@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/infra-npm-publish.cli-command.descriptor.d.ts

@@ -1,27 +1,87 @@
 declare const _default: {
-    id: string;
-    kind: "cli/command";
-    name: string;
-    description: string;
-    group: string;
-    arguments: {
-        name: string;
-        description: string;
-        required: boolean;
-        variadic: boolean;
-    }[];
-    options: ({
-        flags: string;
-        description: string;
-        default?: undefined;
-    } | {
-        flags: string;
-        description: string;
-        default: string;
-    })[];
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra-npm.publish";
+    readonly kind: "cli/command";
+    readonly name: "publish";
+    readonly description: "Publish npm packages. Registry writes use the signed-in session or a configured vibes-secrets token";
+    readonly group: "infra-npm";
+    readonly arguments: [{
+        readonly name: "paths";
+        readonly description: "Release-root package directories; workspace dependencies are derived and published first (defaults to cwd)";
+        readonly required: false;
+        readonly variadic: true;
+    }];
+    readonly options: [{
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes secrets environment to read the publish token from";
+    }, {
+        readonly flags: "--backend <id>";
+        readonly description: "Specific secrets backend id to read from";
+    }, {
+        readonly flags: "--token-key <key>";
+        readonly description: "Secret key containing the npm token (defaults by registry: NPM_TOKEN for npmjs, VIBES_NPM_TOKEN for packages.vibes.dev)";
+    }, {
+        readonly flags: "--to <registry>";
+        readonly description: "The infra/package-registry id to publish to; a registry whose descriptor names mirrorOf receives the source registry's exact bytes";
+    }, {
+        readonly flags: "--registry <url>";
+        readonly description: "Explicit npm registry URL override; defaults to each package publishConfig.registry";
+    }, {
+        readonly flags: "--scope <scope>";
+        readonly description: "Scoped package registry override to write into the temporary npmrc (optional; inferred from package.json if omitted)";
+    }, {
+        readonly flags: "--tag <tag>";
+        readonly description: "npm dist-tag";
+    }, {
+        readonly flags: "--otp <code>";
+        readonly description: "One-time password for npm accounts that require publish-time 2FA";
+    }, {
+        readonly flags: "--provenance";
+        readonly description: "Pass --provenance to npm publish";
+    }, {
+        readonly flags: "--publish-delay-ms <ms>";
+        readonly description: "Milliseconds to wait between successful real publish attempts";
+        readonly default: "0";
+    }, {
+        readonly flags: "--rate-limit-retries <count>";
+        readonly description: "Number of times to wait and retry the same package after npm returns E429";
+        readonly default: "0";
+    }, {
+        readonly flags: "--rate-limit-delay-ms <ms>";
+        readonly description: "Milliseconds to wait before each E429 retry";
+        readonly default: "3600000";
+    }, {
+        readonly flags: "--authority-verify";
+        readonly description: "Verify exact-lease publish, install, replay rejection, and expiry rejection";
+    }, {
+        readonly flags: "--rc-major-exception";
+        readonly description: "ADR-0017 exception for prerelease major-version changes: skip the landed-on-canonical-main check. Requires a non-latest --tag, prerelease versions, and no published stable release of the target major";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Pack and run npm publish --dry-run without requiring an npm token";
+    }, {
+        readonly flags: "--pack-destination <path>";
+        readonly description: "Retain every canonical release-set tarball for clean consumer verification";
+    }, {
+        readonly flags: "--consumer <path>";
+        readonly description: "Also install the packed batch into this real consumer checkout (e.g. a vibes-app-template clone) and run its check/build before publishing. Off by default";
+    }, {
+        readonly flags: "--release-workspace-manifest <path>";
+        readonly description: "Exact sealed workspace package.json under release/registry (defaults to release/registry/package.json)";
+    }, {
+        readonly flags: "--release-contract-version <version>";
+        readonly description: "Release record format: 1 (publish set only) or 2 (separate build closure). Overrides vibes.release.contractVersion in the workspace root package.json; default 1";
+        readonly choices: ["1", "2"];
+    }, {
+        readonly flags: "--yes";
+        readonly description: "Actually publish. Required unless --dry-run is set";
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra-npm-publish.cli-command.descriptor.d.ts.map

package/dist/cli/npm/infra-npm-publish.cli-command.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-npm-publish.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAwEG"}
+{"version":3,"file":"infra-npm-publish.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAsHG"}

package/dist/cli/npm/infra-npm-publish.cli-command.descriptor.js

@@ -1,14 +1,14 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra-npm.publish',
     kind: 'cli/command',
     name: 'publish',
-    description: 'Publish npm packages using a token resolved from vibes secrets',
+    description: 'Publish npm packages. Registry writes use the signed-in session or a configured vibes-secrets token',
     group: 'infra-npm',
     arguments: [
         {
             name: 'paths',
-            description: 'Package directories to publish (defaults to cwd)',
+            description: 'Release-root package directories; workspace dependencies are derived and published first (defaults to cwd)',
             required: false,
             variadic: true
         }
@@ -16,7 +16,7 @@ export default createRuntimeAsset({
     options: [
         {
             flags: '--environment <name>',
-            description: 'Vibes secrets environment to read NPM_TOKEN from'
+            description: 'Vibes secrets environment to read the publish token from'
         },
         {
             flags: '--backend <id>',
@@ -24,27 +24,23 @@ export default createRuntimeAsset({
         },
         {
             flags: '--token-key <key>',
-            description: 'Secret key containing the npm token',
-            default: 'NPM_TOKEN'
+            description: 'Secret key containing the npm token (defaults by registry: NPM_TOKEN for npmjs, VIBES_NPM_TOKEN for packages.vibes.dev)'
         },
         {
-            flags: '--registry <url>',
-            description: 'npm registry URL',
-            default: 'https://registry.npmjs.org'
+            flags: '--to <registry>',
+            description: "The infra/package-registry id to publish to; a registry whose descriptor names mirrorOf receives the source registry's exact bytes"
         },
         {
-            flags: '--scope <scope>',
-            description: 'Scoped package registry override to write into the temporary npmrc',
-            default: '@vibesdotdev'
+            flags: '--registry <url>',
+            description: 'Explicit npm registry URL override; defaults to each package publishConfig.registry'
         },
         {
-            flags: '--access <access>',
-            description: 'npm access level override (public|restricted)'
+            flags: '--scope <scope>',
+            description: 'Scoped package registry override to write into the temporary npmrc (optional; inferred from package.json if omitted)'
         },
         {
             flags: '--tag <tag>',
-            description: 'npm dist-tag',
-            default: 'latest'
+            description: 'npm dist-tag'
         },
         {
             flags: '--otp <code>',
@@ -54,10 +50,50 @@ export default createRuntimeAsset({
             flags: '--provenance',
             description: 'Pass --provenance to npm publish'
         },
+        {
+            flags: '--publish-delay-ms <ms>',
+            description: 'Milliseconds to wait between successful real publish attempts',
+            default: '0'
+        },
+        {
+            flags: '--rate-limit-retries <count>',
+            description: 'Number of times to wait and retry the same package after npm returns E429',
+            default: '0'
+        },
+        {
+            flags: '--rate-limit-delay-ms <ms>',
+            description: 'Milliseconds to wait before each E429 retry',
+            default: '3600000'
+        },
+        {
+            flags: '--authority-verify',
+            description: 'Verify exact-lease publish, install, replay rejection, and expiry rejection'
+        },
+        {
+            flags: '--rc-major-exception',
+            description: 'ADR-0017 exception for prerelease major-version changes: skip the landed-on-canonical-main check. Requires a non-latest --tag, prerelease versions, and no published stable release of the target major'
+        },
         {
             flags: '--dry-run',
             description: 'Pack and run npm publish --dry-run without requiring an npm token'
         },
+        {
+            flags: '--pack-destination <path>',
+            description: 'Retain every canonical release-set tarball for clean consumer verification'
+        },
+        {
+            flags: '--consumer <path>',
+            description: 'Also install the packed batch into this real consumer checkout (e.g. a vibes-app-template clone) and run its check/build before publishing. Off by default'
+        },
+        {
+            flags: '--release-workspace-manifest <path>',
+            description: 'Exact sealed workspace package.json under release/registry (defaults to release/registry/package.json)'
+        },
+        {
+            flags: '--release-contract-version <version>',
+            description: 'Release record format: 1 (publish set only) or 2 (separate build closure). Overrides vibes.release.contractVersion in the workspace root package.json; default 1',
+            choices: ['1', '2']
+        },
         {
             flags: '--yes',
             description: 'Actually publish. Required unless --dry-run is set'

package/dist/cli/npm/infra-npm-publish.cli-command.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-npm-publish.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,gEAAgE;IAC7E,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;SACd;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,kDAAkD;SAC/D;QACD;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE,WAAW;SACpB;QACD;YACC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,4BAA4B;SACrC;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,oEAAoE;YACjF,OAAO,EAAE,cAAc;SACvB;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,+CAA+C;SAC5D;QACD;YACC,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,QAAQ;SACjB;QACD;YACC,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kEAAkE;SAC/E;QACD;YACC,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kCAAkC;SAC/C;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,mEAAmE;SAChF;QACD;YACC,KAAK,EAAE,OAAO;YACd,WAAW,EAAE,oDAAoD;SACjE;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra-npm-publish.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,SAAS;IACf,WAAW,EACV,qGAAqG;IACtG,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,OAAO;YACb,WAAW,EACV,4GAA4G;YAC7G,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;SACd;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,0DAA0D;SACvE;QACD;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,0CAA0C;SACvD;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,yHAAyH;SAC1H;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACV,oIAAoI;SACrI;QACD;YACC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EACV,qFAAqF;SACtF;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACV,sHAAsH;SACvH;QACD;YACC,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,cAAc;SAC3B;QACD;YACC,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kEAAkE;SAC/E;QACD;YACC,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kCAAkC;SAC/C;QACD;YACC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,+DAA+D;YAC5E,OAAO,EAAE,GAAG;SACZ;QACD;YACC,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,2EAA2E;YACxF,OAAO,EAAE,GAAG;SACZ;QACD;YACC,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE,SAAS;SAClB;QACD;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,6EAA6E;SAC1F;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACV,yMAAyM;SAC1M;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,mEAAmE;SAChF;QACD;YACC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,4EAA4E;SACzF;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,4JAA4J;SAC7J;QACD;YACC,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EACV,wGAAwG;SACzG;QACD;YACC,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EACV,kKAAkK;YACnK,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;SACnB;QACD;YACC,KAAK,EAAE,OAAO;YACd,WAAW,EAAE,oDAAoD;SACjE;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/npm/infra-npm-publish.cli-command.impl.d.ts

@@ -1,5 +1,56 @@
+import { CapabilityError, type CaughtFailure } from "@vibesdotdev/kernel";
+import { type CommandContext, type CommandOptions } from "@vibesdotdev/cli";
+import type { JsonValue } from "@vibesdotdev/kernel/schemas/json";
+import type { PublishResult } from "./publish/types.ts";
+/** Invocation path resolution, also used by `vibes registry publish`. */
+export { resolvePublishPackageDirs, resolvePublishWorkspaceRoot, } from "./publish/workspace-discovery.ts";
+/**
+ * Re-enter the sealed framework checkout's own executor when this module is
+ * not it, so release work always runs the sealed source.
+ */
+export declare function dispatchToRegistryReleaseExecutor(args: CommandOptions, opts: CommandOptions, workspaceRoot: string, context: CommandContext): Promise<{
+    dispatched: false;
+    workspaceRoot: string;
+} | {
+    dispatched: true;
+    result: JsonValue;
+}>;
+/** Rethrow a planning/validation failure as the command's INVALID_INPUT. */
+export declare function invalidInput(cause: CaughtFailure): never;
+/** Map a publish-phase failure to the command error, with partial results. */
+export declare function publishFailure(cause: CaughtFailure, results: readonly PublishResult[]): CapabilityError;
+/**
+ * Announce and publish while the ephemeral artifact directory is still owned.
+ * A refusal from the announcement or the publish removes that directory.
+ */
+export declare function publishInsideArtifactCleanup<T>(options: {
+    announce: () => void;
+    publish: () => Promise<T>;
+    cleanup: () => Promise<void>;
+    fail: (cause: CaughtFailure) => CapabilityError;
+}): Promise<T>;
 declare const _default: {
-    execute(args: Record<string, unknown>, opts: Record<string, unknown>): Promise<void>;
+    execute(args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<JsonValue | {
+        [x: string]: unknown;
+        ok: boolean;
+        dryRun: boolean;
+        results: {
+            [x: string]: unknown;
+            name: string;
+            version: string;
+            dryRun: boolean;
+            ok: boolean;
+            artifactIntegrity: string;
+            gitHead: string;
+            skipped?: boolean | undefined;
+            reason?: string | undefined;
+        }[];
+    } | {
+        ok: boolean;
+        source: string;
+        target: string;
+        outcomes: import("./mirror-registry-artifacts.ts").MirrorOutcome[];
+    }>;
 };
 export default _default;
 //# sourceMappingURL=infra-npm-publish.cli-command.impl.d.ts.map

package/dist/cli/npm/infra-npm-publish.cli-command.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-npm-publish.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.impl.ts"],"names":[],"mappings":";kBAqYqB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;;AAD3F,wBAqFE"}
+{"version":3,"file":"infra-npm-publish.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/infra-npm-publish.cli-command.impl.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,eAAe,EAIf,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAwElE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAQxD,yEAAyE;AACzE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,kCAAkC,CAAC;AAE1C;;;GAGG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,cAAc,GACtB,OAAO,CACN;IAAE,UAAU,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAC1C,CA2DA;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,CAOxD;AAcD,8EAA8E;AAC9E,wBAAgB,cAAc,CAC5B,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,SAAS,aAAa,EAAE,GAChC,eAAe,CAoBjB;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,OAAO,EAAE;IAC7D,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,eAAe,CAAC;CACjD,GAAG,OAAO,CAAC,CAAC,CAAC,CAmBb;;kBAIS,cAAc,QACd,cAAc,WACX,cAAc;;;;;;;;;;;;;;;;;;;;;;AAJ3B,wBAuiBE"}