T-7H3A-npm-publish-for-sdlc-once-marketplace-sdlc-mirror-ships

State: planning/draft · Impact: medium · Complexity: medium

Goal

Phase 14 (M-JJKF) ships the first public release at v0.4.0 as a marketplace-sdlc plugin push only. npm publish does not start at v0.4.0 because the mirror (marketplace-sdlc, assembled by scripts/sdlc-mirror/assemble.ts) does not yet ship a buildable CLI source tree — the piece an npm package needs to build and run the CLI standalone. This task tracks that follow-up: wiring the mirror’s CLI source workspace up to the point npm publish is possible, then actually gating and running that publish.

Today

Phase 14 sets up marketplace-sdlc as an agent-pants project holding the vault plugin plus a CLI source workspace (T-WFVU), and wires the release mechanics for an eventual npm binary release (publish-libs.json entry, mirror-side release.yml, T-ZZRC). Neither task claims the mirror’s CLI source is buildable standalone — marketplace-sdlc-out T-WFVU/T-ZZRC’s own out-of-scope notes exclude actually publishing to npm. As of v0.4.0, only the marketplace plugin publish ships publicly; npm stays unpublished.

Proposed

marketplace-sdlc ships a CLI source workspace that builds and runs standalone (no dev checkout, no monorepo-only paths), so an npm package built from it works for a consumer who only has npm. Once that holds, npm publish runs through the same release mechanics T-ZZRC built, gated the same way every other public push is gated: it stops and notifies, and needs the user’s explicit approval every time it happens, not just once.

Approach

Confirm what’s missing from the mirror’s CLI source workspace for a standalone build (dependency closure, path rewrites, any monorepo-only assumptions left over from T-2A6R’s assembler).
Close that gap so marketplace-sdlc’s CLI source builds and runs outside this monorepo.
Extend the release mechanics from T-ZZRC to actually run the npm publish step, behind the same gate/approval Phase 14 already uses for the marketplace push.
Update the plan/roadmap/milestone/atlas docs once npm publish is live, since they currently describe it as a pending follow-up.

Areas

Area	Note
`marketplace-sdlc` (external repo/checkout)	CLI source workspace needs to be standalone-buildable
`scripts/sdlc-mirror/assemble.ts`	Assembler that produces the mirror tree; may need to close leftover-path gaps for the CLI source
mirror-side `release.yml`	Where the actual npm publish step gets added, gated behind approval

Acceptance criteria

AC-1: The mirror’s CLI source workspace builds and runs with no dev checkout, SDLC_HOME, link, or monorepo-only path present.
AC-2: npm publish runs through the mirror-side release mechanics and stops for the user’s explicit approval every time, matching the marketplace-push gate.
AC-3: The plan, roadmap and milestone docs are updated to say npm is live once this ships.

Out of scope

Re-litigating whether v0.4.0 itself should include npm — it doesn’t; see M-JJKF and the atlas.
The marketplace-sdlc plugin push mechanics themselves (T-WFVU, T-ZZRC) — this task only covers the npm-specific gap.

Dependencies

T-WFVU — marketplace-sdlc’s CLI source workspace has to exist before it can be made standalone-buildable.
T-ZZRC — the release mechanics (publish-libs.json entry, mirror-side release.yml) this task’s npm step extends.

Discovery context

Flagged in PR review on #2321: the plan, roadmap and milestone said v0.4.0 publishes to both marketplace-sdlc and npm, while the atlas (the more current source) said npm is a follow-up because the mirror lacks buildable CLI source. This task is the follow-up the atlas alluded to.

Depends on

T-WFVU, T-ZZRC

← Back to Tasks