQ;oBAC9B,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;wBAClC,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,kBAAkB;aAC3B,CAAC;YACF,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,sCAAsC,MAAM,CAAC,QAAQ,kDAAkD;YAClI,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IAE1C,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,yEAAyE;IACzE,MAAM,GAAG,GAAQ;QACf,EAAE,EAAE,UAAU,CAAC,KAAK;QACpB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;QACrB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO;QAC3B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;QACvC,GAAG,EAAE,UAAU,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,GAAG,CAAC,IAAI,cAAc;KACzD,CAAC;IAET,OAAO,cAAc,CAAC;QACpB,GAAG;QACH,MAAM;QACN,KAAK,EAAE;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B;QACD,GAAG;QACH,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;QAC/D,UAAU;QACV,EAAE;QACF,SAAS;QACT,QAAQ;QACR,mBAAmB,EAAE,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED;kFACkF;AAClF,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACrE,CAAC;AAED;;kCAEkC;AAClC,SAAS,OAAO,CAAC,IAMhB;IACC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,CAAC;QACZ,KAAK,EAAE,CAAC;QACR,KAAK,EAAE;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE;QAC9D,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC"}

package/dist/commands/publish.d.ts

@@ -1,8 +1,10 @@
 import { type App, type BuildProblem, type Deployment } from "@percher/client";
+import { type PercherConfig } from "@percher/toml";
 import { z } from "zod";
 import type { Context } from "../context.js";
 import type { DeployPhase, ErrorClass } from "../error-classifier.js";
 import { type PublishRecovery, type PublishStatus } from "../recovery.js";
+import { type TarballResult } from "../tarball.js";
 export declare const publishInputSchema: z.ZodObject<{
     force: z.ZodOptional<z.ZodBoolean>;
     preview: z.ZodOptional<z.ZodBoolean>;
@@ -217,5 +219,67 @@ export interface PublishResult {
  * structured result that an agent can act on (retry, set env vars, ask the
  * user for info, etc.).
  */
-export declare function publish(ctx: Context, input?: PublishInput): Promise<PublishResult>;
+export declare function publish(ctx: Context, input?: PublishInput, preParsedConfig?: PercherConfig): Promise<PublishResult>;
+/**
+ * Post-upload deploy pipeline shared by the primary publish path and
+ * the post-login retry: buffer + upload the tarball (cache probe,
+ * idempotent retry loop), poll to a terminal status via pollDeployment
+ * (which retries transient network failures), and shape the
+ * PublishResult. Both entry paths must route through here so the
+ * re-auth path can't drift from the primary one.
+ */
+export declare function executeDeploy(opts: {
+    ctx: Context;
+    config: PercherConfig;
+    input: PublishInput;
+    app: App;
+    /** True when the app was created during this publish run. */
+    firstDeploy: boolean;
+    tarball: TarballResult;
+    /** Publish start timestamp (ms) — anchors totalSeconds in timing/summary. */
+    t0: number;
+    /** Time spent packaging the tarball (ms). */
+    packageMs: number;
+    /** Pre-upload build-env scan findings; empty when the scan didn't run. */
+    missingBuildEnvKeys: string[];
+}): Promise<PublishResult>;
+/**
+ * Post-deploy tail shared by the upload-publish path (`executeDeploy`)
+ * and the hosted inline-publish path (`publishInline`). Both produce a
+ * queued `Deployment` (from the upload route or the curated
+ * `/apps/publish` route) and need the identical "queued → poll → shape
+ * a PublishResult + recovery contract" behavior so an agent's
+ * `wait_for_deploy` chain works the same way regardless of entry point.
+ *
+ * Takes a bundle-stats summary rather than the live tarball stream
+ * because the stream has already been consumed by the time the deploy
+ * row exists.
+ */
+export declare function finalizeDeploy(opts: {
+    ctx: Context;
+    config: PercherConfig;
+    input: PublishInput;
+    app: App;
+    firstDeploy: boolean;
+    tarball: {
+        fileCount: number;
+        bytes: number;
+    };
+    /** The just-created queued deployment row. */
+    deployment: Deployment;
+    /** Publish start timestamp (ms) — anchors totalSeconds in timing/summary. */
+    t0: number;
+    /** Time spent packaging the tarball (ms). */
+    packageMs: number;
+    /** Time spent uploading the tarball (ms). */
+    uploadMs: number;
+    /** Pre-upload build-env scan findings; empty when the scan didn't run. */
+    missingBuildEnvKeys: string[];
+    /** True when the deploy short-circuited on a content-hash cache reuse. */
+    cacheReused?: boolean;
+}): Promise<PublishResult>;
+export declare function ensureApp(ctx: Context, config: PercherConfig): Promise<{
+    app: App;
+    firstDeploy: boolean;
+}>;
 //# sourceMappingURL=publish.d.ts.map

package/dist/commands/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,GAAG,EACR,KAAK,YAAY,EAEjB,KAAK,UAAU,EAMhB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAInE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EASnB,MAAM,aAAa,CAAC;AAUrB,eAAO,MAAM,kBAAkB;;;;;;;;iBA+B7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AA2GD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAE,YAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6C5F"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,GAAG,EACR,KAAK,YAAY,EAEjB,KAAK,UAAU,EAMhB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,KAAK,aAAa,EAAyC,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAInE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EASnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAU/D,eAAO,MAAM,kBAAkB;;;;;;;;iBA+B7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;IACrD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AA2GD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,OAAO,EACZ,KAAK,GAAE,YAAiB,EACxB,eAAe,CAAC,EAAE,aAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CA6CxB;AAuTD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,GAAG,OAAO,CAAC,aAAa,CAAC,CAoIzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,8CAA8C;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,aAAa,CAAC,CAuOzB;AA+PD,wBAAsB,SAAS,CAC7B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAe7C"}

package/dist/commands/publish.js

@@ -4,13 +4,14 @@ import { isDeployAlreadyInProgress, PercherApiError, PercherClient, saveConfig,
 import { MAX_TARBALL_BYTES } from "@percher/shared";
 import { solvePow } from "@percher/shared/pow";
 import { TIMEOUTS } from "@percher/shared/timeouts";
-import { PercherTomlError, parseFile } from "@percher/toml";
+import { PercherTomlError, parseFile, validate } from "@percher/toml";
 import { z } from "zod";
 import { renderDeployEvent } from "../event-renderer.js";
 import { pollDeployment } from "../poll-deployment.js";
 import { runDeployWithRetry } from "../publish-retry.js";
 import { RECOVERY_NEEDS_LOGIN, RECOVERY_NONE, recoveryAsk, recoveryDoctor, recoveryFixConfig, recoveryWait, } from "../recovery.js";
 import { createTarball } from "../tarball.js";
+import { tomlErrorToRecoveryProblems } from "../toml-recovery.js";
 import { scanForMissingBuildEnvRefs } from "./env-scan.js";
 import { init } from "./init.js";
 import { login } from "./login.js";
@@ -129,9 +130,9 @@ function buildLiveSummary(opts) {
  * structured result that an agent can act on (retry, set env vars, ask the
  * user for info, etc.).
  */
-export async function publish(ctx, input = {}) {
+export async function publish(ctx, input = {}, preParsedConfig) {
     try {
-        return await publishInner(ctx, input);
+        return await publishInner(ctx, input, preParsedConfig);
     }
     catch (err) {
         // Dogfood 2026-05-13 Fynd #2 — business-rule 403s (plan limits,
@@ -174,7 +175,7 @@ export async function publish(ctx, input = {}) {
         };
     }
 }
-async function publishInner(ctx, input) {
+async function publishInner(ctx, input, preParsedConfig) {
     const t0 = Date.now();
     // ── 0. Identity banner ─────────────────────────────────────────────
     //
@@ -213,7 +214,7 @@ async function publishInner(ctx, input) {
     ctx.status("[1/4] Reading config...");
     let config;
     try {
-        config = await loadOrGenerate(ctx);
+        config = await loadOrGenerate(ctx, preParsedConfig);
     }
     catch (err) {
         // FUTURE11 Fas 2 — differentiate by the toml package's typed error.
@@ -236,7 +237,7 @@ async function publishInner(ctx, input) {
                         suggestion: "Fix the syntax error and retry publish.",
                     },
                     recovery: recoveryFixConfig({
-                        problems: [{ file: "percher.toml", message: err.message }],
+                        problems: tomlErrorToRecoveryProblems(err),
                         reasonCode: "config_invalid",
                     }),
                     summary: "percher.toml has invalid TOML syntax — fix and retry.",
@@ -245,10 +246,7 @@ async function publishInner(ctx, input) {
                 };
             }
             if (err.code === "VALIDATION_ERROR") {
-                const problems = (err.issues ?? []).map((i) => ({
-                    file: "percher.toml",
-                    message: `${i.path.join(".") || "(root)"}: ${i.message}`,
-                }));
+                const problems = tomlErrorToRecoveryProblems(err);
                 const bullets = problems.map((p) => `  - ${p.message}`).join("\n");
                 const count = problems.length;
                 return {
@@ -294,6 +292,36 @@ async function publishInner(ctx, input) {
             bundle: { fileCount: 0, bytes: 0 },
         };
     }
+    // A pre-parsed config skips the disk read, but a real upload still needs
+    // percher.toml IN the tarball — the API reads it from the extracted
+    // bundle. Without this guard a non-dry-run injected-config publish would
+    // upload a toml-less tarball and get rejected server-side with an opaque
+    // "percher.toml not found in tarball". Fail fast and locally instead.
+    // Dry-run never uploads, so it's exempt.
+    if (preParsedConfig && !input.dryRun && !existsSync(join(ctx.cwd, "percher.toml"))) {
+        return {
+            status: "failed",
+            fileCount: 0,
+            bytes: 0,
+            error: {
+                title: "percher.toml missing from the project",
+                explanation: "A pre-parsed config was supplied, but no percher.toml exists in the project directory. The file is packaged into the upload, so it must be present on disk for a real deploy.",
+                suggestion: "Run `percher init` (or write percher.toml) before publishing.",
+            },
+            recovery: recoveryFixConfig({
+                problems: [
+                    {
+                        file: "percher.toml",
+                        message: "percher.toml must exist on disk for a real upload (it ships in the tarball).",
+                    },
+                ],
+                reasonCode: "config_missing",
+            }),
+            summary: "percher.toml missing — required on disk for a real upload.",
+            configPath: tomlPathFor(ctx.cwd),
+            bundle: { fileCount: 0, bytes: 0 },
+        };
+    }
     // ── 2. Tarball ─────────────────────────────────────────────────────
     ctx.status("[2/4] Packaging files...");
     const tarball = await createTarball({ cwd: ctx.cwd, config });
@@ -440,7 +468,7 @@ async function publishInner(ctx, input) {
  * PublishResult. Both entry paths must route through here so the
  * re-auth path can't drift from the primary one.
  */
-async function executeDeploy(opts) {
+export async function executeDeploy(opts) {
     const { ctx, config, input, app, firstDeploy, tarball, t0, packageMs, missingBuildEnvKeys } = opts;
     const uploadStart = Date.now();
     ctx.status("[3/4] Uploading...");
@@ -551,11 +579,41 @@ async function executeDeploy(opts) {
     // Surface the auto-replace one-shot signal — only the initial POST
     // response carries it, so capture before the polling loop reassigns
     // `deployment` from getDeployment() (which never sees the flag).
+    const uploadMs = Date.now() - uploadStart;
+    return finalizeDeploy({
+        ctx,
+        config,
+        input,
+        app,
+        firstDeploy,
+        tarball: { fileCount: tarball.fileCount, bytes: tarball.bytes },
+        deployment,
+        t0,
+        packageMs,
+        uploadMs,
+        missingBuildEnvKeys,
+        cacheReused: cacheReusedDeployment !== null,
+    });
+}
+/**
+ * Post-deploy tail shared by the upload-publish path (`executeDeploy`)
+ * and the hosted inline-publish path (`publishInline`). Both produce a
+ * queued `Deployment` (from the upload route or the curated
+ * `/apps/publish` route) and need the identical "queued → poll → shape
+ * a PublishResult + recovery contract" behavior so an agent's
+ * `wait_for_deploy` chain works the same way regardless of entry point.
+ *
+ * Takes a bundle-stats summary rather than the live tarball stream
+ * because the stream has already been consumed by the time the deploy
+ * row exists.
+ */
+export async function finalizeDeploy(opts) {
+    const { ctx, config, input, app, firstDeploy, tarball, t0, packageMs, uploadMs, missingBuildEnvKeys, cacheReused, } = opts;
+    let deployment = opts.deployment;
     const replacedPreview = deployment.replacedPreview === true;
     if (replacedPreview) {
         ctx.status("Replaced previous preview...");
     }
-    const uploadMs = Date.now() - uploadStart;
     // FUTURE11 Phase 1 — async opt-in. Caller asked publish to return as
     // soon as the deploy is queued so it can resume with
     // percher_wait_for_deploy. The upload is finished and the server has
@@ -739,7 +797,7 @@ async function executeDeploy(opts) {
         firstDeploy: firstDeploy || undefined,
         cacheHit,
         cacheStatus,
-        cacheReused: cacheReusedDeployment !== null || undefined,
+        cacheReused: cacheReused || undefined,
         missingBuildEnvKeys: missingBuildEnvKeys.length > 0 ? missingBuildEnvKeys : undefined,
         // Phase 7.9 — operator-facing trace key. Codex P2 follow-up on
         // b8f469a: previously a CLI-generated UUID, but the API/worker
@@ -977,15 +1035,27 @@ async function handleAnonymousPublish(ctx, config, input, tarball) {
     };
 }
 // ── Helpers ────────────────────────────────────────────────────────────
-async function loadOrGenerate(ctx) {
+async function loadOrGenerate(ctx, preParsed) {
+    // Caller already parsed the config (e.g. init() just ran, or a test
+    // injected one) — skip the redundant disk read + parse. Clone it so the
+    // returned object is mutation-safe like the parseFile path: the publish
+    // flow mutates config.app.name in place on the anonymous path, and the
+    // caller's pre-parsed object must not be aliased by that.
+    if (preParsed)
+        return structuredClone(preParsed);
     const tomlPath = join(ctx.cwd, "percher.toml");
     if (!existsSync(tomlPath)) {
         ctx.status("No percher.toml found — detecting framework...");
-        await init(ctx);
+        // init() builds the config in memory and writes it to disk. Validate
+        // that object directly instead of reading + TOML-reparsing the file we
+        // just wrote — validate() applies the same schema (incl. the env-section
+        // transform) as parseFile, so the result is identical to the disk path.
+        const generated = await init(ctx);
+        return validate(generated.config);
     }
     return parseFile(tomlPath);
 }
-async function ensureApp(ctx, config) {
+export async function ensureApp(ctx, config) {
     try {
         const app = await ctx.client.apps.get(config.app.name);
         return { app, firstDeploy: false };