@astra-kit/rp 0.0.0-stage → 0.10.0

package/types/constants/changelog-draft.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Contract of the `[Unreleased]` entries `create-version` drafts with an agent CLI (Claude Code or
+ * Codex) when `changelogDraft` is configured and the release would stop for a missing changelog.
+ *
+ * @module constants/changelog-draft
+ */
+/** Configuration field that turns on the drafting and orders the agent CLIs it tries. */
+export declare const CHANGELOG_DRAFT_FIELD = "changelogDraft";
+/** Agent CLIs that can draft the entries. */
+export declare const CHANGELOG_DRAFT_PROVIDER: Readonly<{
+    claude: "claude";
+    codex: "codex";
+}>;
+/** Order tried with `changelogDraft: true`: Claude Code first, Codex when Claude Code fails or has no quota left. */
+export declare const DEFAULT_CHANGELOG_DRAFT_PROVIDERS: readonly ("claude" | "codex")[];
+/** Names printed for each agent CLI. */
+export declare const CHANGELOG_DRAFT_PROVIDER_LABELS: Readonly<{
+    claude: "Claude Code";
+    codex: "Codex";
+}>;
+/** Executable of each agent CLI, resolved from `PATH`. */
+export declare const CHANGELOG_DRAFT_EXECUTABLES: Readonly<{
+    claude: "claude";
+    codex: "codex";
+}>;
+/**
+ * Prefix of the isolated workspace the agents run in: a temporary directory outside the repository,
+ * removed when the drafting ends.
+ */
+export declare const CHANGELOG_DRAFT_DIRECTORY_PREFIX = "astra-rp-changelog-draft-";
+/**
+ * Directory of the workspace with the files Git tracks at `HEAD` (from `git checkout-index`): no `.git`,
+ * no untracked or ignored files, so local credentials such as an untracked `.env` or `.npmrc` stay
+ * out of the agents' reach.
+ */
+export declare const CHANGELOG_DRAFT_SNAPSHOT_DIRECTORY = "repository";
+/** Directory of the workspace with the release context astra-rp writes for the agents. */
+export declare const CHANGELOG_DRAFT_CONTEXT_DIRECTORY = "release-context";
+/** Release context file with the diff of the release range, without the changelog itself. */
+export declare const CHANGELOG_DRAFT_DIFF_FILE = "changes.diff";
+/** Release context file with the `git log --stat` of the release range. */
+export declare const CHANGELOG_DRAFT_LOG_FILE = "commits.log";
+/** `rmSync` retries when removing the workspace, while Windows releases the files of a stopped agent. */
+export declare const WORKSPACE_REMOVAL_RETRIES: Readonly<{
+    maxRetries: 10;
+    retryDelay: 100;
+}>;
+/**
+ * Settings file, at the workspace root, that Claude Code loads with `--settings`: its file tools
+ * refuse reads outside the working directory in every permission mode, even when the user's own
+ * settings allow them.
+ */
+export declare const CLAUDE_DRAFT_SETTINGS_FILE = "claude-settings.json";
+/** Contents of {@link CLAUDE_DRAFT_SETTINGS_FILE}. */
+export declare const CLAUDE_DRAFT_SETTINGS: Readonly<{
+    permissions: Readonly<{
+        blockReadsOutsideWorkingDirectories: true;
+    }>;
+}>;
+/**
+ * Claude Code in print mode, inside the isolated workspace, with only its file tools (`Read`,
+ * `Grep`, `Glob`): no Bash, so no command can write files, and `--strict-mcp-config` without
+ * `--mcp-config` loads no MCP server. Reads inside the working directory need no approval; reads
+ * outside it need one, which `dontAsk` denies instead of asking (Claude Code documentation,
+ * "Configure permissions"), and {@link CLAUDE_DRAFT_SETTINGS_FILE} also refuses them.
+ * `--restricted` (Claude Code v2.1.248 or later) loads only managed settings and `--settings`, not
+ * the user's or the project's, so an inherited `permissions.additionalDirectories` cannot widen the
+ * reads, and confines the file tools to the working directories (Claude Code documentation, "CLI
+ * reference", https://code.claude.com/docs/en/cli-reference). `--no-session-persistence` keeps the
+ * run, with its prompt and the repository excerpts it read, off the disk and not resumable, as
+ * `--ephemeral` does for Codex. Every argument is fixed, so a Windows `.cmd` shim receives no
+ * variable path on its command line. The answer comes back as JSON.
+ */
+export declare const CLAUDE_DRAFT_ARGUMENTS: readonly string[];
+/** `--output-format json` result that reports a successful answer. */
+export declare const CLAUDE_SUCCESS_SUBTYPE = "success";
+/** File, at the workspace root, where Codex writes its last message (relative to its working directory). */
+export declare const CODEX_LAST_MESSAGE_FILE = "last-message.md";
+/**
+ * Codex in non-interactive mode inside the isolated workspace (its working directory, which is not
+ * a Git repository), sandboxed read-only, without saving the session. Its last message goes to
+ * {@link CODEX_LAST_MESSAGE_FILE} and the prompt comes from stdin (`-`). Every argument is fixed,
+ * so a Windows `.cmd` shim receives no variable path on its command line.
+ *
+ * Residual risk: Codex 0.162 documents no option that limits reads to one directory or turns off
+ * its shell tool, and `read-only` blocks writes but not reads. The workspace keeps the repository's
+ * untracked credentials away, yet Codex could still read other files of the host.
+ */
+export declare const CODEX_DRAFT_ARGUMENTS: readonly string[];
+/** Time an agent CLI has to explore the repository and answer before the next one is tried. */
+export declare const CHANGELOG_DRAFT_TIMEOUT_MS = 600000;
+/** Characters of an agent failure shown to the user. */
+export declare const CHANGELOG_DRAFT_MAX_FAILURE_CHARACTERS = 300;
+/** Markdown code fence an agent may wrap its answer in. */
+export declare const MARKDOWN_FENCE_PATTERN: RegExp;
+/**
+ * A C0 or C1 control character other than a line break or a tab, such as the ESC that starts a
+ * terminal escape sequence (OSC, CSI): an agent answer holding one is rejected before it is shown
+ * or written.
+ */
+export declare const CONTROL_CHARACTER_PATTERN: RegExp;
+/** Every character {@link CONTROL_CHARACTER_PATTERN} matches, to remove them from agent text shown in the terminal. */
+export declare const CONTROL_CHARACTERS_PATTERN: RegExp;
+/**
+ * A line a draft may hold: blank, a `### Section` heading or a complete `- ` entry. Each change is a
+ * single `- ` line, so an indented continuation of an entry is rejected.
+ */
+export declare const CHANGELOG_DRAFT_LINE_PATTERN: RegExp;
+/** An indented line that is not an entry: an entry split across several lines, which a draft must not hold. */
+export declare const CHANGELOG_DRAFT_CONTINUATION_LINE_PATTERN: RegExp;
+/** A level-2 heading such as `## [Unreleased]` or `## [1.2.0] - 2026-01-01`, which the draft must not contain. */
+export declare const RELEASE_LEVEL_HEADING_PATTERN: RegExp;
+/** A single `### Section` line of a draft, capturing the section name. */
+export declare const CHANGELOG_DRAFT_SECTION_PATTERN: RegExp;
+/** A blank line of a draft. */
+export declare const BLANK_LINE_PATTERN: RegExp;
+/** Windows command that resolves an executable on `PATH`, including the `.cmd` shims npm installs. */
+export declare const WINDOWS_EXECUTABLE_LOOKUP_COMMAND = "where";
+/** Files Windows can run; `where` also lists the extensionless shell script next to an npm `.cmd` shim. */
+export declare const WINDOWS_RUNNABLE_FILE_PATTERN: RegExp;
+/** Windows scripts that only a shell can run, such as the `claude.cmd` shim npm installs. */
+export declare const WINDOWS_SHELL_SCRIPT_PATTERN: RegExp;
+/**
+ * Characters `cmd.exe` would interpret inside a double-quoted argument: `"` ends the quotes, `%`
+ * and `!` (with delayed expansion) expand variables, and `^&|<>` are its operators. The shim path
+ * and every agent argument on a Windows shell command line are checked against it.
+ */
+export declare const UNSAFE_SHELL_ARGUMENT_PATTERN: RegExp;
+/**
+ * Temporary Git index (`GIT_INDEX_FILE`), inside the workspace, that checks out the snapshot
+ * without touching the repository index; removed once the snapshot is written.
+ */
+export declare const CHANGELOG_DRAFT_INDEX_FILE = "snapshot.index";
+/**
+ * Release context file with the working tree changelog the agents will update, so they see it
+ * even when it is untracked or only changed locally.
+ */
+export declare const CHANGELOG_DRAFT_CURRENT_CHANGELOG_FILE = "CHANGELOG.md";

package/types/constants/changelog.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Keep a Changelog contract used to read and release `CHANGELOG.md`.
+ *
+ * @module constants/changelog
+ */
+/** Changelog file released together with `package.json`. */
+export declare const CHANGELOG_FILE = "CHANGELOG.md";
+/** Blocking release condition that exits with failure until the manual changelog is updated and its `[Unreleased]` block has entries. */
+export declare const CHANGELOG_UPDATE_REQUIRED_CODE = "changelog-update-required";
+/** Default title when creating a changelog document. */
+export declare const CHANGELOG_TITLE = "# Changelog";
+/** Length of commit hashes displayed in changelog entries. */
+export declare const COMMIT_SHORT_SHA_LENGTH = 7;
+/** Heading of the block that collects changes not yet released. */
+export declare const UNRELEASED_HEADING = "## [Unreleased]";
+/** Change types allowed as `###` sections, in Keep a Changelog order. */
+export declare const CHANGE_TYPES: readonly string[];
+/** Any release-level heading: `## [Unreleased]`, `## [0.7.0] - 2026-09-26` or `## 0.6.0 - 2026-09-23`. */
+export declare const RELEASE_HEADING_PATTERN: RegExp;
+/** Unreleased heading, case-insensitive, as its own line. */
+export declare const UNRELEASED_LINE_PATTERN: RegExp;
+/** A change entry line. */
+export declare const ENTRY_LINE_PATTERN: RegExp;
+/** A change-type section heading inside a release block. */
+export declare const SECTION_HEADING_PATTERN: RegExp;
+/** Leading whitespace left before the next block after moving `[Unreleased]`. */
+export declare const LEADING_WHITESPACE_PATTERN: RegExp;
+/** Line break in a changelog written on any platform. */
+export declare const LINE_BREAK_PATTERN: RegExp;
+/** Line break of a changelog written on Windows, kept when closing `[Unreleased]`. */
+export declare const CRLF_LINE_BREAK = "\r\n";
+/** Line break of a changelog written on any other platform. */
+export declare const LF_LINE_BREAK = "\n";
+/** Separator between the year, month and day of a release date (`YYYY-MM-DD`). */
+export declare const RELEASE_DATE_SEPARATOR = "-";
+/** Digits of the month and the day of a release date. */
+export declare const RELEASE_DATE_PART_LENGTH = 2;
+/** Padding of a one-digit month or day in a release date. */
+export declare const RELEASE_DATE_PAD = "0";
+/**
+ * Locale whose `Intl.DateTimeFormat` parts are Gregorian with Latin digits, to read the year, month
+ * and day of a release in its configured time zone.
+ */
+export declare const RELEASE_DATE_LOCALE = "en-US";
+/** `Intl.DateTimeFormat` fields of a `YYYY-MM-DD` release date. */
+export declare const RELEASE_DATE_FORMAT_OPTIONS: Readonly<{
+    year: "numeric";
+    month: "2-digit";
+    day: "2-digit";
+}>;
+/** `Intl.DateTimeFormat` part types of a release date, in `YYYY-MM-DD` order. */
+export declare const RELEASE_DATE_PART_ORDER: readonly string[];
+/** Configuration field naming the IANA time zone that dates the closed `[Unreleased]` section. */
+export declare const RELEASE_TIME_ZONE_FIELD = "releaseTimeZone";
+/** IANA time zone suggested by the messages about `releaseTimeZone`. */
+export declare const RELEASE_TIME_ZONE_EXAMPLE = "America/Argentina/Buenos_Aires";

package/types/constants/ci-release.d.ts

@@ -0,0 +1,284 @@
+/**
+ * Contracts shared by local release preparation and the GitHub Actions worker.
+ * @module constants/ci-release
+ */
+/** Release execution locations offered by the CLI. */
+export declare const RELEASE_EXECUTION: Readonly<{
+    local: "local";
+    ci: "ci";
+}>;
+/** Choices offered when the repository has no CI release configuration. */
+export declare const CI_SETUP_CHOICE: Readonly<{
+    configure: "configure";
+    local: "local";
+    cancel: "cancel";
+}>;
+/** Default workflow filename, relative to GitHub's workflow directory. */
+export declare const DEFAULT_CI_WORKFLOW = "release.yml";
+/** Directory GitHub reads for versioned workflows. */
+export declare const CI_WORKFLOW_DIRECTORY = ".github/workflows";
+/** Named configuration export used by automatic setup without rewriting existing hooks. */
+export declare const CI_CONFIG_EXPORT = "ci";
+/** Workflow filenames accepted as a configuration value or CLI argument. */
+export declare const CI_WORKFLOW_NAME_PATTERN: RegExp;
+/** Environment variable names allowed in generated secret and variable bindings. */
+export declare const CI_ENVIRONMENT_NAME_PATTERN: RegExp;
+/** Full Git commit identity passed to the worker. */
+export declare const CI_COMMIT_SHA_PATTERN: RegExp;
+/** Worker inputs exposed through environment variables instead of shell interpolation. */
+export declare const CI_RELEASE_ENVIRONMENT: Readonly<{
+    version: "ASTRA_RP_RELEASE_VERSION";
+    sha: "ASTRA_RP_RELEASE_SHA";
+}>;
+/** Environment variable carrying the dispatched release tag into generated workflow steps. */
+export declare const CI_RELEASE_TAG_ENVIRONMENT = "RELEASE_TAG";
+/** Step that authenticates the dispatched tag, commit and `origin/main` ancestry before any project code runs. */
+export declare const CI_RELEASE_IDENTITY_STEP_NAME = "Verificar identidad del release";
+/** POSIX ERE equivalent of `RELEASE_VERSION_PATTERN` for the dependency-free identity step (Bash has no `\d`). */
+export declare const CI_RELEASE_VERSION_SHELL_PATTERN = "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$";
+/** Environment signals that prevent a CI worker from dispatching another workflow. */
+export declare const CI_RUNTIME_ENVIRONMENT: readonly string[];
+/** Normalized (trimmed, lowercase) CI signal values that explicitly mean "not a CI runtime"; any other non-empty value enables it. */
+export declare const CI_RUNTIME_DISABLED_VALUES: readonly string[];
+/** Relative template path from the CI setup module. */
+export declare const CI_RELEASE_TEMPLATE_FILE = "./templates/release.yml";
+/** Placeholders owned by the release workflow template. */
+export declare const CI_TEMPLATE_PLACEHOLDER: Readonly<{
+    node: "__NODE_SETUP__";
+    install: "__PACKAGE_SETUP__";
+    environment: "__RELEASE_ENVIRONMENT__";
+    permissions: "__RELEASE_PERMISSIONS__";
+    command: "__RELEASE_COMMAND__";
+    deploymentSetup: "__DEPLOYMENT_SETUP__";
+    deployment: "__DEPLOYMENT_STEP__";
+    deno: "__DENO_SETUP__";
+    identity: "__RELEASE_IDENTITY_CHECK__";
+}>;
+/** Version pin formats safe to place in generated package manager setup commands. */
+export declare const CI_PACKAGE_MANAGER_VERSION_PATTERN: RegExp;
+/** Numeric Node.js pins (`22`, `22.14`, `v22.14.0` without its `v`) that setup-node resolves to a comparable release; aliases such as `lts/*` stay unverifiable. */
+export declare const CI_NODE_VERSION_PIN_PATTERN: RegExp;
+/** Git tree modes of regular files (non-executable and executable); symlinks (`120000`) and submodules are excluded. */
+export declare const GIT_REGULAR_FILE_MODES: readonly string[];
+/** Maximum external diagnostic length displayed by the CLI, in characters. */
+export declare const CI_DIAGNOSTIC_LIMIT = 800;
+/** Credentials that must be redacted from GitHub CLI diagnostics. */
+export declare const CI_GITHUB_TOKEN_VARIABLES: readonly string[];
+/** Maximum workflow runs considered when reconciling an uncertain dispatch. */
+export declare const CI_RUN_LOOKUP_LIMIT = 100;
+/**
+ * REST resources (under `repos/{owner}/{repo}/actions/`) listing organization bindings that GitHub
+ * exposes to one repository, keyed by `gh` binding kind. Unlike `gh secret list --org`, they honor
+ * each binding's repository visibility, so they match what `${{ secrets.* }}`/`${{ vars.* }}` resolve.
+ */
+export declare const CI_ORGANIZATION_BINDING_RESOURCE: Readonly<{
+    secret: Readonly<{
+        path: "organization-secrets";
+        collection: "secrets";
+    }>;
+    variable: Readonly<{
+        path: "organization-variables";
+        collection: "variables";
+    }>;
+}>;
+/** Page size requested when listing organization bindings shared with a repository. */
+export declare const CI_ORGANIZATION_BINDING_PAGE_SIZE = 100;
+/** Git override that delegates hooks to the worker during local CI preparation. */
+export declare const CI_GIT_HOOKS_OPTION = "core.hooksPath=/dev/null";
+/** Release step that submits the already-pushed release to GitHub Actions. */
+export declare const DISPATCH_CI_RELEASE_STEP = "dispatch-ci-release";
+/** Stable failure categories of the GitHub workflow boundary. */
+export declare const CI_FAILURE_CODE: Readonly<{
+    preflight: "ci-preflight-failed";
+    lookup: "ci-run-lookup-failed";
+    dispatch: "ci-dispatch-unconfirmed";
+}>;
+/** Default Yarn Classic pin when the project does not declare a package manager version. */
+export declare const CI_DEFAULT_YARN_VERSION = "1.22.22";
+/** pnpm setup pin for repositories detected only through their lockfile. */
+export declare const CI_DEFAULT_PNPM_VERSION = "12.6.0";
+/** Deno runtime installed when JSR publication selects its native client. */
+export declare const CI_DENO_VERSION = "v2.9.7";
+/** Native JSR client that needs a Deno runtime in the generated workflow. */
+export declare const CI_DENO_JSR_CLIENT = "deno";
+/** Observable acceptance outcomes returned by the workflow adapter. */
+export declare const CI_DISPATCH_STATUS: Readonly<{
+    submitted: "submitted";
+    existing: "existing";
+}>;
+/**
+ * Prefix of the temporary directory, created inside the repository's Git directory, where `--retry-ci`
+ * checks out the release tag to load the configuration stored in it; living under the checkout lets the
+ * tagged configuration resolve the project's installed dependencies while staying outside the working tree.
+ */
+export declare const CI_RELEASE_TAG_CONFIG_DIRECTORY_PREFIX = "astra-rp-release-tag-config-";
+/** Early-build metadata; its version and the commit that changes it scope the decision to exactly one release commit. */
+export declare const CI_RELEASE_METADATA_FILE = ".astra-rp/release.json";
+/**
+ * Git trailer of the release commit naming where it was prepared (`local` or `ci`), so a resume after a
+ * failed push keeps that location for every release, not only those whose Vercel metadata records it.
+ */
+export declare const RELEASE_EXECUTION_TRAILER = "Astra-Rp-Execution";
+/** Vercel project configuration used to offer deployment setup for applications. */
+export declare const CI_VERCEL_CONFIG_FILE = "vercel.json";
+/** Provider handled by the generated application deployment steps. */
+export declare const CI_VERCEL_DEPLOYMENT = "vercel";
+/** Generated step that lets dependency installs (including `vercel build`) read GitHub Packages. */
+export declare const CI_GITHUB_PACKAGES_AUTHENTICATION_STEP = "Autenticar GitHub Packages";
+/** Step-scoped variable carrying the built-in Actions token into the GitHub Packages authentication step. */
+export declare const CI_GITHUB_PACKAGES_TOKEN_VARIABLE = "GITHUB_PACKAGES_TOKEN";
+/**
+ * User npm config key bound to GitHub Packages. The user config (`~/.npmrc`) is read by npm and pnpm (which
+ * ignores credentials in the repository `.npmrc`), the only package managers the generated workflow authenticates.
+ */
+export declare const CI_GITHUB_PACKAGES_AUTH_TOKEN_KEY = "//npm.pkg.github.com/:_authToken";
+/** Shell path of the runner's user npm config, where the generated step stores the GitHub Packages token. */
+export declare const CI_RUNNER_NPM_USER_CONFIG_PATH = "$HOME/.npmrc";
+/**
+ * Variables that locate the runner's user config outside the package managers' own settings: `HOME` (the
+ * generated step writes `$HOME/.npmrc`) and `XDG_CONFIG_HOME` (pnpm reads its global config under it). A job
+ * binding of one of them would hide the token the workflow stores there from the install.
+ */
+export declare const CI_NPM_USER_CONFIG_LOCATION_VARIABLES: readonly string[];
+/**
+ * Uppercase prefixes of the variables through which npm and pnpm (`NPM_CONFIG_*`, `PNPM_CONFIG_*`, read in any
+ * casing) take any setting from the environment, outranking the committed `.npmrc`: the registry, the user or
+ * global config file, credentials, TLS and so on. None can be proven safe before dispatch, so the generated
+ * workflow rejects every job binding with one of them whenever it hands the package manager the Actions token.
+ */
+export declare const CI_PACKAGE_MANAGER_CONFIG_VARIABLE_PREFIXES: readonly string[];
+/** Only URL protocol accepted for a GitHub Packages registry, so the workflow token never travels in clear text. */
+export declare const CI_GITHUB_PACKAGES_REGISTRY_PROTOCOL = "https:";
+/** Quote character whose wrapped `.npmrc` key or value npm's INI parser decodes as a JSON string. */
+export declare const NPM_CONFIG_JSON_QUOTE = "\"";
+/** `.npmrc` key selecting a registry, default (`registry`) or scoped (`@scope:registry`). */
+export declare const NPM_CONFIG_REGISTRY_KEY_PATTERN: RegExp;
+/**
+ * Every project `.npmrc` key bound to the GitHub Packages host, whatever its path or field (owner paths,
+ * `certfile`, pnpm's `:@scope:_authToken`, array keys...). The host must end right there (followed by `/`,
+ * `:` or nothing), so another host that only starts with the same name, such as `//npm.pkg.github.com.corp.example/`,
+ * is not bound to GitHub Packages. Only `CI_GITHUB_PACKAGES_AUTH_TOKEN_KEY` is accepted among them.
+ * The pattern spells {@link GITHUB_PACKAGES_HOST} literally, escaped for a regular expression.
+ */
+export declare const NPM_CONFIG_GITHUB_PACKAGES_KEY_PATTERN: RegExp;
+/**
+ * Package managers whose GitHub Packages install the generated workflow authenticates through the runner's `~/.npmrc`.
+ * @type {readonly import("../package-manager.js").PackageManagerName[]}
+ */
+export declare const CI_GITHUB_PACKAGES_AUTHENTICATED_PACKAGE_MANAGERS: readonly import("../package-manager.js").PackageManagerName[];
+/**
+ * Committed configuration files of the package managers the generated workflow does not authenticate, whose
+ * uncommented mention of the GitHub Packages host is a GitHub Packages signal: Yarn reads `.yarnrc` (Yarn 1) and
+ * `.yarnrc.yml` (Yarn 2+), Bun reads `bunfig.toml`. Other package managers never read them, so they are not inspected.
+ * @type {Readonly<Partial<Record<import("../package-manager.js").PackageManagerName, readonly string[]>>>}
+ */
+export declare const CI_UNAUTHENTICATED_PACKAGE_MANAGER_CONFIG_FILES: Readonly<Partial<Record<import("../package-manager.js").PackageManagerName, readonly string[]>>>;
+/** Prefix of a comment line (after trimming) in `.yarnrc`, `.yarnrc.yml`, `bunfig.toml` and `pnpm-workspace.yaml`. */
+export declare const PACKAGE_MANAGER_CONFIG_COMMENT_PREFIX = "#";
+/** Mention of the GitHub Packages host ({@link GITHUB_PACKAGES_HOST}, spelled literally) in a package manager config line, in any casing. */
+export declare const GITHUB_PACKAGES_HOST_MENTION_PATTERN: RegExp;
+/** pnpm workspace config, from which pnpm 11+ reads registries and network settings besides the `.npmrc`. */
+export declare const PNPM_WORKSPACE_CONFIG_FILE = "pnpm-workspace.yaml";
+/**
+ * `pnpm-workspace.yaml` line defining a registry or network setting (`registry`, `registries`, TLS, certificates or
+ * proxies) as a key at the start of the line, with or without indentation or quotes, followed by `:`. The generated
+ * workflow only validates registries in the `.npmrc`, so any of them could send the token somewhere unchecked.
+ */
+export declare const PNPM_WORKSPACE_NETWORK_SETTING_LINE_PATTERN: RegExp;
+/** GitHub Packages origin over plain HTTP, named in the error about a lockfile that resolves packages from it. */
+export declare const LOCKFILE_GITHUB_PACKAGES_HTTP_URL = "http://npm.pkg.github.com";
+/**
+ * {@link LOCKFILE_GITHUB_PACKAGES_HTTP_URL} inside a lockfile, matched as text in any casing. The host must end right
+ * there (followed by `/`, `:`, a quote, whitespace or the end of the text), so another host that only starts with the
+ * same name, such as `http://npm.pkg.github.com.corp.example/`, never receives the generated credential and is not matched.
+ * The pattern spells {@link GITHUB_PACKAGES_HOST} literally, escaped for a regular expression.
+ */
+export declare const LOCKFILE_GITHUB_PACKAGES_HTTP_URL_PATTERN: RegExp;
+/** `.npmrc` key that turns TLS certificate verification on or off. */
+export declare const NPM_CONFIG_STRICT_SSL_KEY = "strict-ssl";
+/** Effective `.npmrc` value that turns a boolean setting such as {@link NPM_CONFIG_STRICT_SSL_KEY} off. */
+export declare const NPM_CONFIG_DISABLED_VALUE = "false";
+/** Environment variables that turn off Node.js TLS certificate verification for every request of the install. */
+export declare const CI_TLS_VERIFICATION_DISABLING_VARIABLES: readonly string[];
+/** Indentation and marker opening each job step in the generated workflow. */
+export declare const CI_WORKFLOW_STEP_PREFIX = "      - ";
+/** Job-level binding of the built-in Actions token in the generated workflow. */
+export declare const CI_GITHUB_TOKEN_JOB_BINDING = "      GITHUB_TOKEN: ${{ github.token }}";
+/** Permission line the generated workflow adds to read or publish GitHub Packages. */
+export declare const CI_GITHUB_PACKAGES_PERMISSION_LINE_PATTERN: RegExp;
+/** Value npm's INI parser gives a `.npmrc` key written without `=`. */
+export declare const NPM_CONFIG_VALUELESS_KEY_VALUE = true;
+/** Line terminators npm's INI parser splits a `.npmrc` on: CRLF, LF or a lone CR. */
+export declare const NPM_CONFIG_LINE_BREAK_PATTERN: RegExp;
+/** `.npmrc` value that is exactly one `${NAME}` environment reference; captures the variable name. */
+export declare const NPM_CONFIG_ENVIRONMENT_REFERENCE_PATTERN: RegExp;
+/** Every `${NAME}` environment reference inside a `.npmrc` value, as npm expands them; captures each variable name. */
+export declare const NPM_CONFIG_ENVIRONMENT_REFERENCES_PATTERN: RegExp;
+/** Start of an inline comment in an unquoted `.npmrc` value (INI syntax: an unescaped `;` or `#`). */
+export declare const NPM_CONFIG_INLINE_COMMENT_PATTERN: RegExp;
+/**
+ * `.npmrc` INI section header (`[name]`), matched against the raw, untrimmed line exactly as npm's INI parser
+ * does: the bracket must open the line, the name cannot contain `]` and only whitespace may follow. npm nests
+ * every later key under that section, so those keys never configure the top-level registries or credentials;
+ * any other bracketed line (indented or malformed) is a plain key.
+ */
+export declare const NPM_CONFIG_SECTION_HEADER_PATTERN: RegExp;
+/**
+ * Suffix npm's INI parser removes from an array key (`key[]=value`), so the entry still configures `key`.
+ * Keys bound to GitHub Packages keep it, so they are always rejected instead of read as their last assignment.
+ */
+export declare const NPM_CONFIG_ARRAY_KEY_SUFFIX = "[]";
+/** Prefixes of `.npmrc` comment lines. */
+export declare const NPM_CONFIG_COMMENT_PREFIXES: readonly string[];
+/** Quote characters that may wrap a whole `.npmrc` key or value. */
+export declare const NPM_CONFIG_QUOTES: readonly string[];
+/** Vercel CLI version used by generated workflows. */
+export declare const CI_VERCEL_CLI_VERSION = "62.2.0";
+/** Repository secrets required to deploy prebuilt output to Vercel. */
+export declare const CI_VERCEL_SECRETS: readonly string[];
+/** Paths the generated Vercel worker writes after checkout; they must stay untracked to keep the release tree clean. */
+export declare const CI_VERCEL_WORKER_WRITTEN_PATHS: readonly string[];
+/** Environment names explicitly mentioned by a project's migration target hint. */
+export declare const CI_MIGRATION_ENVIRONMENT_PATTERN: RegExp;
+/** Bindings owned by the worker protocol and unavailable for user overrides. */
+export declare const CI_RESERVED_ENVIRONMENT_NAMES: readonly string[];
+/** Generated Vercel gate; it runs before dependencies are installed. */
+export declare const CI_VERCEL_GATE_FILE = ".astra-rp/vercel-ignore-build.mjs";
+/** Relative template path for the dependency-free Vercel gate. */
+export declare const CI_VERCEL_GATE_TEMPLATE = "./templates/vercel-ignore-build.mjs";
+/** Template placeholder preserving the project's original ignoreCommand. */
+export declare const CI_VERCEL_IGNORE_PLACEHOLDER = "__ORIGINAL_IGNORE_COMMAND__";
+/** Rendered workflow lines quoted when a committed generated workflow drifted from the current configuration. */
+export declare const CI_WORKFLOW_DRIFT_PREVIEW_LINES = 3;
+/**
+ * Root-relative files that shape what the CI worker runs besides the configured workflow: the
+ * configuration modules, the manifest, the project npm config, the Node.js pin and every lockfile.
+ * Local preparation reads them from the working tree while the worker checks them out from the
+ * release tag, so `--ignore-local-changes` must not set changes to them aside during CI preparation.
+ */
+export declare const CI_WORKER_CONFIGURATION_FILES: readonly string[];
+/** Prefix of the `run-name` the generated workflow gives each dispatched release, followed by its tag and commit. */
+export declare const CI_RELEASE_RUN_TITLE_PREFIX = "astra-rp release";
+/** Generated workflow step that runs `--ci-release`; its success proves checks, preparation and publication finished. */
+export declare const CI_RELEASE_WORKER_STEP_NAME = "Checks y publicaci\u00F3n del release";
+/**
+ * Environment the worker reads to query its own GitHub Actions history (set by Actions, plus the bound
+ * job token); the run id and attempt identify the attempt executing the worker, excluded from that history.
+ */
+export declare const CI_ACTIONS_HISTORY_ENVIRONMENT: Readonly<{
+    apiUrl: "GITHUB_API_URL";
+    repository: "GITHUB_REPOSITORY";
+    token: "GITHUB_TOKEN";
+    runId: "GITHUB_RUN_ID";
+    runAttempt: "GITHUB_RUN_ATTEMPT";
+}>;
+/** GitHub REST API used when the runner does not provide `GITHUB_API_URL`. */
+export declare const CI_DEFAULT_GITHUB_API_URL = "https://api.github.com";
+/** REST API version pinned for the worker's Actions history requests. */
+export declare const CI_GITHUB_API_VERSION = "2022-11-28";
+/** Page size of the worker's Actions history requests; one release has far fewer runs, attempts or jobs. */
+export declare const CI_ACTIONS_HISTORY_PAGE_SIZE = 100;
+/** Maximum wait for each Actions history request before the worker stops without publishing, in milliseconds. */
+export declare const CI_ACTIONS_HISTORY_TIMEOUT_MS = 30000;
+/** Step conclusion GitHub Actions reports for a step that finished successfully. */
+export declare const CI_STEP_SUCCESS_CONCLUSION = "success";

package/types/constants/cli.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Commands understood by the `astra-rp` command line.
+ *
+ * @module constants/cli
+ */
+/** Command names accepted as the first `astra-rp` argument. */
+export declare const CLI_COMMAND: Readonly<{
+    ignoreBuild: "ignore-build";
+    createVersion: "create-version";
+    guardPublish: "guard-publish";
+}>;