spawnfile 0.1.13 → 0.1.14

package/dist/cli/lifecyclePlan.js

@@ -0,0 +1,240 @@
+import { open } from "node:fs/promises";
+import path from "node:path";
+import { TextDecoder } from "node:util";
+import { z } from "zod";
+import { admitLifecyclePlan, createDeploymentLifecycleCorrelation, readDeploymentRecordFromOutput, resolveArtifactsExportLifecycleCorrelation, } from "../deployment/index.js";
+import { resolveProjectOutputDirectory } from "../filesystem/index.js";
+import { DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
+import { createArtifactsExportLifecycleInvocation, } from "./artifactsCommands.js";
+import { createDownLifecycleInvocation, } from "./downCommand.js";
+export const LIFECYCLE_PLAN_REQUEST_VERSION = "spawnfile.lifecycle-plan-request.v1";
+export const MAX_LIFECYCLE_PLAN_REQUEST_BYTES = 262_144;
+const common = {
+    compiled: z.string().min(1).max(4096).nullable(),
+    docker_command: z.string().min(1).max(4096).nullable(),
+    lifecycle_invocation_id: z
+        .string()
+        .regex(/^lci_[a-z0-9][a-z0-9_-]{15,127}$/u),
+    path: z.string().min(1).max(4096),
+    timeout_ms: z.number().int().positive().nullable(),
+    version: z.literal(LIFECYCLE_PLAN_REQUEST_VERSION),
+};
+export const lifecyclePlanRequestSchema = z.discriminatedUnion("operation", [
+    z
+        .object({
+        ...common,
+        deployment: z.string().min(1).max(128).nullable(),
+        include_private: z.boolean(),
+        operation: z.literal("artifacts_export"),
+        out: z.string().min(1).max(4096),
+        reader_image: z.string().min(1).max(4096).nullable(),
+        run_id: z.string().min(1).max(512).nullable(),
+    })
+        .strict(),
+    z
+        .object({
+        ...common,
+        deployment: z.string().min(1).max(128),
+        export_to: z.string().min(1).max(4096).nullable(),
+        force: z.boolean(),
+        operation: z.literal("down"),
+        reader_image: z.string().min(1).max(4096).nullable(),
+        remove_volumes: z.boolean(),
+    })
+        .strict(),
+]);
+const fail = () => {
+    throw new SpawnfileError("validation_error", "Invalid lifecycle plan request");
+};
+const assertNoDuplicateJsonKeys = (source) => {
+    let offset = 0;
+    const whitespace = () => {
+        while (/\s/u.test(source[offset] ?? ""))
+            offset += 1;
+    };
+    const string = () => {
+        const start = offset++;
+        while (offset < source.length) {
+            if (source[offset] === "\\")
+                offset += 2;
+            else if (source[offset] === '"') {
+                offset += 1;
+                return JSON.parse(source.slice(start, offset));
+            }
+            else
+                offset += 1;
+        }
+        return fail();
+    };
+    const value = () => {
+        whitespace();
+        if (source[offset] === "{")
+            object();
+        else if (source[offset] === "[")
+            array();
+        else if (source[offset] === '"')
+            void string();
+        else
+            while (offset < source.length &&
+                !/[\s,\]}]/u.test(source[offset] ?? ""))
+                offset += 1;
+    };
+    const object = () => {
+        offset += 1;
+        whitespace();
+        const keys = new Set();
+        if (source[offset] === "}") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            const key = string();
+            if (keys.has(key))
+                fail();
+            keys.add(key);
+            whitespace();
+            if (source[offset++] !== ":")
+                fail();
+            value();
+            whitespace();
+            if (source[offset] === "}") {
+                offset += 1;
+                return;
+            }
+            if (source[offset++] !== ",")
+                fail();
+            whitespace();
+        }
+        fail();
+    };
+    const array = () => {
+        offset += 1;
+        whitespace();
+        if (source[offset] === "]") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            value();
+            whitespace();
+            if (source[offset] === "]") {
+                offset += 1;
+                return;
+            }
+            if (source[offset++] !== ",")
+                fail();
+            whitespace();
+        }
+        fail();
+    };
+    value();
+    whitespace();
+    if (offset !== source.length)
+        fail();
+};
+const readStdin = async (stdin) => {
+    const chunks = [];
+    let length = 0;
+    try {
+        for await (const raw of stdin) {
+            const chunk = typeof raw === "string"
+                ? new TextEncoder().encode(raw)
+                : raw instanceof Uint8Array
+                    ? Uint8Array.from(raw)
+                    : fail();
+            if (chunk.byteLength === 0 ||
+                chunk.byteLength > MAX_LIFECYCLE_PLAN_REQUEST_BYTES - length)
+                fail();
+            chunks.push(chunk);
+            length += chunk.byteLength;
+        }
+    }
+    catch {
+        fail();
+    }
+    if (length === 0)
+        fail();
+    const result = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+};
+const readFile = async (file) => {
+    const exact = path.resolve(file);
+    const handle = await open(exact, "r").catch(fail);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > MAX_LIFECYCLE_PLAN_REQUEST_BYTES)
+            fail();
+        const bytes = new Uint8Array(stat.size);
+        let offset = 0;
+        while (offset < bytes.byteLength) {
+            const { bytesRead } = await handle.read(bytes, offset, bytes.byteLength - offset, offset);
+            if (bytesRead === 0)
+                fail();
+            offset += bytesRead;
+        }
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+};
+export const readLifecyclePlanRequest = async (source, stdin) => {
+    try {
+        const bytes = source === "-" ? await readStdin(stdin) : await readFile(source);
+        const text = new TextDecoder("utf-8", {
+            fatal: true,
+            ignoreBOM: true,
+        }).decode(bytes);
+        if (text.startsWith("\uFEFF"))
+            fail();
+        assertNoDuplicateJsonKeys(text);
+        return lifecyclePlanRequestSchema.parse(JSON.parse(text));
+    }
+    catch {
+        return fail();
+    }
+};
+const timeout = (value) => value === null ? undefined : String(value);
+export const createPlannedLifecycleInvocation = async (request) => {
+    const compiled = resolveProjectOutputDirectory(request.path, request.compiled ?? undefined, DEFAULT_OUTPUT_DIRECTORY);
+    if (request.operation === "artifacts_export") {
+        const options = {
+            compiled: request.compiled ?? undefined,
+            deployment: request.deployment ?? undefined,
+            dockerCommand: request.docker_command ?? undefined,
+            includePrivate: request.include_private,
+            json: true,
+            lifecycleInvocation: request.lifecycle_invocation_id,
+            out: request.out,
+            readerImage: request.reader_image ?? undefined,
+            runId: request.run_id ?? undefined,
+            timeout: timeout(request.timeout_ms),
+        };
+        const correlation = await resolveArtifactsExportLifecycleCorrelation({
+            compiledOutputDirectory: compiled,
+            deploymentName: options.deployment,
+            runId: options.runId,
+        });
+        return createArtifactsExportLifecycleInvocation(request.lifecycle_invocation_id, options, compiled, correlation);
+    }
+    const options = {
+        compiled: request.compiled ?? undefined,
+        deployment: request.deployment,
+        dockerCommand: request.docker_command ?? undefined,
+        exportTo: request.export_to ?? undefined,
+        force: request.force,
+        json: true,
+        lifecycleInvocation: request.lifecycle_invocation_id,
+        readerImage: request.reader_image ?? undefined,
+        timeout: timeout(request.timeout_ms),
+        volumes: request.remove_volumes,
+    };
+    const record = await readDeploymentRecordFromOutput(compiled, request.deployment);
+    return createDownLifecycleInvocation(request.lifecycle_invocation_id, compiled, options, createDeploymentLifecycleCorrelation(record));
+};
+export const planLifecycleInvocation = async (request) => admitLifecyclePlan(await createPlannedLifecycleInvocation(request));

package/dist/cli/lifecyclePlanningCommands.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { CliStreams } from "./runCli.js";
+export declare const registerLifecyclePlanningCommands: (program: Command, streams: CliStreams, stdin: AsyncIterable<unknown>) => void;

package/dist/cli/lifecyclePlanningCommands.js

@@ -0,0 +1,30 @@
+import { lookupLifecycleCompletion } from "../deployment/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { planLifecycleInvocation, readLifecyclePlanRequest } from "./lifecyclePlan.js";
+export const registerLifecyclePlanningCommands = (program, streams, stdin) => {
+    const lifecycle = program
+        .command("lifecycle")
+        .description("Plan or read durable machine lifecycle operations");
+    lifecycle
+        .command("plan")
+        .description("Admit an exact read-only artifacts-export or down lifecycle plan")
+        .requiredOption("--request <file>", "Strict spawnfile.lifecycle-plan-request.v1 JSON file, or - for stdin")
+        .action(async (options) => {
+        streams.stdout(JSON.stringify(await planLifecycleInvocation(await readLifecyclePlanRequest(options.request, stdin)), null, 2));
+    });
+    lifecycle
+        .command("lookup")
+        .description("Read one lifecycle completion without Docker or provider inspection")
+        .argument("[invocation]", "Lifecycle invocation id")
+        .option("--lifecycle-invocation <id>", "Lifecycle invocation id")
+        .action(async (invocation, options) => {
+        const id = options.lifecycleInvocation ?? invocation;
+        if (!id ||
+            (invocation !== undefined &&
+                options.lifecycleInvocation !== undefined &&
+                invocation !== options.lifecycleInvocation)) {
+            throw new SpawnfileError("validation_error", "lifecycle lookup requires exactly one lifecycle invocation id");
+        }
+        streams.stdout(JSON.stringify(await lookupLifecycleCompletion(id), null, 2));
+    });
+};

package/dist/cli/runCli.d.ts

@@ -1,7 +1,8 @@
-import { importClaudeCodeAuth, importCodexAuth, importEnvFile, requireAuthProfile } from "../auth/index.js";
-import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
+import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
 import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
+import { downDeployment, exportRunArtifacts } from "../deployment/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
 export interface CliStreams {
     stderr: (message: string) => void;
@@ -28,11 +29,16 @@ export interface CliHandlers {
     importCodexAuth: typeof importCodexAuth;
     importEnvFile: typeof importEnvFile;
     initProject: typeof initProject;
+    initializeTargetSecretSourceLifecycle: typeof initializeTargetSecretSourceLifecycle;
+    provisionCredentials: typeof provisionCredentials;
+    exportRunArtifacts: typeof exportRunArtifacts;
+    downDeployment: typeof downDeployment;
     listRuntimeAdapters: typeof listRuntimeAdapters;
     removeProjectSurface: typeof removeProjectSurface;
     requireAuthProfile: typeof requireAuthProfile;
     runProject: typeof runProject;
     upProject: typeof upProject;
+    buildUpReceipt: typeof buildUpReceipt;
     consumeImageUp: typeof consumeImageUp;
     devActivityProject: typeof devActivityProject;
     devApplyProject: typeof devApplyProject;
@@ -48,6 +54,7 @@ export interface CliHandlers {
 export interface RunCliOptions {
     handlers?: Partial<CliHandlers>;
     renderEnvironment?: CliRenderEnvironment;
+    stdin?: AsyncIterable<unknown>;
     streams?: CliStreams;
 }
 type RunCli = {

package/dist/cli/runCli.js

@@ -1,17 +1,21 @@
 import { readFileSync } from "node:fs";
 import { Command } from "commander";
-import { importClaudeCodeAuth, importCodexAuth, importEnvFile, requireAuthProfile } from "../auth/index.js";
-import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
+import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
 import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
+import { downDeployment, exportRunArtifacts } from "../deployment/index.js";
 import { errorExitCode, isSpawnfileError } from "../shared/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
+import { registerArtifactsCommands } from "./artifactsCommands.js";
+import { registerAuthCommands } from "./authCommands.js";
 import { registerDevCommands } from "./devCommands.js";
 import { registerLifecycleCommands } from "./lifecycleCommands.js";
 import { registerModelCommands } from "./modelCommands.js";
 import { registerRuntimeCommands } from "./runtimeCommands.js";
 import { registerSurfaceCommands } from "./surfaceCommands.js";
 import { registerStatusCommand } from "./statusCommand.js";
+import { registerProductionTargetCommands } from "./targetCommands.js";
 import { registerViewCommand } from "./viewCommand.js";
 const packageJsonPath = new URL("../../package.json", import.meta.url);
 const readPackageVersion = () => {
@@ -31,9 +35,11 @@ const createDefaultHandlers = () => ({
     buildCompilePlan, buildOrganizationView, buildProject, compileProject, publishProject,
     addAgentProject, addProjectModelFallback, addProjectSurface,
     addSubagentProject, addTeamProject, clearProjectModelFallbacks,
-    importClaudeCodeAuth, importCodexAuth, importEnvFile,
+    importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle,
+    provisionCredentials,
+    exportRunArtifacts, downDeployment,
     initProject, listRuntimeAdapters, removeProjectSurface, requireAuthProfile,
-    runProject, setProjectPrimaryModel, setProjectRuntime, upProject, consumeImageUp,
+    runProject, setProjectPrimaryModel, setProjectRuntime, upProject, buildUpReceipt, consumeImageUp,
     devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject,
     setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth
 });
@@ -45,11 +51,13 @@ const normalizeRunCliOptions = (optionsOrStreams, handlerOverrides = {}) => isCl
     ? {
         handlers: handlerOverrides,
         renderEnvironment: createDefaultRenderEnvironment(),
+        stdin: process.stdin,
         streams: optionsOrStreams
     }
     : {
         handlers: optionsOrStreams?.handlers ?? handlerOverrides,
         renderEnvironment: optionsOrStreams?.renderEnvironment ?? createDefaultRenderEnvironment(),
+        stdin: optionsOrStreams?.stdin ?? process.stdin,
         streams: optionsOrStreams?.streams ?? createDefaultStreams()
     };
 const writeCommanderOutput = (write, message) => {
@@ -58,6 +66,7 @@ const writeCommanderOutput = (write, message) => {
         write(normalized);
     }
 };
+const TARGET_CLI_USAGE_ERROR = "error: Invalid target command";
 const isCommanderError = (error) => {
     if (typeof error !== "object" || error === null) {
         return false;
@@ -82,32 +91,28 @@ const formatPlanSummary = (plan) => [
     `nodes: ${plan.nodes.length}`,
     `runtimes: ${Object.keys(plan.runtimes).sort().join(", ") || "none"}`
 ].join("\n");
-const formatAuthProfileSummary = (profile) => {
-    const envKeys = Object.keys(profile.env).sort();
-    const importedKinds = Object.keys(profile.imports).sort();
-    return [
-        `profile: ${profile.name}`,
-        `env: ${envKeys.length > 0 ? envKeys.join(", ") : "none"}`,
-        `imports: ${importedKinds.length > 0 ? importedKinds.join(", ") : "none"}`
-    ];
-};
 const emitLines = (streams, lines) => lines.forEach((line) => streams.stdout(line));
 const emitFileLines = (streams, label, filePaths) => emitLines(streams, filePaths.map((filePath) => `${label} ${filePath}`));
 export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
     const cliOptions = normalizeRunCliOptions(optionsOrStreams, handlerOverrides);
     const streams = cliOptions.streams;
     const handlers = { ...createDefaultHandlers(), ...cliOptions.handlers };
+    const isTargetInvocation = argv[0] === "target";
     let commandExitCode = 0;
     const program = new Command();
     program.name("spawnfile").description("Spawnfile v0.1 compiler").version(readPackageVersion());
     program.exitOverride();
     program.configureOutput({
         outputError: (message, write) => write(message),
-        writeErr: (message) => writeCommanderOutput(streams.stderr, message),
+        writeErr: (message) => {
+            if (!isTargetInvocation)
+                writeCommanderOutput(streams.stderr, message);
+        },
         writeOut: (message) => writeCommanderOutput(streams.stdout, message)
     });
-    registerLifecycleCommands(program, handlers, streams);
+    registerLifecycleCommands(program, handlers, streams, cliOptions.stdin);
     registerDevCommands(program, handlers, streams);
+    registerArtifactsCommands(program, handlers, streams);
     program
         .command("init")
         .description("Scaffold a new Spawnfile project or team in a directory")
@@ -172,6 +177,9 @@ export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
         commandExitCode = exitCode;
     });
     registerViewCommand(program, handlers, streams, cliOptions.renderEnvironment);
+    registerProductionTargetCommands(program, streams, cliOptions.stdin, (exitCode) => {
+        commandExitCode = exitCode;
+    });
     program
         .command("validate")
         .description("Validate a Spawnfile and report the resolved compile plan")
@@ -189,68 +197,16 @@ export const runCli = async (argv, optionsOrStreams, handlerOverrides = {}) => {
             streams.stdout(runtimeName);
         }
     });
-    const authCommand = program.command("auth").description("Manage local Spawnfile auth profiles");
-    const authImportCommand = authCommand
-        .command("import")
-        .description("Import auth material into a local auth profile");
-    authImportCommand
-        .command("env")
-        .description("Import secrets from an env file into a profile")
-        .argument("<file>", "Path to an env file")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .action(async (filePath, options) => {
-        const profile = await handlers.importEnvFile(options.profile, filePath);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authImportCommand
-        .command("claude-code")
-        .description("Import Claude Code subscription credentials into a profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--from <directory>", "Source Claude Code config directory")
-        .action(async (options) => {
-        const profile = await handlers.importClaudeCodeAuth(options.profile, options.from);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authImportCommand
-        .command("codex")
-        .description("Import Codex subscription credentials into a profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--from <directory>", "Source Codex config directory")
-        .action(async (options) => {
-        const profile = await handlers.importCodexAuth(options.profile, options.from);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authCommand
-        .command("sync")
-        .description("Provision auth material a project requires into a profile")
-        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .option("--env-file <file>", "Path to an env file with model keys and runtime secrets")
-        .option("--claude-from <directory>", "Source Claude Code config directory")
-        .option("--codex-from <directory>", "Source Codex config directory")
-        .action(async (inputPath, options) => {
-        const profile = await handlers.syncProjectAuth(inputPath, {
-            claudeCodeDirectory: options.claudeFrom,
-            codexDirectory: options.codexFrom,
-            envFilePath: options.envFile,
-            profileName: options.profile
-        });
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
-    authCommand
-        .command("show")
-        .description("Show the contents of a local auth profile")
-        .option("-p, --profile <name>", "Auth profile name", "default")
-        .action(async (options) => {
-        const profile = await handlers.requireAuthProfile(options.profile);
-        emitLines(streams, formatAuthProfileSummary(profile));
-    });
+    registerAuthCommands(program, handlers, streams, cliOptions.stdin);
     try {
         await program.parseAsync(argv, { from: "user" });
         return commandExitCode;
     }
     catch (error) {
         if (isCommanderError(error)) {
+            if (isTargetInvocation && error.exitCode !== 0) {
+                streams.stderr(TARGET_CLI_USAGE_ERROR);
+            }
             // Commander prints its own usage message; usage errors exit 2.
             return error.exitCode === 0 ? 0 : 2;
         }

package/dist/cli/runPublishCommands.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { CliHandlers, CliStreams } from "./runCli.js";
+export declare const registerRunPublishCommands: (program: Command, handlers: CliHandlers, streams: CliStreams) => void;

package/dist/cli/runPublishCommands.js

@@ -0,0 +1,70 @@
+import { SpawnfileError } from "../shared/index.js";
+import { resolveCommandInput } from "./resolveCommandInput.js";
+export const registerRunPublishCommands = (program, handlers, streams) => {
+    program
+        .command("run")
+        .description("Compile, build, and run the organization container locally")
+        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
+        .option("-o, --out <directory>", "Output directory")
+        .option("-t, --tag <image>", "Docker image tag")
+        .option("--auth-profile <name>", "Local Spawnfile auth profile")
+        .option("--context <name>", "Docker context for the deployment target")
+        .option("--deployment <name>", "Detached deployment record name")
+        .option("--docker-command <command>", "Docker command")
+        .option("--name <container>", "Docker container name")
+        .option("--env-file <file>", "Path to an env file for runtime secrets")
+        .option("--world-bindings <file>", "Path to a versioned world-bindings artifact")
+        .option("--image", "Interpret the argument as an image reference")
+        .option("-d, --detach", "Run the container in detached mode")
+        .action(async (inputPath, options) => {
+        const runInput = resolveCommandInput(inputPath, { forceImage: options.image });
+        if (runInput.kind === "image" || (runInput.kind === "invalid" && options.image)) {
+            throw new SpawnfileError("validation_error", `Image-mode run is not supported. Deploy the image with: ` +
+                `spawnfile up ${inputPath} --auth-profile <profile> ` +
+                "(add --env-file for any extra secrets; image deployments always detach).");
+        }
+        if (runInput.kind === "invalid") {
+            throw new SpawnfileError("validation_error", `Cannot resolve "${inputPath}" as a project path or image reference. ` +
+                "Pass a project directory, a Spawnfile path, or an image like 'name:tag' (use --image to force image mode).");
+        }
+        const result = await handlers.runProject(inputPath, {
+            authProfile: options.authProfile,
+            containerName: options.name,
+            detach: options.detach,
+            deploymentName: options.deployment,
+            dockerCommand: options.dockerCommand,
+            dockerContext: options.context,
+            envFilePath: options.envFile,
+            imageTag: options.tag,
+            outputDirectory: options.out,
+            ...(options.worldBindings !== undefined
+                ? { worldBindingsPath: options.worldBindings }
+                : {})
+        });
+        if (options.detach) {
+            streams.stdout(`running container ${result.containerName ?? "unknown"}`);
+            streams.stdout(`image: ${result.imageTag}`);
+        }
+    });
+    program
+        .command("publish")
+        .description("Compile, build, verify, and push the organization image to a registry")
+        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
+        .requiredOption("-t, --tag <image>", "Registry image reference to push")
+        .option("-o, --out <directory>", "Output directory")
+        .option("--docker-command <command>", "Docker command")
+        .action(async (inputPath, options) => {
+        const publishInput = resolveCommandInput(inputPath);
+        if (publishInput.kind !== "project") {
+            throw new SpawnfileError("validation_error", "publish operates on a project path, not an image reference");
+        }
+        const result = await handlers.publishProject(inputPath, {
+            dockerCommand: options.dockerCommand,
+            imageTag: options.tag,
+            outputDirectory: options.out
+        });
+        streams.stdout(`published ${result.imageTag}`);
+        streams.stdout(`digest: ${result.digest ?? "unknown"}`);
+        streams.stdout(`next: spawnfile up ${result.imageTag} --detach --auth-profile <profile>`);
+    });
+};

package/dist/cli/statusCommand.d.ts

@@ -1,37 +1,8 @@
 import { Command } from "commander";
-import { inspectDockerDeployment, recoverDockerDeploymentRecords } from "../deployment/index.js";
-import { collectDeploymentLogObservations, collectMoltnetProbeObservations, collectRuntimeProbeObservations, type StatusCommandResult, type StatusExitCode } from "../status/index.js";
+import { type StatusCommandResult, type StatusExitCode } from "../status/index.js";
 import type { CliHandlers, CliStreams } from "./runCli.js";
-type StatusCommandHandlers = Pick<CliHandlers, "buildOrganizationView"> & Partial<Pick<CliHandlers, "requireAuthProfile">>;
-type StatusCommandLiveHandlers = {
-    collectDeploymentLogObservations?: typeof collectDeploymentLogObservations;
-    collectMoltnetProbeObservations?: typeof collectMoltnetProbeObservations;
-    collectRuntimeProbeObservations?: typeof collectRuntimeProbeObservations;
-    inspectDockerDeployment?: typeof inspectDockerDeployment;
-    recoverDockerDeploymentRecords?: typeof recoverDockerDeploymentRecords;
-};
-type StatusCommandHandlersWithLive = StatusCommandHandlers & StatusCommandLiveHandlers;
-export interface StatusCommandOptions {
-    agent?: string;
-    context?: string;
-    deployment?: string;
-    dockerCommand?: string;
-    image?: boolean;
-    json?: boolean;
-    live?: boolean;
-    logs?: boolean;
-    network?: string;
-    out?: string;
-    pretty?: boolean;
-    pull?: boolean;
-    pullCheck?: boolean;
-    quiet?: boolean;
-    recover?: boolean;
-    runtime?: string;
-    team?: string;
-    timeout?: string;
-    watch?: boolean;
-}
+import { type StatusCommandHandlersWithLive, type StatusCommandOptions } from "./statusCommandOptions.js";
+export type { StatusCommandOptions } from "./statusCommandOptions.js";
 export interface StatusWatchOptions {
     intervalMs?: number;
     iterations?: number;
@@ -40,4 +11,3 @@ export interface StatusWatchOptions {
 export declare const executeStatusWatch: (inputPath: string, options: StatusCommandOptions, handlers: StatusCommandHandlersWithLive, streams: CliStreams, setExitCode: (exitCode: StatusExitCode) => void, watchOptions?: StatusWatchOptions) => Promise<void>;
 export declare const executeStatusCommand: (inputPath: string, options: StatusCommandOptions, handlers: StatusCommandHandlersWithLive) => Promise<StatusCommandResult>;
 export declare const registerStatusCommand: (program: Command, handlers: CliHandlers, streams: CliStreams, setExitCode: (exitCode: StatusExitCode) => void) => void;
-export {};