@cleocode/cleo 2026.3.56 → 2026.3.58

package/dist/dispatch/engines/release-engine.js

@@ -0,0 +1,669 @@
+/**
+ * Release Engine
+ *
+ * Thin wrapper around core release manifest operations.
+ * Business logic lives in src/core/release/release-manifest.ts.
+ *
+ * Note: Some operations (push, rollback) inherently require git CLI.
+ * Those are handled as hybrid operations - native for data, CLI for git.
+ *
+ * @task T4788
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { buildPRBody, bumpVersionFromConfig, cancelRelease, channelToDistTag, checkDoubleListing, checkEpicCompleteness, commitRelease, createPullRequest, generateReleaseChangelog, getAccessor, getGitFlowConfig, getPushMode, getVersionBumpConfig, isGhCliAvailable, listManifestReleases, loadReleaseConfig, markReleasePushed, prepareRelease, pushRelease, resolveChannelFromBranch, resolveProjectRoot, rollbackRelease, runReleaseGates, showManifestRelease, tagRelease, } from '@cleocode/core/internal';
+import { engineError } from './_error.js';
+/**
+ * Detect whether the current execution context is an AI agent.
+ * Checks for CLEO_SESSION_ID or CLAUDE_AGENT_TYPE environment variables.
+ * @task T4279
+ */
+function isAgentContext() {
+    return !!(process.env['CLEO_SESSION_ID'] || process.env['CLAUDE_AGENT_TYPE']);
+}
+/**
+ * Verify that a release manifest entry exists for the given version.
+ * Used as a protocol guard to ensure agents go through the proper
+ * release.ship workflow rather than calling release.push directly.
+ * @task T4279
+ */
+async function hasManifestEntry(version, projectRoot) {
+    try {
+        await showManifestRelease(version, projectRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Load tasks via DataAccessor (SQLite).
+ */
+async function loadTasks(projectRoot) {
+    const root = projectRoot ?? resolveProjectRoot();
+    try {
+        const accessor = await getAccessor(root);
+        const result = await accessor.queryTasks({});
+        return result?.tasks ?? [];
+    }
+    catch (error) {
+        throw new Error(`Failed to load task data: ${error.message}`);
+    }
+}
+/**
+ * release.prepare - Prepare a release
+ * @task T4788
+ */
+export async function releasePrepare(version, tasks, notes, projectRoot) {
+    try {
+        const data = await prepareRelease(version, tasks, notes, () => loadTasks(projectRoot), projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        let code = 'E_RELEASE_PREPARE_FAILED';
+        if (message.includes('required'))
+            code = 'E_INVALID_INPUT';
+        else if (message.includes('Invalid version'))
+            code = 'E_INVALID_VERSION';
+        else if (message.includes('already exists'))
+            code = 'E_VERSION_EXISTS';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.changelog - Generate changelog
+ * @task T4788
+ */
+export async function releaseChangelog(version, projectRoot) {
+    try {
+        const data = await generateReleaseChangelog(version, () => loadTasks(projectRoot), projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        let code = 'E_CHANGELOG_FAILED';
+        if (message.includes('required'))
+            code = 'E_INVALID_INPUT';
+        else if (message.includes('not found'))
+            code = 'E_NOT_FOUND';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.list - List all releases (query operation via data read)
+ * @task T4788
+ */
+export async function releaseList(optionsOrProjectRoot, projectRoot) {
+    try {
+        const options = typeof optionsOrProjectRoot === 'string' || optionsOrProjectRoot === undefined
+            ? {}
+            : optionsOrProjectRoot;
+        const effectiveProjectRoot = typeof optionsOrProjectRoot === 'string' ? optionsOrProjectRoot : projectRoot;
+        const data = await listManifestReleases(options, effectiveProjectRoot);
+        return {
+            success: true,
+            data: {
+                releases: data.releases,
+                total: data.total,
+                filtered: data.filtered,
+                latest: data.latest,
+            },
+            page: data.page,
+        };
+    }
+    catch (err) {
+        return engineError('E_LIST_FAILED', err.message);
+    }
+}
+/**
+ * release.show - Show release details (query operation via data read)
+ * @task T4788
+ */
+export async function releaseShow(version, projectRoot) {
+    try {
+        const data = await showManifestRelease(version, projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        const code = message.includes('not found') ? 'E_NOT_FOUND' : 'E_SHOW_FAILED';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.commit - Mark release as committed (metadata only)
+ * @task T4788
+ */
+export async function releaseCommit(version, projectRoot) {
+    try {
+        const data = await commitRelease(version, projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        let code = 'E_COMMIT_FAILED';
+        if (message.includes('not found'))
+            code = 'E_NOT_FOUND';
+        else if (message.includes('expected'))
+            code = 'E_INVALID_STATE';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.tag - Mark release as tagged (metadata only)
+ * @task T4788
+ */
+export async function releaseTag(version, projectRoot) {
+    try {
+        const data = await tagRelease(version, projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        const code = message.includes('not found') ? 'E_NOT_FOUND' : 'E_TAG_FAILED';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.gates.run - Run release gates (validation checks)
+ * @task T4788
+ */
+export async function releaseGatesRun(version, projectRoot) {
+    try {
+        const data = await runReleaseGates(version, () => loadTasks(projectRoot), projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        const code = message.includes('not found') ? 'E_NOT_FOUND' : 'E_GATES_FAILED';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.rollback - Rollback a release
+ * @task T4788
+ */
+export async function releaseRollback(version, reason, projectRoot) {
+    try {
+        const data = await rollbackRelease(version, reason, projectRoot);
+        return { success: true, data };
+    }
+    catch (err) {
+        const message = err.message;
+        const code = message.includes('not found') ? 'E_NOT_FOUND' : 'E_ROLLBACK_FAILED';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.cancel - Cancel and remove a release in draft or prepared state
+ * @task T5602
+ */
+export async function releaseCancel(version, projectRoot) {
+    if (!version) {
+        return engineError('E_INVALID_INPUT', 'version is required');
+    }
+    try {
+        const result = await cancelRelease(version, projectRoot);
+        if (!result.success) {
+            const code = result.message.includes('not found') ? 'E_NOT_FOUND' : 'E_INVALID_STATE';
+            return engineError(code, result.message);
+        }
+        return { success: true, data: result };
+    }
+    catch (err) {
+        const message = err.message;
+        const code = message.includes('not found') ? 'E_NOT_FOUND' : 'E_CANCEL_FAILED';
+        return engineError(code, message);
+    }
+}
+/**
+ * release.push - Push release to remote via git
+ * Uses execFileSync (no shell) for safety.
+ * Respects config.release.push policy.
+ *
+ * Agent protocol guard (T4279): When running in agent context
+ * (detected via CLEO_SESSION_ID or CLAUDE_AGENT_TYPE env vars),
+ * requires a release manifest entry for the version. This ensures
+ * agents go through the proper release.ship workflow rather than
+ * calling release.push directly, maintaining provenance tracking.
+ *
+ * @task T4788
+ * @task T4276
+ * @task T4279
+ */
+export async function releasePush(version, remote, projectRoot, opts) {
+    // Agent protocol guard: require manifest entry when in agent context
+    if (isAgentContext()) {
+        const hasEntry = await hasManifestEntry(version, projectRoot);
+        if (!hasEntry) {
+            return engineError('E_PROTOCOL_RELEASE', `Agent protocol violation: no release manifest entry for '${version}'. ` +
+                'Use the full release.ship workflow to ensure provenance tracking. ' +
+                'Direct release.push is not allowed in agent context without a manifest entry.', {
+                fix: `ct release ship ${version} --epic T####`,
+                alternatives: [
+                    {
+                        action: 'Use full ship workflow',
+                        command: `ct release ship ${version} --epic T####`,
+                    },
+                ],
+            });
+        }
+    }
+    try {
+        const result = await pushRelease(version, remote, projectRoot, opts);
+        // Capture commit SHA for provenance and update the manifest
+        let commitSha;
+        try {
+            commitSha = execFileSync('git', ['rev-parse', 'HEAD'], {
+                cwd: projectRoot ?? process.cwd(),
+                encoding: 'utf-8',
+                stdio: 'pipe',
+            })
+                .toString()
+                .trim();
+        }
+        catch {
+            // Non-fatal: provenance capture is best-effort
+        }
+        const gitTag = `v${result.version.replace(/^v/, '')}`;
+        await markReleasePushed(result.version, result.pushedAt, projectRoot, { commitSha, gitTag });
+        return { success: true, data: result };
+    }
+    catch (err) {
+        const execError = err;
+        const message = (execError.stderr ?? execError.message ?? '').slice(0, 500);
+        // Distinguish config policy errors from git errors
+        if (execError.message?.includes('disabled by config') ||
+            execError.message?.includes('not in allowed branches') ||
+            execError.message?.includes('not clean')) {
+            return engineError('E_VALIDATION', message);
+        }
+        return engineError('E_GENERAL', `Git push failed: ${message}`, {
+            details: { exitCode: execError.status },
+        });
+    }
+}
+/**
+ * release.ship - Composite release operation
+ *
+ * Sequence: validate gates → epic completeness → double-listing check →
+ * write CHANGELOG → git commit/tag/push (or PR) → record provenance
+ *
+ * @task T5582
+ * @task T5586
+ * @epic T5576
+ */
+export async function releaseShip(params, projectRoot) {
+    const { version, epicId, remote, dryRun = false, bump = true } = params;
+    if (!version) {
+        return engineError('E_INVALID_INPUT', 'version is required');
+    }
+    if (!epicId) {
+        return engineError('E_INVALID_INPUT', 'epicId is required');
+    }
+    const cwd = projectRoot ?? resolveProjectRoot();
+    /** Collected step log messages, included in every return value for MCP visibility. */
+    const steps = [];
+    /** Emit a step line for each release stage. Pushes to steps[] and console.log for CLI. */
+    const logStep = (n, total, label, done, error) => {
+        let msg;
+        if (done === undefined) {
+            msg = `[Step ${n}/${total}] ${label}...`;
+        }
+        else if (done) {
+            msg = `  ✓ ${label}`;
+        }
+        else {
+            msg = `  ✗ ${label}: ${error ?? 'failed'}`;
+        }
+        steps.push(msg);
+        console.log(msg);
+    };
+    const bumpTargets = getVersionBumpConfig(cwd);
+    const shouldBump = bump && bumpTargets.length > 0;
+    try {
+        // Step 0: Bump version files (if configured and bump not disabled)
+        if (shouldBump) {
+            logStep(0, 8, 'Bump version files');
+            if (!dryRun) {
+                const bumpResults = bumpVersionFromConfig(version, { dryRun: false }, cwd);
+                if (!bumpResults.allSuccess) {
+                    const failed = bumpResults.results.filter((r) => !r.success).map((r) => r.file);
+                    steps.push(`  ! Version bump partial: failed for ${failed.join(', ')}`);
+                }
+                else {
+                    logStep(0, 8, 'Bump version files', true);
+                }
+            }
+            else {
+                logStep(0, 8, 'Bump version files', true);
+            }
+        }
+        // Step 0.5: Ensure release record exists (auto-prepare if needed)
+        // Since T5615 removed release.add/plan, ship must be self-contained
+        try {
+            await showManifestRelease(version, cwd);
+        }
+        catch {
+            // Release record doesn't exist yet — create it
+            logStep(0, 8, 'Auto-prepare release record');
+            if (!dryRun) {
+                await prepareRelease(version, undefined, `Auto-prepared by release.ship (${epicId})`, () => loadTasks(projectRoot), cwd);
+                // Set epicId on the newly created record (prepareRelease doesn't accept it)
+                const { getDb } = await import('@cleocode/core/internal');
+                const { releaseManifests } = await import('@cleocode/core/internal');
+                const { eq } = await import('drizzle-orm');
+                const normalizedVer = version.startsWith('v') ? version : `v${version}`;
+                const db = await getDb(cwd);
+                await db
+                    .update(releaseManifests)
+                    .set({ epicId })
+                    .where(eq(releaseManifests.version, normalizedVer))
+                    .run();
+                // Pre-generate changelog so has_changelog gate passes
+                await generateReleaseChangelog(version, () => loadTasks(projectRoot), cwd);
+            }
+            logStep(0, 8, 'Auto-prepare release record', true);
+        }
+        // Step 1: Run release gates
+        logStep(1, 8, 'Validate release gates');
+        const gatesResult = await runReleaseGates(version, () => loadTasks(projectRoot), projectRoot, {
+            dryRun,
+        });
+        if (gatesResult && !gatesResult.allPassed) {
+            const failedGates = gatesResult.gates.filter((g) => g.status === 'failed');
+            logStep(1, 8, 'Validate release gates', false, failedGates.map((g) => g.name).join(', '));
+            return engineError('E_LIFECYCLE_GATE_FAILED', `Release gates failed for ${version}: ${failedGates.map((g) => g.name).join(', ')}`, {
+                details: { gates: gatesResult.gates, failedCount: gatesResult.failedCount },
+            });
+        }
+        logStep(1, 8, 'Validate release gates', true);
+        // Resolve release channel from current branch (after gates, which read the branch)
+        let resolvedChannel = 'latest';
+        let currentBranchForPR = 'HEAD';
+        try {
+            const branchName = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+                cwd,
+                encoding: 'utf-8',
+                stdio: 'pipe',
+            }).trim();
+            currentBranchForPR = branchName;
+            const channelEnum = resolveChannelFromBranch(branchName);
+            resolvedChannel = channelToDistTag(channelEnum);
+        }
+        catch {
+            // git unavailable — keep default
+        }
+        // Prefer metadata from gates result if available (B4 populates this)
+        const gateMetadata = gatesResult.metadata;
+        const requiresPRFromGates = gateMetadata?.requiresPR ?? false;
+        const targetBranchFromGates = gateMetadata?.targetBranch;
+        if (gateMetadata?.currentBranch) {
+            currentBranchForPR = gateMetadata.currentBranch;
+        }
+        // Step 2: Check epic completeness — load release tasks from manifest
+        logStep(2, 8, 'Check epic completeness');
+        let releaseTaskIds = [];
+        try {
+            const manifest = await showManifestRelease(version, projectRoot);
+            releaseTaskIds = manifest.tasks ?? [];
+        }
+        catch {
+            // Manifest may not exist yet if prepare hasn't been called; proceed
+        }
+        const epicAccessor = await getAccessor(cwd);
+        const epicCheck = await checkEpicCompleteness(releaseTaskIds, projectRoot, epicAccessor);
+        if (epicCheck.hasIncomplete) {
+            const incomplete = epicCheck.epics
+                .filter((e) => e.missingChildren.length > 0)
+                .map((e) => `${e.epicId}: missing ${e.missingChildren.map((c) => c.id).join(', ')}`)
+                .join('; ');
+            logStep(2, 8, 'Check epic completeness', false, incomplete);
+            return engineError('E_LIFECYCLE_GATE_FAILED', `Epic completeness check failed: ${incomplete}`, {
+                details: { epics: epicCheck.epics },
+            });
+        }
+        logStep(2, 8, 'Check epic completeness', true);
+        // Step 3: Check for double-listing
+        logStep(3, 8, 'Check task double-listing');
+        const allReleases = await listManifestReleases(projectRoot);
+        const existingReleases = (allReleases.releases ?? []).filter((r) => r.version !== version);
+        const doubleCheck = checkDoubleListing(releaseTaskIds, existingReleases.map((r) => ({ version: r.version, tasks: r.tasks ?? [] })));
+        if (doubleCheck.hasDoubleListing) {
+            const dupes = doubleCheck.duplicates
+                .map((d) => `${d.taskId} (in ${d.releases.join(', ')})`)
+                .join('; ');
+            logStep(3, 8, 'Check task double-listing', false, dupes);
+            return engineError('E_VALIDATION', `Double-listing detected: ${dupes}`, {
+                details: { duplicates: doubleCheck.duplicates },
+            });
+        }
+        logStep(3, 8, 'Check task double-listing', true);
+        // Resolve push mode for dry-run and PR logic
+        const loadedConfig = loadReleaseConfig(cwd);
+        const pushMode = getPushMode(loadedConfig);
+        const gitflowCfg = getGitFlowConfig(loadedConfig);
+        const targetBranch = targetBranchFromGates ?? gitflowCfg.branches.main;
+        if (dryRun) {
+            // Step 4 (dry-run): Preview CHANGELOG generation without writing to disk
+            logStep(4, 8, 'Generate CHANGELOG');
+            logStep(4, 8, 'Generate CHANGELOG', true);
+            const wouldCreatePR = requiresPRFromGates || pushMode === 'pr';
+            const filesToStagePreview = [
+                'CHANGELOG.md',
+                ...(shouldBump ? bumpTargets.map((t) => t.file) : []),
+            ];
+            const wouldDo = [];
+            if (shouldBump) {
+                wouldDo.push(`bump version files: ${bumpTargets.map((t) => t.file).join(', ')} → ${version}`);
+            }
+            wouldDo.push(`write CHANGELOG.md: ## [${version}] - ${new Date().toISOString().split('T')[0]} (preview only, not written in dry-run)`, `git add ${filesToStagePreview.join(' ')}`, `git commit -m "release: ship v${version} (${epicId})"`, `git tag -a v${version} -m "Release v${version}"`);
+            const dryRunOutput = {
+                version,
+                epicId,
+                dryRun: true,
+                channel: resolvedChannel,
+                pushMode,
+                wouldDo,
+            };
+            if (wouldCreatePR) {
+                const ghAvailable = isGhCliAvailable();
+                dryRunOutput['wouldDo'].push(ghAvailable
+                    ? `gh pr create --base ${targetBranch} --head ${currentBranchForPR} --title "release: ship v${version}"`
+                    : `manual PR: ${currentBranchForPR} → ${targetBranch} (gh CLI not available)`);
+                dryRunOutput['wouldCreatePR'] = true;
+                dryRunOutput['prTitle'] = `release: ship v${version}`;
+                dryRunOutput['prTargetBranch'] = targetBranch;
+            }
+            else {
+                dryRunOutput['wouldDo'].push(`git push ${remote ?? 'origin'} --follow-tags`);
+                dryRunOutput['wouldCreatePR'] = false;
+            }
+            dryRunOutput['wouldDo'].push('markReleasePushed(...)');
+            return { success: true, data: { ...dryRunOutput, steps } };
+        }
+        // Step 4: Write CHANGELOG section (non-dry-run only)
+        logStep(4, 8, 'Generate CHANGELOG');
+        await generateReleaseChangelog(version, () => loadTasks(projectRoot), projectRoot);
+        const changelogPath = `${cwd}/CHANGELOG.md`;
+        // Verify CHANGELOG.md actually contains ## [VERSION] — CI will reject without it
+        const cleanVersion = version.replace(/^v/, '');
+        try {
+            const changelogContent = readFileSync(changelogPath, 'utf8');
+            if (!changelogContent.includes(`## [${cleanVersion}]`)) {
+                logStep(4, 8, 'Generate CHANGELOG', false, `CHANGELOG.md missing ## [${cleanVersion}] section`);
+                return engineError('E_VALIDATION', `CHANGELOG.md does not contain ## [${cleanVersion}] after generation. ` +
+                    `This will cause the release workflow to fail.`);
+            }
+        }
+        catch (err) {
+            const msg = err.message ?? String(err);
+            logStep(4, 8, 'Generate CHANGELOG', false, `Cannot read CHANGELOG.md: ${msg}`);
+            return engineError('E_GENERAL', `Cannot read CHANGELOG.md: ${msg}`);
+        }
+        logStep(4, 8, 'Generate CHANGELOG', true);
+        // Step 4.5: Lint check — warn on biome errors but don't block release
+        try {
+            execFileSync('npx', ['biome', 'check', '--no-errors-on-unmatched', cwd], {
+                cwd,
+                encoding: 'utf-8',
+                stdio: 'pipe',
+                timeout: 30_000,
+            });
+            logStep(4, 8, 'Lint check', true);
+        }
+        catch (err) {
+            const execErr = err;
+            if (execErr.status && execErr.status > 0) {
+                const output = (execErr.stdout ?? execErr.stderr ?? '').slice(0, 500);
+                const errorMatch = output.match(/Found (\d+) error/);
+                const errorCount = errorMatch ? errorMatch[1] : 'unknown';
+                logStep(4, 8, 'Lint check', true, `${errorCount} biome warning(s) — non-blocking`);
+            }
+        }
+        // Step 5: Git commit
+        logStep(5, 8, 'Commit release');
+        const gitCwd = { cwd, encoding: 'utf-8', stdio: 'pipe' };
+        const filesToStage = ['CHANGELOG.md', ...(shouldBump ? bumpTargets.map((t) => t.file) : [])];
+        try {
+            execFileSync('git', ['add', ...filesToStage], gitCwd);
+        }
+        catch (err) {
+            const msg = err.message ?? String(err);
+            logStep(5, 8, 'Commit release', false, `git add failed: ${msg}`);
+            return engineError('E_GENERAL', `git add failed: ${msg}`);
+        }
+        try {
+            execFileSync('git', ['commit', '-m', `release: ship v${version} (${epicId})`], gitCwd);
+        }
+        catch (err) {
+            const msg = err.stderr ??
+                err.message ??
+                String(err);
+            logStep(5, 8, 'Commit release', false, `git commit failed: ${msg}`);
+            return engineError('E_GENERAL', `git commit failed: ${msg}`);
+        }
+        logStep(5, 8, 'Commit release', true);
+        let commitSha;
+        try {
+            commitSha = execFileSync('git', ['rev-parse', 'HEAD'], gitCwd).toString().trim();
+        }
+        catch {
+            // Non-fatal
+        }
+        // Step 6: Tag release
+        logStep(6, 8, 'Tag release');
+        const gitTag = `v${version.replace(/^v/, '')}`;
+        try {
+            execFileSync('git', ['tag', '-a', gitTag, '-m', `Release ${gitTag}`], gitCwd);
+        }
+        catch (err) {
+            const msg = err.stderr ??
+                err.message ??
+                String(err);
+            logStep(6, 8, 'Tag release', false, `git tag failed: ${msg}`);
+            return engineError('E_GENERAL', `git tag failed: ${msg}`);
+        }
+        logStep(6, 8, 'Tag release', true);
+        // Step 7: Push or create PR
+        logStep(7, 8, 'Push / create PR');
+        let prResult = null;
+        // First attempt the core pushRelease (which may signal requiresPR)
+        const pushResult = await pushRelease(version, remote, projectRoot, {
+            explicitPush: true,
+            mode: pushMode,
+        });
+        if (pushResult.requiresPR || requiresPRFromGates) {
+            // Branch is protected — create PR instead of direct push
+            const prBody = buildPRBody({
+                base: targetBranch,
+                head: currentBranchForPR,
+                title: `release: ship v${version}`,
+                body: '',
+                version,
+                epicId,
+                projectRoot: cwd,
+            });
+            prResult = await createPullRequest({
+                base: targetBranch,
+                head: currentBranchForPR,
+                title: `release: ship v${version}`,
+                body: prBody,
+                labels: ['release', resolvedChannel],
+                version,
+                epicId,
+                projectRoot: cwd,
+            });
+            if (prResult.mode === 'created') {
+                const m1 = `  ✓ Push / create PR`;
+                const m2 = `  PR created: ${prResult.prUrl}`;
+                const m3 = `  → Next: merge the PR, then CI will publish to npm @${resolvedChannel}`;
+                steps.push(m1, m2, m3);
+                console.log(m1);
+                console.log(m2);
+                console.log(m3);
+            }
+            else if (prResult.mode === 'skipped') {
+                const m1 = `  ✓ Push / create PR`;
+                const m2 = `  PR already exists: ${prResult.prUrl}`;
+                steps.push(m1, m2);
+                console.log(m1);
+                console.log(m2);
+            }
+            else {
+                const m1 = `  ! Push / create PR — manual PR required:`;
+                const m2 = prResult.instructions ?? '';
+                steps.push(m1, m2);
+                console.log(m1);
+                console.log(m2);
+            }
+        }
+        else {
+            // Direct push path (pushRelease already ran, but it skips the actual push
+            // when requiresPR is false — so we do the git push here directly)
+            try {
+                execFileSync('git', ['push', remote ?? 'origin', '--follow-tags'], gitCwd);
+                logStep(7, 8, 'Push / create PR', true);
+            }
+            catch (err) {
+                const execError = err;
+                const msg = (execError.stderr ?? execError.message ?? '').slice(0, 500);
+                logStep(7, 8, 'Push / create PR', false, `git push failed: ${msg}`);
+                return engineError('E_GENERAL', `git push failed: ${msg}`, {
+                    details: { exitCode: execError.status },
+                });
+            }
+        }
+        // Step 8 (internal): Record provenance
+        const pushedAt = new Date().toISOString();
+        await markReleasePushed(version, pushedAt, projectRoot, { commitSha, gitTag });
+        return {
+            success: true,
+            data: {
+                version,
+                epicId,
+                commitSha,
+                gitTag,
+                pushedAt,
+                changelog: changelogPath,
+                channel: resolvedChannel,
+                steps,
+                ...(prResult
+                    ? {
+                        pr: {
+                            mode: prResult.mode,
+                            prUrl: prResult.prUrl,
+                            prNumber: prResult.prNumber,
+                            instructions: prResult.instructions,
+                        },
+                    }
+                    : {}),
+            },
+        };
+    }
+    catch (err) {
+        return engineError('E_GENERAL', err.message ?? String(err));
+    }
+}
+//# sourceMappingURL=release-engine.js.map