Delimit Deploy Impl
_delimit_deploy_implDispatch a deployment operation by name: plan, build, publish, verify, rollback, status, site, or npm. Manage container, site, and npm deployments from a single entry point.
Instructions
Unified deployment entry point — dispatches to one of eight actions (Pro).
When to use: as the single MCP-registered deploy surface (delimit_deploy) when the caller wants to pick the deploy operation by name in one call rather than choosing a specific delimit_deploy_* alias. Covers the full container chain (plan -> build -> publish -> verify -> rollback), the deploy-state read (status), and the two non-container ship paths (site / npm). When NOT to use: from internal code paths or when you want the operation's behavior and gate to surface at the right name — prefer the specific alias (delimit_deploy_plan, delimit_deploy_build, delimit_deploy_publish, delimit_deploy_verify, delimit_deploy_rollback, delimit_deploy_status, delimit_deploy_site, delimit_deploy_npm). For a pure runtime health check use delimit_obs_status; for a pre-deploy smoke test use delimit_test_smoke; for release-tracking metadata use delimit_release_status.
Sibling contrast: each delimit_deploy_ wrapper is a thin alias over this implementation (they exist so the action's docstring lives at the right name). This is the dispatch core. The "plan" action additionally shares logic with delimit_deploy_plan via the internal _deploy_plan_chain helper.
Side effects: ALL actions are gated by require_premium — unlicensed callers receive a license payload and no backend call is made. Errors are deterministic: an unrecognized action returns {"error": "Unknown action ''. Valid: ..."} before any gate or backend call. Per action:
"plan": delegates to _deploy_plan_chain (gate key "deploy_plan"). Read-mostly but ORCHESTRATES a chain: a worktree-sanity precheck, then delimit_security_audit (FAIL-CLOSED — halts with status="blocked" on audit error or any critical finding without producing a plan), then the deploy-bridge plan, then a best-effort delimit_gov_evaluate. Produces no deploy artifact itself.
"build": gate "deploy_build". WRITES locally — shells out to the container builder (consumes local disk/CPU for image layers). No network push at this step.
"publish": gate "deploy_publish". NETWORK WRITE — pushes previously built images to the configured container registry.
"verify": gate "deploy_verify". Read-only network PROBES (HTTP health checks, container/dependency inspection) of a deployed revision. May return partial results on backends without health endpoints.
"rollback": gate "deploy_rollback". MUTATES the running environment to point at to_sha (reversal-only).
"status": gate "deploy_status". READ-ONLY query of the deploy state store. No write, no probe.
"site": repo_path is required and project_path resolves inside it. gate "deploy_site". LOCAL scoped git ops + a NETWORK Vercel build. The default uses only pre-staged changes; explicit paths are the only way the tool stages files. A post-push Vercel timeout returns pending with continuation identifiers instead of closing the transport.
"npm": gate "deploy_npm". A PRODUCTION DEPLOY — bumps package.json (LOCAL write), runs prepublishOnly, npm pack, then npm publish (a publicly-visible NETWORK write, effectively not undoable). dry_run=True suppresses only the final publish; the bump and pack still run. Every result is wrapped via _with_next_steps for orchestrator hints.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | Application name / project key in the deploy backend. Used by "plan", "build", "publish", "verify", "rollback", "status". Required for a real container operation. (Ignored by "site" and "npm".) | |
| env | No | Target environment, typically "staging" or "production". Used by "plan", "verify", "rollback", "status". | |
| tag | No | npm dist-tag. Used by "npm" only. Default "latest"; use "next" or a custom tag to avoid auto-installing the new version for existing users. | latest |
| bump | No | Semver bump "patch" (default) / "minor" / "major". Used by "npm" only. | patch |
| paths | No | ||
| action | No | Which deploy operation to perform. One of "plan", "build", "npm", "publish", "site", "status", "verify", "rollback". Default "status". Case/space-insensitive (lowered + stripped). Other values return a deterministic {"error": ...}. | status |
| to_sha | No | SHA to roll back to. Used by "rollback" only. None lets the backend select the previous deployed SHA. | |
| dry_run | No | If True, run the npm chain without the final publish. Used by "npm" only. Default False. | |
| git_ref | No | Git ref (branch/tag/SHA). Used by "plan", "build", "publish", "verify". Default None = backend HEAD; drives the image tag for "build". | |
| message | No | Git commit message. Used by "site" only. | |
| venture | No | ||
| repo_path | No | Required Git worktree root for every deploy action. | |
| observation | No | ||
| staged_only | No | ||
| target_urls | No | ||
| project_path | No | Repository-relative site/package directory. It must remain inside repo_path. | . |
| service_unit | No | ||
| expected_host | No | ||
| vercel_timeout | No | ||
| intended_release | No | ||
| deployment_health | No | ||
| observation_max_age_s | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||