@astra-kit/rp 0.0.0-stage → 0.10.0

package/types/constants/create-version.d.ts

@@ -0,0 +1,397 @@
+/**
+ * Git, npm, configuration and display values of the shared `astra-rp create-version` command.
+ *
+ * @module constants/create-version
+ */
+/** Branch that receives releases. */
+export declare const MAIN_BRANCH = "main";
+/** Remote that receives releases. */
+export declare const RELEASE_REMOTE = "origin";
+/** Remote-tracking ref of the release branch. */
+export declare const REMOTE_MAIN_REF = "origin/main";
+/** Configuration module read from the repository root. */
+export declare const CREATE_VERSION_CONFIG_FILE = "astra-rp.config.js";
+/**
+ * Configuration candidates in lookup order: `.mjs` is always ESM, so projects
+ * without `"type": "module"` load it without Node warnings.
+ */
+export declare const CREATE_VERSION_CONFIG_FILES: readonly string[];
+/** Manifest whose `version` is released; shared with the build gate. */
+export { PACKAGE_MANIFEST_FILE } from "./build-gate.js";
+/** Pinned Node.js version compared with the running one when present; a full version or only its major. */
+export declare const PINNED_NODE_VERSION_FILE = ".nvmrc";
+/** Environment file that may hold `NPM_TOKEN` locally; ignored by Git. */
+export declare const LOCAL_ENVIRONMENT_FILE = ".env";
+/** Environment variable that holds the npm token; the temporary npm config references it as `${NPM_TOKEN}`. */
+export declare const NPM_TOKEN_VARIABLE = "NPM_TOKEN";
+/**
+ * Path segments, relative to the user home directory (`os.homedir()`), of the environment file
+ * shared by every project: one `NPM_TOKEN` for all the repositories that release with astra-rp.
+ */
+export declare const SHARED_ENVIRONMENT_FILE_SEGMENTS: readonly string[];
+/** How the shared environment file is shown to the user, independent of the platform. */
+export declare const SHARED_ENVIRONMENT_FILE_LABEL: string;
+/** Where `NPM_TOKEN` was found, in lookup order: environment, repository `.env`, shared file. */
+export declare const NPM_TOKEN_SOURCE: Readonly<{
+    environment: "environment";
+    repository: "repository";
+    shared: "shared";
+}>;
+/** How each {@link NPM_TOKEN_SOURCE} is named in the diagnosis and the error messages; never the token. */
+export declare const NPM_TOKEN_SOURCE_LABEL: Readonly<{
+    environment: "variable de entorno";
+    repository: ".env del repo";
+    shared: string;
+}>;
+/**
+ * Result of checking the npm credentials before publishing:
+ * - `ok`: the token authenticates and its user owns the package (or it was never published); npm
+ *   cannot tell beforehand whether the token itself can write (read-only or granular tokens);
+ * - `missingToken`: no source defines `NPM_TOKEN`;
+ * - `invalidToken`: the registry rejects the token (`npm whoami` answers 401/403);
+ * - `notOwner`: the token authenticates as a user that is not an owner of the package;
+ * - `projectCredentials`: the project `.npmrc` defines credentials for the publish registry, which
+ *   npm prefers over the temporary config that binds `NPM_TOKEN`;
+ * - `unknown`: the check could not finish (network, a registry without `npm owner ls`, an
+ *   organization package whose access may come from a team); it warns but does not block.
+ */
+export declare const NPM_AUTH_STATUS: Readonly<{
+    ok: "ok";
+    missingToken: "missing-token";
+    invalidToken: "invalid-token";
+    notOwner: "not-owner";
+    projectCredentials: "project-credentials";
+    unsupportedAuth: "unsupported-auth";
+    unknown: "unknown";
+}>;
+/** npm error codes of a rejected credential: `npm whoami` fails with them for an invalid or expired token. */
+export declare const NPM_REJECTED_CREDENTIAL_PATTERN: RegExp;
+/** Where `NPM_TOKEN` can be defined, in lookup order, as the credential messages explain it. */
+export declare const NPM_TOKEN_LOCATIONS: string;
+/** Why npm answers 404 to a publication the token cannot make. */
+export declare const NPM_PUT_NOT_FOUND_NOTE = "Un 404 Not Found de npm en el PUT suele significar falta de permisos sobre el paquete (npm responde 404 en vez de 403).";
+/** Diagnosis note of an owner token: npm exposes no side-effect-free way to check its write permission. */
+export declare const NPM_WRITE_ACCESS_UNVERIFIED_NOTE = "permiso de escritura del token no verificable antes de publicar";
+/** Why a failed publication can still be the token when its user owns the package. */
+export declare const NPM_READ_ONLY_TOKEN_NOTE = "El token puede ser read-only o granular sin permiso de escritura sobre el paquete (npm no permite verificarlo antes de publicar): revisalo en npm \u2192 Access Tokens.";
+/**
+ * Next action after fixing the npm credentials reported by the diagnosis.
+ *
+ * @param {string} createVersionCommand - How the project runs create-version (`pnpm create-version`, `bun run create-version`…).
+ * @returns {string} Spanish next action.
+ */
+export declare const buildNpmAuthRerunAction: (createVersionCommand: string) => string;
+/**
+ * Next action after fixing the npm credentials once `npm publish` failed.
+ *
+ * @param {string} createVersionCommand - How the project runs create-version.
+ * @returns {string} Spanish next action.
+ */
+export declare const buildNpmPublishRetryAction: (createVersionCommand: string) => string;
+/** {@link buildNpmAuthRerunAction} of a pnpm project. */
+export declare const NPM_AUTH_RERUN_ACTION: string;
+/** {@link buildNpmPublishRetryAction} of a pnpm project. */
+export declare const NPM_PUBLISH_RETRY_ACTION: string;
+/**
+ * Option that keeps the plain text output of `npm whoami` and `npm owner ls` even when the project
+ * config or the environment enables npm's global JSON output (`json=true`, `npm_config_json=true`).
+ */
+export declare const NPM_PLAIN_OUTPUT_OPTION = "--json=false";
+/** Arguments of the npm command that prints the user a token authenticates as. */
+export declare const NPM_WHOAMI_ARGUMENTS: readonly string[];
+/** Arguments of the npm command that lists the owners of a package, followed by the package name. */
+export declare const NPM_OWNER_LIST_ARGUMENTS: readonly string[];
+/** Project npm config, read from the repository root; npm prefers it over the temporary `--userconfig`. */
+export declare const PROJECT_NPM_CONFIG_FILE = ".npmrc";
+/**
+ * npm config fields that select the HTTP credential of a registry, either bound to it
+ * (`//host/path/:_authToken`) or unbound (`_authToken`); any of them in the project `.npmrc` or in an
+ * inherited `npm_config_*` variable overrides `NPM_TOKEN`. TLS client options such as `keyfile` or
+ * `certfile` are not listed: they do not replace the token.
+ */
+export declare const NPM_CREDENTIAL_CONFIG_FIELDS: readonly string[];
+/** Prefix of the environment variables npm reads as config, in any casing (`npm_config_`, `NPM_CONFIG_`). */
+export declare const NPM_CONFIG_ENVIRONMENT_PREFIX = "npm_config_";
+/** Prefix of an npm config key bound to a registry: `//host[:port]/path/:field`. */
+export declare const NPM_REGISTRY_BOUND_KEY_PREFIX = "//";
+/** One line of `npm owner ls`: `<user> <<email>>`; the `user` group keeps the npm user name. */
+export declare const NPM_OWNER_LINE_PATTERN: RegExp;
+/** Stable identifiers of every step the command knows how to run, in execution order. */
+export declare const RELEASE_STEP: Readonly<{
+    syncMain: "sync-main";
+    applyMigrations: "apply-migrations";
+    verifyChangelog: "verify-changelog";
+    runChecks: "run-checks";
+    bumpVersion: "bump-version";
+    prepareRelease: "prepare-release";
+    pushRelease: "push-release";
+    pushReleaseTag: "push-release-tag";
+    publishRelease: "publish-release";
+}>;
+/** What the command does with the current state. */
+export declare const RELEASE_MODE: Readonly<{
+    newRelease: "new-release";
+    resume: "resume";
+    upToDate: "up-to-date";
+    blocked: "blocked";
+}>;
+/** Result of a project migrations adapter. */
+export declare const MIGRATION_STATUS: Readonly<{
+    upToDate: "up-to-date";
+    pending: "pending";
+    unknown: "unknown";
+}>;
+/** Pull request states reported by `gh pr view --json state`. */
+export declare const PULL_REQUEST_STATE: Readonly<{
+    open: "OPEN";
+    merged: "MERGED";
+    closed: "CLOSED";
+}>;
+/** Fields requested from `gh pr view`. */
+export declare const PULL_REQUEST_JSON_FIELDS = "number,url,title,state,isDraft,headRefOid";
+/** Message `gh pr view` prints when the branch has no pull request. */
+export declare const NO_PULL_REQUEST_MESSAGE_PATTERN: RegExp;
+/** Registries whose published versions drive resumes and the banner. */
+export declare const RELEASE_REGISTRY: Readonly<{
+    npm: "npm";
+    github: "github";
+    gitlab: "gitlab";
+    jsr: "jsr";
+}>;
+/** `package.json` script run as the release checks when the configuration does not set `checks`. */
+export declare const DEFAULT_CHECKS_SCRIPT = "ci";
+/** Command line of the default release checks in a pnpm project (other package managers run `<pm> run ci`). */
+export declare const DEFAULT_CHECKS_COMMAND = "pnpm run ci";
+/** Built-in publisher selected with `publish: "npm"`. */
+export declare const NPM_PUBLISHER = "npm";
+/** Result of asking npm which versions of the package exist. */
+export declare const NPM_LOOKUP_STATUS: Readonly<{
+    ok: "ok";
+    failed: "failed";
+}>;
+/** Valid npm package name (optionally scoped), checked before it reaches a shell command line. */
+export declare const NPM_PACKAGE_NAME_PATTERN: RegExp;
+/** npm error code of a package that was never published. */
+export declare const NPM_NOT_FOUND_CODE = "E404";
+/** npm dist-tag every stable release is published under. */
+export declare const NPM_DIST_TAG = "latest";
+/** Command-line flags of `astra-rp create-version`. */
+export declare const CREATE_VERSION_FLAG: Readonly<{
+    bump: "bump";
+    patch: "patch";
+    minor: "minor";
+    major: "major";
+    setVersion: "set-version";
+    dryRun: "dry-run";
+    skipUnpublished: "skip-unpublished";
+    ignoreLocalChanges: "ignore-local-changes";
+    acceptSuggested: "accept-suggested";
+    local: "local";
+    ci: "ci";
+    setupCi: "setup-ci";
+    ciRelease: "ci-release";
+    retryCi: "retry-ci";
+    help: "help";
+    /** Short flag of `--help`; public alias of the `h` entry of `CREATE_VERSION_SHORT_FLAG`. */
+    helpShort: "h";
+    endOfOptions: "--";
+}>;
+/**
+ * Short name of each release type: `--bump`/`-b` accepts it as a value (`-b m`) and it is also the
+ * short flag of the `--patch`, `--minor` and `--major` shortcuts. Case-sensitive: `m` is minor and
+ * `M` major.
+ */
+export declare const RELEASE_TYPE_SHORT_NAME: Readonly<{
+    patch: "p";
+    minor: "m";
+    major: "M";
+}>;
+/**
+ * Long flag of each short flag of `astra-rp create-version`. Short flags are whole tokens (`-sv` has
+ * two letters), so they are never grouped: `-lm` is rejected instead of read as `-l -m`. A value may
+ * follow as the next token or after `=` (`-b m`, `-b=m`, `-sv 1.3.0`, `-sv=1.3.0`).
+ */
+export declare const CREATE_VERSION_SHORT_FLAG: Readonly<{
+    b: "bump";
+    sv: "set-version";
+    p: "patch";
+    m: "minor";
+    M: "major";
+    l: "local";
+    h: "help";
+}>;
+/** Single-dash token of a short flag, with an optional `=value`: `-l`, `-sv=1.3.0`; not `--local`. */
+export declare const SHORT_FLAG_TOKEN_PATTERN: RegExp;
+/** Message of the `git stash` entry holding the changes `--ignore-local-changes` sets aside. */
+export declare const LOCAL_CHANGES_STASH_MESSAGE = "astra-rp create-version: cambios locales apartados durante el release";
+/** Optional `v` prefix accepted in hand-typed versions. */
+export declare const VERSION_PREFIX_PATTERN: RegExp;
+/** `version` field of `package.json`, replaced in place to keep formatting. */
+export declare const PACKAGE_VERSION_FIELD_PATTERN: RegExp;
+/** `git log -G` pattern of a changed top-level `version` field; the last such commit is the last release. */
+export declare const VERSION_FIELD_CHANGE_PATTERN = "\"version\"[[:space:]]*:";
+/** GitHub `owner/repo` inside an SSH or HTTPS remote URL. */
+export declare const GITHUB_REPOSITORY_PATTERN: RegExp;
+/** Separates fields inside one `git log --format` record. */
+export declare const FIELD_SEPARATOR = "\u001F";
+/** Separates records in `git log --format` output. */
+export declare const RECORD_SEPARATOR = "\u001E";
+/** Width of the `git status --porcelain` state columns before each path. */
+export declare const PORCELAIN_STATUS_WIDTH = 3;
+/** Separator between the original and the new path of a renamed or copied `git status --porcelain` entry. */
+export declare const PORCELAIN_RENAME_SEPARATOR = " -> ";
+/**
+ * Extensions of the files `--ignore-local-changes` refuses to set aside: the configuration is
+ * loaded before the changes are set aside, and it (or a hook) may import code or data from them,
+ * so the release would run with content that is not the committed one.
+ */
+export declare const UNSETTABLE_ASIDE_EXTENSIONS: readonly string[];
+/** Maximum commits listed in a box. */
+export declare const MAX_LISTED_COMMITS = 12;
+/** Maximum uncommitted files, foreign commits or pending migrations listed before summarizing. */
+export declare const MAX_LISTED_ITEMS = 5;
+/** Length of the abbreviated commit ids shown to the user: the same as in changelog entries. */
+export declare const SHORT_SHA_LENGTH = 7;
+/** Placeholders of the `artifact` pattern: the released version and the npm package name. */
+export declare const ARTIFACT_VERSION_PLACEHOLDER = "{version}";
+export declare const ARTIFACT_NAME_PLACEHOLDER = "{name}";
+/**
+ * Scope of a package name as `npm pack` and `pnpm pack` name the tarball: the
+ * leading `@` is dropped and the `/` becomes `-` (`@scope/pkg` → `scope-pkg`).
+ * The `scope` group keeps the scope without `@`.
+ */
+export declare const PACKAGE_SCOPE_PATTERN: RegExp;
+/** Replacement of {@link PACKAGE_SCOPE_PATTERN} that yields the tarball base name prefix. */
+export declare const PACKED_SCOPE_REPLACEMENT = "$<scope>-";
+/** Wildcard of an `artifact` pattern segment, such as the checksum in `releases/{version}-*`. */
+export declare const ARTIFACT_SEGMENT_WILDCARD = "*";
+/**
+ * Checksum placeholder: the SHA-256 of the archive, verified before publishing. It may repeat,
+ * in one segment or several, and every occurrence must declare the same digest.
+ */
+export declare const ARTIFACT_SHA256_PLACEHOLDER = "{sha256}";
+/** Lowercase hexadecimal SHA-256 digest matched by {@link ARTIFACT_SHA256_PLACEHOLDER}. */
+export declare const SHA256_HEX_PATTERN_SOURCE = "[0-9a-f]{64}";
+/**
+ * Characters allowed in an artifact path passed to `npm publish` through the Windows shell;
+ * `~` is allowed because npm package names (and so tarball names) may contain it.
+ */
+export declare const SAFE_ARTIFACT_PATH_PATTERN: RegExp;
+/**
+ * Prefix that makes npm read an artifact path as a local file: a bare
+ * `releases/x/pkg.tgz` operand is parsed as a package spec (a GitHub shorthand).
+ */
+export declare const LOCAL_PATH_PREFIX = "./";
+/**
+ * Arguments of the `npm pack` run that reports the integrity npm would pack from the release
+ * checkout: nothing is written and no lifecycle script runs, so it only reads what `prepare` left.
+ */
+export declare const NPM_PACK_DRY_RUN_ARGUMENTS: readonly string[];
+/**
+ * Prefix of the temporary directory, outside the package root, that holds the prepared archive
+ * while `npm pack --dry-run` runs, so npm never packs the archive into the package it describes.
+ */
+export declare const ARTIFACT_HOLDING_DIRECTORY_PREFIX = "astra-rp-artifact-";
+/** Node.js error code of a `rename` across file systems, retried as copy and delete. */
+export declare const CROSS_DEVICE_RENAME_ERROR_CODE = "EXDEV";
+/** Hash algorithm of the npm `integrity` string (`sha512-<base64>`). */
+export declare const NPM_INTEGRITY_ALGORITHM = "sha512";
+/** npm `integrity` string as `npm pack --json` reports it. */
+export declare const NPM_INTEGRITY_PATTERN: RegExp;
+/** Manifest field whose keys npm applies as configuration when it publishes. */
+export declare const PUBLISH_CONFIG_FIELD = "publishConfig";
+/**
+ * `publishConfig` keys pnpm hoists onto the packed manifest root. npm treats every
+ * `publishConfig` key as npm configuration and never rewrites manifest fields with it, so a
+ * package that declares any of these would be published differently by npm than by `pnpm pack`.
+ * Any other key (`registry`, `access`, `tag`, `provenance`, `@scope:registry`, `otp`...) is npm
+ * configuration and is accepted.
+ *
+ * Source: `PUBLISH_CONFIG_WHITELIST` in pnpm v12.6.0
+ * (`pnpm/crates/exportable-manifest/src/create.rs`; same list as
+ * `releasing/exportable-manifest/src/overridePublishConfig.ts` in pnpm 11).
+ *
+ * @see https://github.com/pnpm/pnpm/blob/v12.6.0/pnpm/crates/exportable-manifest/src/create.rs
+ * @see https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig
+ */
+export declare const PNPM_HOISTED_PUBLISH_CONFIG_KEYS: readonly string[];
+/** Dependency maps npm publishes as they are written in `package.json`. */
+export declare const PUBLISHED_DEPENDENCY_FIELDS: readonly string[];
+/**
+ * Dependency specifiers only `pnpm pack` rewrites and npm publishes verbatim, which npm then
+ * cannot install (`EUNSUPPORTEDPROTOCOL`):
+ * - `catalog:` (dereferenced to the catalog entry);
+ * - `workspace:` (resolved to the linked package version), as the whole specifier or, in
+ *   `peerDependencies`, as a segment of a compound range (`^1.0.0 || workspace:>=1.0.0`);
+ * - `jsr:` (turned into an `npm:@jsr/<scope>__<name>` alias).
+ *
+ * Source: `convert_dependency_for_publish` (catalog → workspace → jsr replacers) in pnpm v12.6.0
+ * `pnpm/crates/exportable-manifest/src/create.rs`, and `replace_workspace_protocol_peer_dependency`
+ * in `pnpm/crates/exportable-manifest/src/replace.rs`. No other protocol is rewritten there.
+ *
+ * @see https://github.com/pnpm/pnpm/blob/v12.6.0/pnpm/crates/exportable-manifest/src/create.rs
+ * @see https://github.com/pnpm/pnpm/blob/v12.6.0/pnpm/crates/exportable-manifest/src/replace.rs
+ */
+export declare const PNPM_PACK_REWRITTEN_SPECIFIER_PATTERN: RegExp;
+/** Public npm registry: npm's default, used when no config sets `@scope:registry` nor `registry`. */
+export declare const DEFAULT_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+/** Prefix of a package page on npmjs.com, linked in the summary of a release published to {@link DEFAULT_NPM_REGISTRY_URL}. */
+export declare const NPMJS_PACKAGE_PAGE_URL = "https://www.npmjs.com/package/";
+/** `publishConfig` key of the registry for every package, used when no scope-specific registry applies. */
+export declare const PUBLISH_CONFIG_REGISTRY_KEY = "registry";
+/** Suffix of the scope-specific `publishConfig` registry key, as in `@scope:registry`. */
+export declare const SCOPED_REGISTRY_KEY_SUFFIX = ":registry";
+/**
+ * Registry URL allowed on the `npm view` command line built for the Windows shell: only characters
+ * without shell meaning (no `%`, `&`, `|`, `^`, quotes or spaces), after URL normalization.
+ */
+export declare const SHELL_SAFE_REGISTRY_URL_PATTERN: RegExp;
+/** npm option that selects the registry `npm view` queries. */
+export declare const NPM_REGISTRY_OPTION = "--registry";
+/** npm option that replaces the user config (`~/.npmrc`) with the temporary one. */
+export declare const NPM_USER_CONFIG_OPTION = "--userconfig";
+/** npm subcommand that prints the effective value of a config key. */
+export declare const NPM_CONFIG_GET_ARGUMENTS: readonly string[];
+/** What `npm config get` prints for a key no config source sets, such as an unused `@scope:registry`. */
+export declare const NPM_UNSET_CONFIG_VALUE = "undefined";
+/** Protocols a publish registry URL may use. */
+export declare const NPM_REGISTRY_PROTOCOLS: readonly string[];
+/**
+ * Value of the registry credential in the temporary npm config: npm expands `${NPM_TOKEN}` from
+ * the environment, so the token never reaches the disk or a command line.
+ */
+export declare const NPM_AUTH_TOKEN_REFERENCE = "${NPM_TOKEN}";
+/** Prefix of the temporary directory holding the publish-only npm user config. */
+export declare const NPM_AUTH_DIRECTORY_PREFIX = "astra-rp-npm-auth-";
+/** Characters that could break out of a quoted path on the Windows shell. */
+export declare const UNSAFE_QUOTED_PATH_PATTERN: RegExp;
+/** Placeholder replaced by the released version in `summary` lines. */
+export declare const SUMMARY_VERSION_PLACEHOLDER = "{version}";
+/**
+ * Shown when syncing `main` brought new commits: the run ends (exit code 0, it is not a failure)
+ * so the next one loads the updated configuration and diagnoses again.
+ *
+ * @param {string} createVersionCommand - How the project runs create-version.
+ * @returns {string} Spanish message.
+ */
+export declare const buildMainSyncedRestartMessage: (createVersionCommand: string) => string;
+/** {@link buildMainSyncedRestartMessage} of a pnpm project. */
+export declare const MAIN_SYNCED_RESTART_MESSAGE: string;
+/** Exit code of a release stopped by a failed step, invalid arguments or configuration. */
+export declare const FAILURE_EXIT_CODE = 1;
+/** What each release type means when a project does not describe it. */
+export declare const DEFAULT_RELEASE_TYPE_DESCRIPTIONS: Readonly<{
+    patch: "Solo arreglos o cambios internos; nada nuevo para quien lo usa.";
+    minor: "Funcionalidades nuevas compatibles; lo existente sigue funcionando igual.";
+    major: "Cambio incompatible: quien lo usa tiene que adaptarse.";
+}>;
+/**
+ * Default descriptions while `preMajorShift` applies to a `0.x` version: each release type carries
+ * the changes of the level above (a patch ships features, a minor breaking changes) and a major
+ * leaves `0.x`.
+ */
+export declare const PRE_MAJOR_SHIFTED_RELEASE_TYPE_DESCRIPTIONS: Readonly<{
+    patch: "Arreglos o funcionalidades nuevas compatibles; lo existente sigue funcionando igual.";
+    minor: "Cambio incompatible: quien lo usa tiene que adaptarse.";
+    major: "Sale de 0.x: primera versión estable 1.0.0.";
+}>;

package/types/constants/guard-publish.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Contract of `astra-rp guard-publish`, the `prepublishOnly` guard that keeps
+ * packages from being published by a package manager other than npm.
+ *
+ * @module constants/guard-publish
+ */
+/**
+ * Environment variable package managers set for lifecycle scripts, for
+ * example `pnpm/12.6.0 npm/? node/v24.21.0 win32 x64`. npm also reads it as its
+ * `user-agent` config, so an inherited value survives `npm publish`.
+ */
+export declare const PACKAGE_MANAGER_USER_AGENT_VARIABLE = "npm_config_user_agent";
+/** User agent prefix of npm, the only package manager allowed to publish. */
+export declare const ALLOWED_PUBLISH_USER_AGENT_PREFIX = "npm/";
+/** Package managers whose `publish` is blocked, keyed by their user agent prefix. */
+export declare const BLOCKED_PUBLISH_PACKAGE_MANAGERS: Readonly<{
+    "pnpm/": "pnpm";
+    "yarn/": "yarn";
+    "bun/": "bun";
+}>;
+/** Exit codes of `astra-rp guard-publish`. */
+export declare const GUARD_PUBLISH_EXIT_CODE: Readonly<{
+    allowed: 0;
+    blocked: 1;
+}>;

package/types/constants/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Facade of every `astra-rp` constant, grouped by domain.
+ *
+ * @module constants
+ */
+export * from "./build-gate.js";
+export * from "./changelog.js";
+export * from "./cli.js";
+export * from "./guard-publish.js";
+export * from "./package-manager.js";
+export * from "./version-files.js";
+export * from "./monorepo.js";
+export * from "./terminal-ui.js";
+export * from "./versions.js";
+export * from "./create-version.js";
+export * from "./registry.js";
+export * from "./ci-release.js";

package/types/constants/monorepo.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Monorepo mode of `astra-rp create-version`: workspace discovery, per-package
+ * tags and the subject of the single release commit.
+ *
+ * @module constants/monorepo
+ */
+/** `packages` value that releases the workspaces the root `package.json` declares. */
+export declare const WORKSPACES_PACKAGES = "workspaces";
+/** Placeholders of `tagFormat`. `{version}` is required. */
+export declare const TAG_FORMAT_PLACEHOLDER: Readonly<{
+    version: "{version}";
+    /** Last directory segment of the package (`packages/widget` → `widget`). */
+    component: "{component}";
+    /** npm name of the package (`@scope/widget`). */
+    name: "{name}";
+}>;
+/** Tag of each package in monorepo mode: `widget-v1.2.0` (the release-please component tag). */
+export declare const DEFAULT_MONOREPO_TAG_FORMAT: string;
+/**
+ * Placeholder of `summary` replaced by the name of each released package in monorepo mode (next
+ * to `{version}`, its version): a line with either one is printed once per released package.
+ */
+export declare const SUMMARY_PACKAGE_PLACEHOLDER = "{name}";
+/** Prefix of the release commit subject: `release: @scope/a@1.2.0, @scope/b@0.3.1`. */
+export declare const MONOREPO_RELEASE_SUBJECT_PREFIX = "release: ";
+/** Separator of the released packages in the release commit subject. */
+export declare const MONOREPO_RELEASE_ENTRY_SEPARATOR = ", ";
+/** One `name@X.Y.Z` entry of the release commit subject; the name may be scoped. */
+export declare const MONOREPO_RELEASE_ENTRY_PATTERN: RegExp;
+/** Workspace pattern that matches every direct subdirectory: `packages/*`. */
+export declare const WORKSPACE_WILDCARD_SUFFIX = "/*";
+/** Prefix of a workspace pattern that excludes directories: `!packages/internal`. */
+export declare const WORKSPACE_EXCLUSION_PREFIX = "!";
+/** Manifest fields listing dependencies; any of them links workspace packages for change detection. */
+export declare const DEPENDENCY_FIELDS: readonly string[];
+/** Answer of the per-package version prompt that leaves the package out of this release. */
+export declare const SKIP_PACKAGE_CHOICE = "skip";
+/** Steps of a monorepo release plan (the shared ones reuse `RELEASE_STEP`). */
+export declare const MONOREPO_RELEASE_STEP: Readonly<{
+    chooseVersions: "choose-versions";
+    verifyChangelogs: "verify-changelogs";
+    bumpPackages: "bump-packages";
+    pushPackages: "push-packages";
+    publishPackages: "publish-packages";
+}>;

package/types/constants/package-manager.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Package managers a project may use and how each one runs its scripts.
+ *
+ * @module constants/package-manager
+ */
+/** Package managers astra-rp recognizes. */
+export declare const PACKAGE_MANAGER: Readonly<{
+    pnpm: "pnpm";
+    npm: "npm";
+    yarn: "yarn";
+    bun: "bun";
+}>;
+/** Package manager assumed when a project declares none and has no lockfile: the historical default. */
+export declare const DEFAULT_PACKAGE_MANAGER: "pnpm";
+/** `packageManager` field of `package.json` (Corepack format, `<name>@<version>`). */
+export declare const PACKAGE_MANAGER_FIELD = "packageManager";
+/** Name part of a `packageManager` value such as `bun@1.3.11`. */
+export declare const PACKAGE_MANAGER_FIELD_PATTERN: RegExp;
+/**
+ * Lockfiles of each package manager, checked in order to reveal the package manager when
+ * `packageManager` is missing. The generated CI workflow installs with a frozen lockfile, so it
+ * also needs one of its package manager's lockfiles committed.
+ */
+export declare const LOCKFILE_PACKAGE_MANAGERS: readonly string[][];
+/** Every lockfile name in {@link LOCKFILE_PACKAGE_MANAGERS}, whatever its package manager. */
+export declare const LOCKFILE_NAMES: readonly string[];
+/**
+ * Prefix that runs a `package.json` script by name. `bun create-version` would run `bun create`
+ * and `npm create-version` is not a command, so both need `run`; pnpm and yarn run scripts directly.
+ */
+export declare const SCRIPT_RUNNER: Readonly<{
+    pnpm: "pnpm";
+    npm: "npm run";
+    yarn: "yarn";
+    bun: "bun run";
+}>;
+/** `package.json` script projects declare to run `astra-rp create-version`. */
+export declare const CREATE_VERSION_SCRIPT = "create-version";
+/** How a pnpm project runs `astra-rp create-version`: the default quoted by messages when no project is known. */
+export declare const DEFAULT_CREATE_VERSION_COMMAND: string;

package/types/constants/registry.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Defines providers, authentication modes and transport defaults for one-registry releases.
+ *
+ * @module constants/registry
+ */
+/** npm package registry provider. */
+export declare const NPM_REGISTRY_PROVIDER = "npm";
+/** GitHub Packages provider. */
+export declare const GITHUB_REGISTRY_PROVIDER = "github";
+/** GitLab package registry provider. */
+export declare const GITLAB_REGISTRY_PROVIDER = "gitlab";
+/** Native JSR provider. */
+export declare const JSR_REGISTRY_PROVIDER = "jsr";
+/** Providers that can publish without a project-defined hook. */
+export declare const REGISTRY_PROVIDERS: readonly string[];
+/** Token-based authentication mode. */
+export declare const TOKEN_AUTHENTICATION = "token";
+/** Tokenless CI authentication mode. */
+export declare const OIDC_AUTHENTICATION = "oidc";
+/** Interactive JSR browser authentication mode. */
+export declare const BROWSER_AUTHENTICATION = "browser";
+/** Authentication modes accepted in project configuration. */
+export declare const REGISTRY_AUTHENTICATION_MODES: readonly string[];
+/** Provider names used in terminal feedback. */
+export declare const REGISTRY_LABELS: Readonly<{
+    npm: "npm";
+    github: "GitHub Packages";
+    gitlab: "GitLab";
+    jsr: "JSR";
+}>;
+/** Host of the GitHub Packages npm endpoint. */
+export declare const GITHUB_PACKAGES_HOST = "npm.pkg.github.com";
+/** Public GitHub Packages npm endpoint. */
+export declare const GITHUB_PACKAGES_REGISTRY_URL = "https://npm.pkg.github.com/";
+/** Public native JSR endpoint. */
+export declare const JSR_REGISTRY_URL = "https://jsr.io/";
+/** Hostname of JSR's npm compatibility endpoint, which installs JSR packages but cannot publish them. */
+export declare const JSR_NPM_COMPATIBILITY_HOSTNAME = "npm.jsr.io";
+/** Default credential variable for each provider. */
+export declare const NPM_REGISTRY_TOKEN_VARIABLE = "NPM_TOKEN";
+/** GitHub Actions token or a classic PAT stored under this variable. */
+export declare const GITHUB_REGISTRY_TOKEN_VARIABLE = "GITHUB_TOKEN";
+/** GitLab access token; a project may configure CI_JOB_TOKEN instead. */
+export declare const GITLAB_REGISTRY_TOKEN_VARIABLE = "GITLAB_TOKEN";
+/** Personal JSR publishing token. */
+export declare const JSR_REGISTRY_TOKEN_VARIABLE = "JSR_TOKEN";
+/** Default token variables indexed by the selected provider. */
+export declare const REGISTRY_TOKEN_VARIABLES: Readonly<{
+    npm: "NPM_TOKEN";
+    github: "GITHUB_TOKEN";
+    gitlab: "GITLAB_TOKEN";
+    jsr: "JSR_TOKEN";
+}>;
+/** Variable names safe to reference from npm configuration and child-process environments. */
+export declare const REGISTRY_TOKEN_VARIABLE_PATTERN: RegExp;
+/** Distribution tags safe to pass as one npm CLI operand. */
+export declare const REGISTRY_DIST_TAG_PATTERN: RegExp;
+/** npm access modes supported by registry publishers. */
+export declare const REGISTRY_ACCESS_MODES: readonly string[];
+/** HTTP timeout for direct metadata lookups, in milliseconds. */
+export declare const REGISTRY_LOOKUP_TIMEOUT_MS = 15000;
+/** GitLab publishing uses a project endpoint, including on self-managed instances. */
+export declare const GITLAB_PROJECT_REGISTRY_PATTERN: RegExp;
+/** JSR configuration filenames, in preferred lookup order. */
+export declare const JSR_CONFIG_FILES: readonly string[];
+/** Scoped JSR names with command-line-safe scope and package components. */
+export declare const JSR_PACKAGE_NAME_PATTERN: RegExp;
+/** Pinned official npm client used when JSR does not use an installed Deno client. */
+export declare const JSR_NPM_CLIENT_SPEC = "jsr@0.14.3";
+/** JSR client choices. */
+export declare const JSR_CLIENTS: readonly string[];
+/** Child-only JSR token variable expanded by the command shell, never logged by astra-rp. */
+export declare const JSR_CHILD_TOKEN_VARIABLE = "ASTRA_RP_JSR_TOKEN";
+/** Opaque JSR tokens safe to substitute as one shell-quoted operand. */
+export declare const JSR_SHELL_SAFE_TOKEN_PATTERN: RegExp;
+/** Minimum npm CLI version that implements trusted publishing. */
+export declare const NPM_OIDC_MINIMUM_VERSION = "11.5.1";
+/** Minimum Node version needed by npm trusted publishing. */
+export declare const NPM_OIDC_MINIMUM_NODE_VERSION = "22.14.0";