Found by the gate built for #12016 (scripts/check-cli-command-ids.mjs) on its first live run, and left unfixed there deliberately: packages/spec is not that card's lane, and its edit would pull a second package's regeneration family into a scripts/-only PR. Filed unassigned so the owning lane can take it with the evidence attached.
The defect
packages/spec/src/api/endpoint.zod.ts:39, inside STORED_BOOKKEEPING_GUIDANCE — the message an author meets when they hand-write a stored-envelope key onto an api declaration:
'... Remove it — publication state is managed by `objectstack publish`, not authored.'
objectstack publish resolves to no command. objectstack is a real declared bin (packages/cli/package.json declares both objectstack and os), but there is no publish command id: the registered publish ids are package publish and plugin publish.
That is not a guess. #11465 measured it against the built oclif Config and #12177 records the result in packages/cli/src/commands/package/publish.ts:
the registered publish ids are package publish and plugin publish, and no rollback id exists at all
os publish was the legacy direct-to-environment command, removed with the path that wrote sys_environment_revision.
Why it is worth fixing rather than declaring
#12177 declares two deliberate unresolvable ids in place, because those sentences are about the removal — accurate history that a rewrite would falsify. This one is the opposite shape. It is present tense and prescriptive: it tells an author, at the moment their write is refused, where publication state actually comes from. An author who follows it types a command that errors as unknown. Same class as items 1 and 2 in #11465, which that card fixed.
Correct spelling: os package publish — the message's own neighbouring sentence names publishPackage as the writer, and packages/cli/src/commands/package/publish.ts is the command that runs it.
Two more sites, same word, lower severity
Both are outside the #12016 gate's population by design (it scans non-comment string literals in source), so they will not be caught mechanically and need the same pass:
| Site |
Shape |
packages/spec/src/cloud/package.zod.ts:237 |
a doc comment — "the objectstack publish CLI sets it explicitly when promoting first-party or partner content" |
content/docs/api/declarative-endpoints.mdx:91 |
published prose — "Publish it (objectstack publish), and the two URLs answer" |
The objectstack validate on that same docs line is valid (validate.ts exists, objectstack is a declared bin) — only publish is stale.
Current state
The literal is carried as a baselined violation in scripts/check-cli-command-ids.mjs, printed on every green run of pnpm check:cli-command-ids and linked to this issue. The ledger self-retires: once the string is fixed the gate reds until the entry is deleted, so this cannot rot into a silent exemption.
Back-links: #12016 (the gate) · #11465 / PR #12177 (the sibling sweep inside packages/cli, which measured the id set).
Found by the gate built for #12016 (
scripts/check-cli-command-ids.mjs) on its first live run, and left unfixed there deliberately:packages/specis not that card's lane, and its edit would pull a second package's regeneration family into ascripts/-only PR. Filed unassigned so the owning lane can take it with the evidence attached.The defect
packages/spec/src/api/endpoint.zod.ts:39, insideSTORED_BOOKKEEPING_GUIDANCE— the message an author meets when they hand-write a stored-envelope key onto anapideclaration:objectstack publishresolves to no command.objectstackis a real declared bin (packages/cli/package.jsondeclares bothobjectstackandos), but there is nopublishcommand id: the registered publish ids arepackage publishandplugin publish.That is not a guess. #11465 measured it against the built oclif
Configand #12177 records the result inpackages/cli/src/commands/package/publish.ts:os publishwas the legacy direct-to-environment command, removed with the path that wrotesys_environment_revision.Why it is worth fixing rather than declaring
#12177 declares two deliberate unresolvable ids in place, because those sentences are about the removal — accurate history that a rewrite would falsify. This one is the opposite shape. It is present tense and prescriptive: it tells an author, at the moment their write is refused, where publication state actually comes from. An author who follows it types a command that errors as unknown. Same class as items 1 and 2 in #11465, which that card fixed.
Correct spelling:
os package publish— the message's own neighbouring sentence namespublishPackageas the writer, andpackages/cli/src/commands/package/publish.tsis the command that runs it.Two more sites, same word, lower severity
Both are outside the #12016 gate's population by design (it scans non-comment string literals in source), so they will not be caught mechanically and need the same pass:
packages/spec/src/cloud/package.zod.ts:237objectstack publishCLI sets it explicitly when promoting first-party or partner content"content/docs/api/declarative-endpoints.mdx:91objectstack publish), and the two URLs answer"The
objectstack validateon that same docs line is valid (validate.tsexists,objectstackis a declared bin) — onlypublishis stale.Current state
The literal is carried as a baselined violation in
scripts/check-cli-command-ids.mjs, printed on every green run ofpnpm check:cli-command-idsand linked to this issue. The ledger self-retires: once the string is fixed the gate reds until the entry is deleted, so this cannot rot into a silent exemption.Back-links: #12016 (the gate) · #11465 / PR #12177 (the sibling sweep inside
packages/cli, which measured the id set).