spawnfile 0.1.12 → 0.1.14

package/dist/cli/lifecycleMachine.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import { claimLifecycleInvocation, claimLifecycleRecovery, completeLifecycleInvocation, findExactLifecycleCompletion, markLifecycleAmbiguous, renewLifecycleOwner, } from "../deployment/index.js";
+import { SpawnfileError } from "../shared/index.js";
+export const createLifecycleInvocation = (id, operation, correlation, requestPolicy) => ({
+    correlation,
+    id,
+    operation,
+    request_policy: requestPolicy,
+    version: "spawnfile.lifecycle-invocation.v1",
+});
+export const digestLifecycleBinding = (value) => value === undefined
+    ? null
+    : `sha256:${createHash("sha256").update(value).digest("hex")}`;
+const withLifecycleHeartbeat = async (invocation, capability, task) => {
+    await renewLifecycleOwner(invocation, capability);
+    let failure;
+    const timer = setInterval(() => {
+        void renewLifecycleOwner(invocation, capability).catch((error) => {
+            failure = error;
+        });
+    }, 10_000);
+    timer.unref();
+    try {
+        const result = await task();
+        if (failure)
+            throw failure;
+        return result;
+    }
+    finally {
+        clearInterval(timer);
+    }
+};
+export const runMachineLifecycle = async (invocation, owner, reconcile) => {
+    const existing = await findExactLifecycleCompletion(invocation);
+    if (existing)
+        return existing.outcome_bytes;
+    const claim = await claimLifecycleInvocation(invocation);
+    if (claim.status === "replay") {
+        const replay = await findExactLifecycleCompletion(invocation);
+        if (!replay) {
+            throw new SpawnfileError("runtime_error", "Lifecycle replay completion disappeared");
+        }
+        return replay.outcome_bytes;
+    }
+    if (claim.status === "pending" && reconcile) {
+        const recovery = await claimLifecycleRecovery(invocation);
+        if (recovery.status === "replay") {
+            const completed = await findExactLifecycleCompletion(invocation);
+            if (completed)
+                return completed.outcome_bytes;
+            throw new SpawnfileError("runtime_error", "Lifecycle replay completion disappeared");
+        }
+        if (recovery.status === "owner") {
+            const verdict = await withLifecycleHeartbeat(invocation, recovery.capability, reconcile);
+            if (verdict.status === "completed") {
+                return (await completeLifecycleInvocation(invocation, verdict.outcomeBytes, recovery.capability)).outcome_bytes;
+            }
+            if (verdict.status === "provably_not_applied" ||
+                verdict.status === "resume_safe") {
+                return (await completeLifecycleInvocation(invocation, await withLifecycleHeartbeat(invocation, recovery.capability, () => owner(recovery.capability)), recovery.capability)).outcome_bytes;
+            }
+            await markLifecycleAmbiguous(invocation, "reconciliation_ambiguous", recovery.capability);
+            throw new SpawnfileError("runtime_error", `Lifecycle recovery is ambiguous: ${verdict.reason}`);
+        }
+        if (recovery.status === "ambiguous") {
+            throw new SpawnfileError("runtime_error", "Lifecycle recovery owner died; invocation is ambiguous");
+        }
+    }
+    if (claim.status !== "owner") {
+        throw new SpawnfileError("runtime_error", "Lifecycle invocation already has an in-flight owner");
+    }
+    return (await completeLifecycleInvocation(invocation, await withLifecycleHeartbeat(invocation, claim.capability, () => owner(claim.capability)), claim.capability)).outcome_bytes;
+};
+export const requireMachineLifecycle = (invocationId, json) => {
+    if (invocationId !== undefined && !json) {
+        throw new SpawnfileError("validation_error", "--lifecycle-invocation is only valid with --json");
+    }
+};

package/dist/cli/lifecyclePlan.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { type LifecycleInvocation } from "../deployment/index.js";
+export declare const LIFECYCLE_PLAN_REQUEST_VERSION: "spawnfile.lifecycle-plan-request.v1";
+export declare const MAX_LIFECYCLE_PLAN_REQUEST_BYTES = 262144;
+export declare const lifecyclePlanRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    deployment: z.ZodNullable<z.ZodString>;
+    include_private: z.ZodBoolean;
+    operation: z.ZodLiteral<"artifacts_export">;
+    out: z.ZodString;
+    reader_image: z.ZodNullable<z.ZodString>;
+    run_id: z.ZodNullable<z.ZodString>;
+    compiled: z.ZodNullable<z.ZodString>;
+    docker_command: z.ZodNullable<z.ZodString>;
+    lifecycle_invocation_id: z.ZodString;
+    path: z.ZodString;
+    timeout_ms: z.ZodNullable<z.ZodNumber>;
+    version: z.ZodLiteral<"spawnfile.lifecycle-plan-request.v1">;
+}, z.core.$strict>, z.ZodObject<{
+    deployment: z.ZodString;
+    export_to: z.ZodNullable<z.ZodString>;
+    force: z.ZodBoolean;
+    operation: z.ZodLiteral<"down">;
+    reader_image: z.ZodNullable<z.ZodString>;
+    remove_volumes: z.ZodBoolean;
+    compiled: z.ZodNullable<z.ZodString>;
+    docker_command: z.ZodNullable<z.ZodString>;
+    lifecycle_invocation_id: z.ZodString;
+    path: z.ZodString;
+    timeout_ms: z.ZodNullable<z.ZodNumber>;
+    version: z.ZodLiteral<"spawnfile.lifecycle-plan-request.v1">;
+}, z.core.$strict>], "operation">;
+export type LifecyclePlanRequest = z.infer<typeof lifecyclePlanRequestSchema>;
+export declare const readLifecyclePlanRequest: (source: string, stdin: AsyncIterable<unknown>) => Promise<LifecyclePlanRequest>;
+export declare const createPlannedLifecycleInvocation: (request: LifecyclePlanRequest) => Promise<LifecycleInvocation>;
+export declare const planLifecycleInvocation: (request: LifecyclePlanRequest) => Promise<LifecycleInvocation>;

package/dist/cli/lifecyclePlan.js

@@ -0,0 +1,240 @@
+import { open } from "node:fs/promises";
+import path from "node:path";
+import { TextDecoder } from "node:util";
+import { z } from "zod";
+import { admitLifecyclePlan, createDeploymentLifecycleCorrelation, readDeploymentRecordFromOutput, resolveArtifactsExportLifecycleCorrelation, } from "../deployment/index.js";
+import { resolveProjectOutputDirectory } from "../filesystem/index.js";
+import { DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
+import { createArtifactsExportLifecycleInvocation, } from "./artifactsCommands.js";
+import { createDownLifecycleInvocation, } from "./downCommand.js";
+export const LIFECYCLE_PLAN_REQUEST_VERSION = "spawnfile.lifecycle-plan-request.v1";
+export const MAX_LIFECYCLE_PLAN_REQUEST_BYTES = 262_144;
+const common = {
+    compiled: z.string().min(1).max(4096).nullable(),
+    docker_command: z.string().min(1).max(4096).nullable(),
+    lifecycle_invocation_id: z
+        .string()
+        .regex(/^lci_[a-z0-9][a-z0-9_-]{15,127}$/u),
+    path: z.string().min(1).max(4096),
+    timeout_ms: z.number().int().positive().nullable(),
+    version: z.literal(LIFECYCLE_PLAN_REQUEST_VERSION),
+};
+export const lifecyclePlanRequestSchema = z.discriminatedUnion("operation", [
+    z
+        .object({
+        ...common,
+        deployment: z.string().min(1).max(128).nullable(),
+        include_private: z.boolean(),
+        operation: z.literal("artifacts_export"),
+        out: z.string().min(1).max(4096),
+        reader_image: z.string().min(1).max(4096).nullable(),
+        run_id: z.string().min(1).max(512).nullable(),
+    })
+        .strict(),
+    z
+        .object({
+        ...common,
+        deployment: z.string().min(1).max(128),
+        export_to: z.string().min(1).max(4096).nullable(),
+        force: z.boolean(),
+        operation: z.literal("down"),
+        reader_image: z.string().min(1).max(4096).nullable(),
+        remove_volumes: z.boolean(),
+    })
+        .strict(),
+]);
+const fail = () => {
+    throw new SpawnfileError("validation_error", "Invalid lifecycle plan request");
+};
+const assertNoDuplicateJsonKeys = (source) => {
+    let offset = 0;
+    const whitespace = () => {
+        while (/\s/u.test(source[offset] ?? ""))
+            offset += 1;
+    };
+    const string = () => {
+        const start = offset++;
+        while (offset < source.length) {
+            if (source[offset] === "\\")
+                offset += 2;
+            else if (source[offset] === '"') {
+                offset += 1;
+                return JSON.parse(source.slice(start, offset));
+            }
+            else
+                offset += 1;
+        }
+        return fail();
+    };
+    const value = () => {
+        whitespace();
+        if (source[offset] === "{")
+            object();
+        else if (source[offset] === "[")
+            array();
+        else if (source[offset] === '"')
+            void string();
+        else
+            while (offset < source.length &&
+                !/[\s,\]}]/u.test(source[offset] ?? ""))
+                offset += 1;
+    };
+    const object = () => {
+        offset += 1;
+        whitespace();
+        const keys = new Set();
+        if (source[offset] === "}") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            const key = string();
+            if (keys.has(key))
+                fail();
+            keys.add(key);
+            whitespace();
+            if (source[offset++] !== ":")
+                fail();
+            value();
+            whitespace();
+            if (source[offset] === "}") {
+                offset += 1;
+                return;
+            }
+            if (source[offset++] !== ",")
+                fail();
+            whitespace();
+        }
+        fail();
+    };
+    const array = () => {
+        offset += 1;
+        whitespace();
+        if (source[offset] === "]") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            value();
+            whitespace();
+            if (source[offset] === "]") {
+                offset += 1;
+                return;
+            }
+            if (source[offset++] !== ",")
+                fail();
+            whitespace();
+        }
+        fail();
+    };
+    value();
+    whitespace();
+    if (offset !== source.length)
+        fail();
+};
+const readStdin = async (stdin) => {
+    const chunks = [];
+    let length = 0;
+    try {
+        for await (const raw of stdin) {
+            const chunk = typeof raw === "string"
+                ? new TextEncoder().encode(raw)
+                : raw instanceof Uint8Array
+                    ? Uint8Array.from(raw)
+                    : fail();
+            if (chunk.byteLength === 0 ||
+                chunk.byteLength > MAX_LIFECYCLE_PLAN_REQUEST_BYTES - length)
+                fail();
+            chunks.push(chunk);
+            length += chunk.byteLength;
+        }
+    }
+    catch {
+        fail();
+    }
+    if (length === 0)
+        fail();
+    const result = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+};
+const readFile = async (file) => {
+    const exact = path.resolve(file);
+    const handle = await open(exact, "r").catch(fail);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > MAX_LIFECYCLE_PLAN_REQUEST_BYTES)
+            fail();
+        const bytes = new Uint8Array(stat.size);
+        let offset = 0;
+        while (offset < bytes.byteLength) {
+            const { bytesRead } = await handle.read(bytes, offset, bytes.byteLength - offset, offset);
+            if (bytesRead === 0)
+                fail();
+            offset += bytesRead;
+        }
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+};
+export const readLifecyclePlanRequest = async (source, stdin) => {
+    try {
+        const bytes = source === "-" ? await readStdin(stdin) : await readFile(source);
+        const text = new TextDecoder("utf-8", {
+            fatal: true,
+            ignoreBOM: true,
+        }).decode(bytes);
+        if (text.startsWith("\uFEFF"))
+            fail();
+        assertNoDuplicateJsonKeys(text);
+        return lifecyclePlanRequestSchema.parse(JSON.parse(text));
+    }
+    catch {
+        return fail();
+    }
+};
+const timeout = (value) => value === null ? undefined : String(value);
+export const createPlannedLifecycleInvocation = async (request) => {
+    const compiled = resolveProjectOutputDirectory(request.path, request.compiled ?? undefined, DEFAULT_OUTPUT_DIRECTORY);
+    if (request.operation === "artifacts_export") {
+        const options = {
+            compiled: request.compiled ?? undefined,
+            deployment: request.deployment ?? undefined,
+            dockerCommand: request.docker_command ?? undefined,
+            includePrivate: request.include_private,
+            json: true,
+            lifecycleInvocation: request.lifecycle_invocation_id,
+            out: request.out,
+            readerImage: request.reader_image ?? undefined,
+            runId: request.run_id ?? undefined,
+            timeout: timeout(request.timeout_ms),
+        };
+        const correlation = await resolveArtifactsExportLifecycleCorrelation({
+            compiledOutputDirectory: compiled,
+            deploymentName: options.deployment,
+            runId: options.runId,
+        });
+        return createArtifactsExportLifecycleInvocation(request.lifecycle_invocation_id, options, compiled, correlation);
+    }
+    const options = {
+        compiled: request.compiled ?? undefined,
+        deployment: request.deployment,
+        dockerCommand: request.docker_command ?? undefined,
+        exportTo: request.export_to ?? undefined,
+        force: request.force,
+        json: true,
+        lifecycleInvocation: request.lifecycle_invocation_id,
+        readerImage: request.reader_image ?? undefined,
+        timeout: timeout(request.timeout_ms),
+        volumes: request.remove_volumes,
+    };
+    const record = await readDeploymentRecordFromOutput(compiled, request.deployment);
+    return createDownLifecycleInvocation(request.lifecycle_invocation_id, compiled, options, createDeploymentLifecycleCorrelation(record));
+};
+export const planLifecycleInvocation = async (request) => admitLifecyclePlan(await createPlannedLifecycleInvocation(request));

package/dist/cli/lifecyclePlanningCommands.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { CliStreams } from "./runCli.js";
+export declare const registerLifecyclePlanningCommands: (program: Command, streams: CliStreams, stdin: AsyncIterable<unknown>) => void;

package/dist/cli/lifecyclePlanningCommands.js

@@ -0,0 +1,30 @@
+import { lookupLifecycleCompletion } from "../deployment/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { planLifecycleInvocation, readLifecyclePlanRequest } from "./lifecyclePlan.js";
+export const registerLifecyclePlanningCommands = (program, streams, stdin) => {
+    const lifecycle = program
+        .command("lifecycle")
+        .description("Plan or read durable machine lifecycle operations");
+    lifecycle
+        .command("plan")
+        .description("Admit an exact read-only artifacts-export or down lifecycle plan")
+        .requiredOption("--request <file>", "Strict spawnfile.lifecycle-plan-request.v1 JSON file, or - for stdin")
+        .action(async (options) => {
+        streams.stdout(JSON.stringify(await planLifecycleInvocation(await readLifecyclePlanRequest(options.request, stdin)), null, 2));
+    });
+    lifecycle
+        .command("lookup")
+        .description("Read one lifecycle completion without Docker or provider inspection")
+        .argument("[invocation]", "Lifecycle invocation id")
+        .option("--lifecycle-invocation <id>", "Lifecycle invocation id")
+        .action(async (invocation, options) => {
+        const id = options.lifecycleInvocation ?? invocation;
+        if (!id ||
+            (invocation !== undefined &&
+                options.lifecycleInvocation !== undefined &&
+                invocation !== options.lifecycleInvocation)) {
+            throw new SpawnfileError("validation_error", "lifecycle lookup requires exactly one lifecycle invocation id");
+        }
+        streams.stdout(JSON.stringify(await lookupLifecycleCompletion(id), null, 2));
+    });
+};

package/dist/cli/runCli.d.ts

@@ -1,6 +1,8 @@
-import { importClaudeCodeAuth, importCodexAuth, importEnvFile, requireAuthProfile } from "../auth/index.js";
-import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
+import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
+import { downDeployment, exportRunArtifacts } from "../deployment/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
 export interface CliStreams {
     stderr: (message: string) => void;
@@ -27,12 +29,22 @@ export interface CliHandlers {
     importCodexAuth: typeof importCodexAuth;
     importEnvFile: typeof importEnvFile;
     initProject: typeof initProject;
+    initializeTargetSecretSourceLifecycle: typeof initializeTargetSecretSourceLifecycle;
+    provisionCredentials: typeof provisionCredentials;
+    exportRunArtifacts: typeof exportRunArtifacts;
+    downDeployment: typeof downDeployment;
     listRuntimeAdapters: typeof listRuntimeAdapters;
     removeProjectSurface: typeof removeProjectSurface;
     requireAuthProfile: typeof requireAuthProfile;
     runProject: typeof runProject;
     upProject: typeof upProject;
+    buildUpReceipt: typeof buildUpReceipt;
     consumeImageUp: typeof consumeImageUp;
+    devActivityProject: typeof devActivityProject;
+    devApplyProject: typeof devApplyProject;
+    devRestartProject: typeof devRestartProject;
+    devStopProject: typeof devStopProject;
+    devUpProject: typeof devUpProject;
     setProjectPrimaryModel: typeof setProjectPrimaryModel;
     setProjectRuntime: typeof setProjectRuntime;
     setProjectSurfaceAccess: typeof setProjectSurfaceAccess;
@@ -42,6 +54,7 @@ export interface CliHandlers {
 export interface RunCliOptions {
     handlers?: Partial<CliHandlers>;
     renderEnvironment?: CliRenderEnvironment;
+    stdin?: AsyncIterable<unknown>;
     streams?: CliStreams;
 }
 type RunCli = {

package/dist/cli/runCli.js

@@ -1,15 +1,21 @@
 import { readFileSync } from "node:fs";
 import { Command } from "commander";
-import { importClaudeCodeAuth, importCodexAuth, importEnvFile, requireAuthProfile } from "../auth/index.js";
-import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
+import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
+import { downDeployment, exportRunArtifacts } from "../deployment/index.js";
 import { errorExitCode, isSpawnfileError } from "../shared/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
+import { registerArtifactsCommands } from "./artifactsCommands.js";
+import { registerAuthCommands } from "./authCommands.js";
+import { registerDevCommands } from "./devCommands.js";
 import { registerLifecycleCommands } from "./lifecycleCommands.js";
 import { registerModelCommands } from "./modelCommands.js";
 import { registerRuntimeCommands } from "./runtimeCommands.js";
 import { registerSurfaceCommands } from "./surfaceCommands.js";
 import { registerStatusCommand } from "./statusCommand.js";
+import { registerProductionTargetCommands } from "./targetCommands.js";
 import { registerViewCommand } from "./viewCommand.js";
 const packageJsonPath = new URL("../../package.json", import.meta.url);
 const readPackageVersion = () => {
@@ -29,9 +35,12 @@ const createDefaultHandlers = () => ({
     buildCompilePlan, buildOrganizationView, buildProject, compileProject, publishProject,
     addAgentProject, addProjectModelFallback, addProjectSurface,
     addSubagentProject, addTeamProject, clearProjectModelFallbacks,
-    importClaudeCodeAuth, importCodexAuth, importEnvFile,
+    importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle,
+    provisionCredentials,
+    exportRunArtifacts, downDeployment,
     initProject, listRuntimeAdapters, removeProjectSurface, requireAuthProfile,
-    runProject, setProjectPrimaryModel, setProjectRuntime, upProject, consumeImageUp,
+    runProject, setProjectPrimaryModel, setProjectRuntime, upProject, buildUpReceipt, consumeImageUp,
+    devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject,
     setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth
 });
 const isCliStreams = (value) => {
@@ -42,11 +51,13 @@ const normalizeRunCliOptions = (optionsOrStreams, handlerOverrides = {}) => isCl
     ? {
         handlers: handlerOverrides,
         renderEnvironment: createDefaultRenderEnvironment(),
+        stdin: process.stdin,
         streams: optionsOrStreams
     }
     : {
         handlers: optionsOrStreams?.handlers ?? handlerOverrides,
         renderEnvironment: optionsOrStreams?.renderEnvironment ?? createDefaultRenderEnvironment(),
+        stdin: optionsOrStreams?.stdin ?? process.stdin,
         streams: optionsOrStreams?.streams ?? createDefaultStreams()
     };
 const writeCommanderOutput = (write, message) => {
@@ -55,6 +66,7 @@ const writeCommanderOutput = (write, message) => {
         write(normalized);
     }
 };
+const TARGET_CLI_USAGE_ERROR = "error: Invalid target command";
 const isCommanderError = (error) => {
     if (typeof error !== "object" || error === null) {
         return false;
@@ -79,31 +91,28 @@ const formatPlanSummary = (plan) => [
     `nodes: ${plan.nodes.length}`,
     `runtimes: ${Object.keys(plan.runtimes).sort().join(", ") || "none"}`
 ].join("\n");
-const formatAuthProfileSummary = (profile) => {
-    const envKeys = Object.keys(profile.env).sort();
-    const importedKinds = Object.keys(profile.imports).sort();
-    return [
-        `profile: ${profile.name}`,
-        `env: ${envKeys.length > 0 ? envKeys.join(", ") : "none"}`,
-        `imports: ${importedKinds.length > 0 ? importedKinds.join(", ") : "none"}`
-    ];
-};
 const emitLines = (streams, lines) => lines.forEach((line) => streams.stdout(line));
 const emitFileLines = (streams, label, filePaths) => emitLines(streams, filePaths.map((filePath) => `${label} ${filePath}`));
 export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
     const cliOptions = normalizeRunCliOptions(optionsOrStreams, handlerOverrides);
     const streams = cliOptions.streams;
     const handlers = { ...createDefaultHandlers(), ...cliOptions.handlers };
+    const isTargetInvocation = argv[0] === "target";
     let commandExitCode = 0;
     const program = new Command();
     program.name("spawnfile").description("Spawnfile v0.1 compiler").version(readPackageVersion());
     program.exitOverride();
     program.configureOutput({
         outputError: (message, write) => write(message),
-        writeErr: (message) => writeCommanderOutput(streams.stderr, message),
+        writeErr: (message) => {
+            if (!isTargetInvocation)
+                writeCommanderOutput(streams.stderr, message);
+        },
         writeOut: (message) => writeCommanderOutput(streams.stdout, message)
     });
-    registerLifecycleCommands(program, handlers, streams);
+    registerLifecycleCommands(program, handlers, streams, cliOptions.stdin);
+    registerDevCommands(program, handlers, streams);
+    registerArtifactsCommands(program, handlers, streams);
     program
         .command("init")
         .description("Scaffold a new Spawnfile project or team in a directory")
@@ -168,6 +177,9 @@ export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
         commandExitCode = exitCode;
     });
     registerViewCommand(program, handlers, streams, cliOptions.renderEnvironment);
+    registerProductionTargetCommands(program, streams, cliOptions.stdin, (exitCode) => {
+        commandExitCode = exitCode;
+    });
     program
         .command("validate")
         .description("Validate a Spawnfile and report the resolved compile plan")
@@ -185,68 +197,16 @@ export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
             streams.stdout(runtimeName);
         }
     });
-    const authCommand = program.command("auth").description("Manage local Spawnfile auth profiles");
-    const authImportCommand = authCommand
-        .command("import")
-        .description("Import auth material into a local auth profile");
-    authImportCommand
-        .command("env")
-        .description("Import secrets from an env file into a profile")
-        .argument("<file>", "Path to an env file")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .action(async (filePath, options) => {
-        const profile = await handlers.importEnvFile(options.profile, filePath);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authImportCommand
-        .command("claude-code")
-        .description("Import Claude Code subscription credentials into a profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--from <directory>", "Source Claude Code config directory")
-        .action(async (options) => {
-        const profile = await handlers.importClaudeCodeAuth(options.profile, options.from);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authImportCommand
-        .command("codex")
-        .description("Import Codex subscription credentials into a profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--from <directory>", "Source Codex config directory")
-        .action(async (options) => {
-        const profile = await handlers.importCodexAuth(options.profile, options.from);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authCommand
-        .command("sync")
-        .description("Provision auth material a project requires into a profile")
-        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--env-file <file>", "Path to an env file with model keys and runtime secrets")
-        .option("--claude-from <directory>", "Source Claude Code config directory")
-        .option("--codex-from <directory>", "Source Codex config directory")
-        .action(async (inputPath, options) => {
-        const profile = await handlers.syncProjectAuth(inputPath, {
-            claudeCodeDirectory: options.claudeFrom,
-            codexDirectory: options.codexFrom,
-            envFilePath: options.envFile,
-            profileName: options.profile
-        });
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authCommand
-        .command("show")
-        .description("Show the contents of a local auth profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .action(async (options) => {
-        const profile = await handlers.requireAuthProfile(options.profile);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
+    registerAuthCommands(program, handlers, streams, cliOptions.stdin);
     try {
         await program.parseAsync(argv, { from: "user" });
         return commandExitCode;
     }
     catch (error) {
         if (isCommanderError(error)) {
+            if (isTargetInvocation && error.exitCode !== 0) {
+                streams.stderr(TARGET_CLI_USAGE_ERROR);
+            }
             // Commander prints its own usage message; usage errors exit 2.
             return error.exitCode === 0 ? 0 : 2;
         }

package/dist/cli/runPublishCommands.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { CliHandlers, CliStreams } from "./runCli.js";
+export declare const registerRunPublishCommands: (program: Command, handlers: CliHandlers, streams: CliStreams) => void;