@deftai/directive-core 0.104.0 → 0.106.0

package/dist/release/build-dist.js

@@ -1,32 +1,43 @@
-import { createWriteStream, existsSync, mkdirSync, readdirSync, statSync, unlinkSync, } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, statSync, unlinkSync, } from "node:fs";
 import { createRequire } from "node:module";
 import { platform } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { NON_PRODUCT_DIRS } from "../fs/non-product-dirs.js";
+import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 const { ZipArchive, TarArchive } = createRequire(import.meta.url)("archiver");
-export const DEFAULT_EXCLUDES = new Set([
-    ".git",
-    "dist",
-    "backup",
-    "node_modules",
-    "__pycache__",
-    ".venv",
-    "htmlcov",
-    ".pytest_cache",
-    ".mypy_cache",
-    ".ruff_cache",
-    ".coverage",
-    "coverage",
-    // Scratch worktrees are never shippable framework content (#2953).
-    ".deft-scratch",
-    "swarm-worktrees",
-]);
+/**
+ * Shared "not product source" core (#3487) plus the coverage artifacts only the
+ * release archive names. Scratch and agent worktrees are never shippable
+ * framework content (#2953). The archive set is git-tracked files (#3490); this
+ * denylist is defence in depth, including for a tracked path under a core name.
+ *
+ * Callers may still widen this per run via `extraExcludes` / `--exclude-extra`.
+ */
+export const DEFAULT_EXCLUDES = new Set([...NON_PRODUCT_DIRS, "htmlcov", ".coverage", "coverage"]);
 export const DEFAULT_EXCLUDED_PATH_PREFIXES = [
     "history/archive",
     "vbrief/completed",
     "vbrief/cancelled",
 ];
+/**
+ * Generated outputs that may be packed even when untracked. Empty by default:
+ * the release archive is a source distribution, so extra outputs must be named
+ * explicitly (#3490).
+ */
+export const DEFAULT_GENERATED_ALLOWLIST = [];
 export const ARCHIVE_ROOT = "deft";
 export const CONTENT_PREFIX = "content/";
+/** Raised when the resolved archive set contains an untracked surprise (#3490). */
+export class UntrackedArchiveEntryError extends Error {
+    paths;
+    constructor(paths) {
+        const listed = paths.join(", ");
+        super(`build-dist: refusing to pack untracked files not on the generated-output allowlist: ${listed}`);
+        this.name = "UntrackedArchiveEntryError";
+        this.paths = paths;
+    }
+}
 const VENDORED_TS_TEST_RE = /\.(test|spec)\.(c|m)?[jt]sx?$/i;
 function flattenContentPrefix(relPosix) {
     if (relPosix === "content")
@@ -46,6 +57,362 @@ function isVendoredTsTest(relPosix) {
     const basename = relPosix.split("/").pop() ?? "";
     return VENDORED_TS_TEST_RE.test(basename);
 }
+function pathHasExcludedComponent(relPosix, excludes) {
+    return relPosix.split("/").some((part) => excludes.has(part));
+}
+function shouldSkipRel(relPosix, excludes, excludedPrefixes) {
+    return (pathHasExcludedComponent(relPosix, excludes) ||
+        matchesExcludedPrefix(relPosix, excludedPrefixes) ||
+        isVendoredTsTest(relPosix));
+}
+/** Private-use mark so archiver's string `name` can carry raw member bytes. */
+export const ARCHIVE_BINARY_NAME_MARK = "\uF000";
+export function flattenContentPrefixBytes(relBytes) {
+    const contentDir = Buffer.from("content", "utf8");
+    if (relBytes.equals(contentDir))
+        return Buffer.from(relBytes);
+    const prefix = Buffer.from(CONTENT_PREFIX, "utf8");
+    if (relBytes.length >= prefix.length && relBytes.subarray(0, prefix.length).equals(prefix)) {
+        return Buffer.from(relBytes.subarray(prefix.length));
+    }
+    return Buffer.from(relBytes);
+}
+export function isValidUtf8Buffer(buf) {
+    return Buffer.from(buf.toString("utf8"), "utf8").equals(buf);
+}
+export function archiveMemberBytes(archiveRelBytes) {
+    return Buffer.concat([Buffer.from(`${ARCHIVE_ROOT}/`, "utf8"), archiveRelBytes]);
+}
+/** Archiver `file()`/`append` name: UTF-8 text, or marked latin1 of raw bytes. */
+export function archiverEntryName(memberBytes) {
+    if (isValidUtf8Buffer(memberBytes))
+        return memberBytes.toString("utf8");
+    return `${ARCHIVE_BINARY_NAME_MARK}${memberBytes.toString("latin1")}`;
+}
+function paxRawRecord(key, value) {
+    const keyword = Buffer.from(` ${key}=`, "utf8");
+    const nl = Buffer.from("\n", "utf8");
+    let digits = 1;
+    for (;;) {
+        const total = digits + keyword.length + value.length + nl.length;
+        const lenStr = String(total);
+        if (lenStr.length === digits) {
+            return Buffer.concat([Buffer.from(lenStr, "utf8"), keyword, value, nl]);
+        }
+        digits = lenStr.length;
+    }
+}
+function loadZipArchiveEntry() {
+    const archiverReq = createRequire(import.meta.url);
+    const zipReq = createRequire(archiverReq.resolve("archiver"));
+    const commons = createRequire(zipReq.resolve("zip-stream"))("compress-commons");
+    const cls = commons.ZipArchiveEntry ?? commons.default?.ZipArchiveEntry;
+    if (cls?.prototype?.setName)
+        return cls;
+    throw new Error("build-dist: cannot load ZipArchiveEntry for byte-preserving member names");
+}
+function loadTarHeaders() {
+    const archiverReq = createRequire(import.meta.url);
+    const zipReq = createRequire(archiverReq.resolve("archiver"));
+    const tarMain = zipReq.resolve("tar-stream");
+    const loaded = createRequire(tarMain)("./headers.js");
+    if (typeof loaded.encodePax !== "function") {
+        throw new Error("build-dist: cannot load tar-stream headers.encodePax");
+    }
+    return loaded;
+}
+/**
+ * Archiver only accepts a string `name` and UTF-8-encodes it. For invalid
+ * git path bytes we mark a latin1 string and write those bytes where
+ * zip-stream / tar-stream already copy a Buffer (`setName` / PAX path).
+ */
+function installBytePreservingMemberNames() {
+    const ZipArchiveEntry = loadZipArchiveEntry();
+    const origSetName = ZipArchiveEntry.prototype.setName;
+    ZipArchiveEntry.prototype.setName = function (name, prependSlash = false) {
+        if (typeof name === "string" && name.charCodeAt(0) === ARCHIVE_BINARY_NAME_MARK.charCodeAt(0)) {
+            // Raw bytes, not UTF-8: leave the ZIP language-encoding flag off so
+            // extractors do not decode 0xFF-class names as UTF-8.
+            this.name = Buffer.from(name.slice(ARCHIVE_BINARY_NAME_MARK.length), "latin1");
+            return;
+        }
+        return origSetName.call(this, name, prependSlash);
+    };
+    const headers = loadTarHeaders();
+    const origEncodePax = headers.encodePax.bind(headers);
+    headers.encodePax = (opts) => {
+        if (typeof opts.name === "string" &&
+            opts.name.charCodeAt(0) === ARCHIVE_BINARY_NAME_MARK.charCodeAt(0)) {
+            const pathRec = paxRawRecord("path", Buffer.from(opts.name.slice(ARCHIVE_BINARY_NAME_MARK.length), "latin1"));
+            const rest = origEncodePax({ ...opts, name: undefined });
+            return Buffer.concat([pathRec, rest]);
+        }
+        return origEncodePax(opts);
+    };
+    return () => {
+        ZipArchiveEntry.prototype.setName = origSetName;
+        headers.encodePax = origEncodePax;
+    };
+}
+function addArchiveFile(archive, absPath, name) {
+    if (Buffer.isBuffer(absPath)) {
+        archive.append(createReadStream(absPath), { name });
+        return;
+    }
+    archive.file(absPath, { name });
+}
+const defaultArchiveFs = {
+    realpathSync: (path, options) => {
+        if (options?.encoding === "buffer") {
+            return realpathSync(path, { encoding: "buffer" });
+        }
+        return realpathSync(path);
+    },
+    lstatSync: (path) => lstatSync(path),
+};
+/** `-z` stdout is a NUL-separated byte stream; never UTF-8-decode it whole. */
+export const GIT_LS_FILES_Z_ENCODING = null;
+/** Decode one `ls-files -z` segment; keep non-UTF-8 bytes as latin1. */
+export function decodeGitLsFilesPath(segment) {
+    const utf8 = segment.toString("utf8");
+    if (Buffer.from(utf8, "utf8").equals(segment))
+        return utf8;
+    return segment.toString("latin1");
+}
+/** Split a raw `git ls-files -z` Buffer on 0x00, keeping original path bytes. */
+export function splitGitLsFilesZRecords(stdout) {
+    const paths = [];
+    let start = 0;
+    for (let i = 0; i < stdout.length; i += 1) {
+        if (stdout[i] === 0) {
+            if (i > start) {
+                const bytes = Buffer.from(stdout.subarray(start, i));
+                paths.push({ relPosix: decodeGitLsFilesPath(bytes), bytes });
+            }
+            start = i + 1;
+        }
+    }
+    if (start < stdout.length) {
+        const bytes = Buffer.from(stdout.subarray(start));
+        paths.push({ relPosix: decodeGitLsFilesPath(bytes), bytes });
+    }
+    return paths;
+}
+/** Split a raw `git ls-files -z` Buffer on 0x00, then decode each path. */
+export function splitGitLsFilesZ(stdout) {
+    return splitGitLsFilesZRecords(stdout).map((p) => p.relPosix);
+}
+function spawnTextFromMaybeBuffer(value) {
+    if (Buffer.isBuffer(value))
+        return value.toString("utf8");
+    return typeof value === "string" ? value : "";
+}
+function bufferFromSpawnStdout(value) {
+    if (Buffer.isBuffer(value))
+        return value;
+    if (typeof value === "string")
+        return Buffer.from(value, "utf8");
+    return Buffer.alloc(0);
+}
+/**
+ * Return `git ls-files -z` paths with original bytes. Fail closed when git
+ * cannot enumerate tracked files -- a walk would pack host-local untracked
+ * state (#3490).
+ */
+export function listGitTrackedPathRecords(root, spawn = spawnSync) {
+    // Pin to root/.git so a nested --root cannot walk up and pack a parent repo.
+    const result = spawn("git", ["-C", root, "--git-dir=.git", "--work-tree=.", "ls-files", "-z"], {
+        encoding: GIT_LS_FILES_Z_ENCODING,
+        timeout: 30_000,
+        maxBuffer: SUBPROCESS_MAX_BUFFER,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status !== 0 || result.error) {
+        const detail = spawnTextFromMaybeBuffer(result.stderr).trim() ||
+            spawnTextFromMaybeBuffer(result.stdout).trim() ||
+            result.error?.message ||
+            "unknown error";
+        throw new Error(`git ls-files failed in ${root}: ${detail}`);
+    }
+    return splitGitLsFilesZRecords(bufferFromSpawnStdout(result.stdout));
+}
+/** Return `git ls-files -z` paths in POSIX form. */
+export function listGitTrackedFiles(root, spawn = spawnSync) {
+    return listGitTrackedPathRecords(root, spawn).map((p) => p.relPosix);
+}
+/**
+ * Fail closed when any resolved archive path is untracked and not on the
+ * generated-output allowlist (#3490).
+ */
+export function assertArchiveEntriesTrackedOrGenerated(root, rels, generatedAllowlist = DEFAULT_GENERATED_ALLOWLIST, spawn = spawnSync) {
+    const tracked = new Set(listGitTrackedFiles(root, spawn));
+    const allowed = new Set(generatedAllowlist);
+    const surprise = rels.filter((rel) => !tracked.has(rel) && !allowed.has(rel));
+    if (surprise.length > 0) {
+        throw new UntrackedArchiveEntryError(surprise);
+    }
+}
+function isInsideRoot(root, absPath) {
+    const rel = relative(resolve(root), absPath);
+    return !rel.startsWith("..") && !isAbsolute(rel);
+}
+/** Canonicalize the supplied archive root once per resolve (#3490 review). */
+function canonicalArchiveRoot(root, fs) {
+    try {
+        const real = fs.realpathSync(root, { encoding: "buffer" });
+        if (Buffer.isBuffer(real)) {
+            return { text: real.toString("utf8"), bytes: real };
+        }
+        return { text: real, bytes: Buffer.from(real, "utf8") };
+    }
+    catch {
+        throw new Error(`build-dist: cannot resolve archive root: ${root}`);
+    }
+}
+/** Join canonical root bytes with original git path bytes; convert POSIX `/` to OS sep. */
+export function joinRootAndRelBytes(rootBytes, relBytes) {
+    const sepByte = sep.charCodeAt(0);
+    const converted = Buffer.from(relBytes);
+    if (sep !== "/") {
+        for (let i = 0; i < converted.length; i += 1) {
+            if (converted[i] === 0x2f)
+                converted[i] = sepByte;
+        }
+    }
+    if (converted.length === 0)
+        return rootBytes;
+    const rootEndsSep = rootBytes.length > 0 && rootBytes[rootBytes.length - 1] === sepByte;
+    const relStartsSep = converted[0] === sepByte;
+    if (rootEndsSep && relStartsSep)
+        return Buffer.concat([rootBytes, converted.subarray(1)]);
+    if (rootEndsSep || relStartsSep)
+        return Buffer.concat([rootBytes, converted]);
+    return Buffer.concat([rootBytes, Buffer.from([sepByte]), converted]);
+}
+/**
+ * String path when the `-z` segment is valid UTF-8; otherwise a Buffer that
+ * keeps the original filename bytes for fs lookup (#3490 residual).
+ */
+export function fsLookupPath(root, relPosix, bytes, rootBytes) {
+    const contained = containedAbsPath(root, relPosix);
+    if (contained === null)
+        return null;
+    if (Buffer.from(relPosix, "utf8").equals(bytes))
+        return contained;
+    return joinRootAndRelBytes(rootBytes ?? Buffer.from(resolve(root), "utf8"), bytes);
+}
+function isInsideResolved(canonicalRoot, canonicalBytes, real) {
+    if (typeof real === "string")
+        return isInsideRoot(canonicalRoot, real);
+    const sepByte = sep.charCodeAt(0);
+    if (real.equals(canonicalBytes))
+        return true;
+    const prefix = canonicalBytes.length > 0 && canonicalBytes[canonicalBytes.length - 1] === sepByte
+        ? canonicalBytes
+        : Buffer.concat([canonicalBytes, Buffer.from([sepByte])]);
+    if (real.length < prefix.length)
+        return false;
+    if (real.subarray(0, prefix.length).equals(prefix))
+        return true;
+    if (process.platform === "win32") {
+        return (real.subarray(0, prefix.length).toString("utf8").toLowerCase() ===
+            prefix.toString("utf8").toLowerCase());
+    }
+    return false;
+}
+/** Resolve a POSIX rel path under root, or null if it escapes (#3490 review). */
+export function containedAbsPath(root, relPosix) {
+    if (relPosix.includes("\0"))
+        return null;
+    // Git index paths are POSIX (`/` only). A literal `\` is a filename byte
+    // (gitglossary "path"); splitting on `\` would pack `foo\bar` as nested
+    // path segments and could escape the root. Node resolve still fail-closes
+    // OS-separator `..\` via isInsideRoot.
+    const parts = relPosix.split("/");
+    if (parts.some((part) => part === ".."))
+        return null;
+    const absPath = resolve(root, ...parts.filter((part) => part.length > 0 && part !== "."));
+    if (!isInsideRoot(root, absPath))
+        return null;
+    return absPath;
+}
+function toArchiveEntry(root, canonicalRoot, relPosix, bytes, fs) {
+    const lookup = fsLookupPath(root, relPosix, bytes, canonicalRoot.bytes);
+    if (lookup === null)
+        return null;
+    let real;
+    try {
+        // realpath resolves leaf and ancestor symlinks before the file-type check.
+        // Buffer lookup keeps invalid filename bytes; a string would re-encode UTF-8.
+        real = Buffer.isBuffer(lookup)
+            ? fs.realpathSync(lookup, { encoding: "buffer" })
+            : fs.realpathSync(lookup);
+    }
+    catch {
+        return null;
+    }
+    // Compare against the canonical root so a symlink *to* the checkout is
+    // inside, while a symlink *out of* the tree still throws.
+    if (!isInsideResolved(canonicalRoot.text, canonicalRoot.bytes, real)) {
+        throw new Error(`build-dist: path resolves outside the archive root: ${relPosix}`);
+    }
+    let st;
+    try {
+        st = fs.lstatSync(real);
+    }
+    catch {
+        return null;
+    }
+    if (st == null || !st.isFile())
+        return null;
+    return {
+        absPath: real,
+        archiveRel: flattenContentPrefix(relPosix),
+        archiveRelBytes: flattenContentPrefixBytes(bytes),
+    };
+}
+/**
+ * Derive the archive file set from git-tracked paths plus an explicit
+ * generated-output allowlist. The basename denylist remains defence in depth.
+ */
+export function resolveArchiveEntries(root, options = {}) {
+    const excludes = new Set([...DEFAULT_EXCLUDES, ...(options.extraExcludes ?? [])]);
+    const excludedPrefixes = options.excludedPrefixes ?? DEFAULT_EXCLUDED_PATH_PREFIXES;
+    const generatedAllowlist = options.generatedAllowlist ?? DEFAULT_GENERATED_ALLOWLIST;
+    const spawn = options.spawn ?? spawnSync;
+    const fs = options.fs ?? defaultArchiveFs;
+    const canonicalRoot = canonicalArchiveRoot(root, fs);
+    const tracked = listGitTrackedPathRecords(root, spawn);
+    const entries = [];
+    const sourceRels = [];
+    const seen = new Set();
+    for (const { relPosix, bytes } of tracked) {
+        if (shouldSkipRel(relPosix, excludes, excludedPrefixes))
+            continue;
+        const entry = toArchiveEntry(root, canonicalRoot, relPosix, bytes, fs);
+        if (entry === null)
+            continue;
+        entries.push(entry);
+        sourceRels.push(relPosix);
+        seen.add(relPosix);
+    }
+    for (const relPosix of generatedAllowlist) {
+        if (seen.has(relPosix))
+            continue;
+        if (containedAbsPath(root, relPosix) === null) {
+            throw new Error(`build-dist: generated allowlist path escapes the archive root: ${relPosix}`);
+        }
+        const entry = toArchiveEntry(root, canonicalRoot, relPosix, Buffer.from(relPosix, "utf8"), fs);
+        if (entry === null)
+            continue;
+        entries.push(entry);
+        sourceRels.push(relPosix);
+        seen.add(relPosix);
+    }
+    assertArchiveEntriesTrackedOrGenerated(root, sourceRels, generatedAllowlist, spawn);
+    entries.sort((a, b) => a.archiveRel.localeCompare(b.archiveRel));
+    return entries;
+}
 export function iterSourceFiles(root, excludes = DEFAULT_EXCLUDES, excludedPrefixes = DEFAULT_EXCLUDED_PATH_PREFIXES) {
     const entries = [];
     const walk = (dir) => {
@@ -121,48 +488,63 @@ function isExtraExcludesList(options) {
 function resolveBuildOptions(options = {}) {
     // Backward-compatible: 4th arg may be a bare extra-excludes array (pre-#2953).
     if (isExtraExcludesList(options)) {
-        return { extraExcludes: options, onProgress: () => { } };
+        return {
+            extraExcludes: options,
+            generatedAllowlist: DEFAULT_GENERATED_ALLOWLIST,
+            onProgress: () => { },
+            spawn: undefined,
+            fs: undefined,
+        };
     }
     return {
         extraExcludes: options.extraExcludes ?? [],
+        generatedAllowlist: options.generatedAllowlist ?? DEFAULT_GENERATED_ALLOWLIST,
         onProgress: options.onProgress ?? (() => { }),
+        spawn: options.spawn,
+        fs: options.fs,
     };
 }
 export async function buildArchive(root, version, fmt, options = {}) {
-    const { extraExcludes, onProgress } = resolveBuildOptions(options);
-    const excludes = new Set([...DEFAULT_EXCLUDES, ...extraExcludes]);
+    const { extraExcludes, generatedAllowlist, onProgress, spawn, fs } = resolveBuildOptions(options);
     const output = outputPath(root, version, fmt);
     mkdirSync(dirname(output), { recursive: true });
     if (existsSync(output)) {
         unlinkSync(output);
     }
-    onProgress({ stage: "scan", detail: "enumerating source files" });
-    const entries = iterSourceFiles(root, excludes);
+    onProgress({ stage: "scan", detail: "enumerating tracked source files" });
+    const entries = resolveArchiveEntries(root, { extraExcludes, generatedAllowlist, spawn, fs });
     const total = entries.length;
     onProgress({ stage: "scan", detail: `found ${total} files`, current: total, total });
-    await new Promise((resolvePromise, reject) => {
-        const out = createWriteStream(output);
-        const archive = fmt === "zip"
-            ? new ZipArchive({ zlib: { level: 9 } })
-            : new TarArchive({ gzip: true, gzipOptions: { level: 9 } });
-        out.on("close", () => resolvePromise());
-        out.on("error", (err) => reject(err));
-        archive.on("error", (err) => reject(err));
-        archive.pipe(out);
-        onProgress({ stage: "pack", detail: `format=${fmt}`, current: 0, total });
-        // Progress ticks every ~5% (or every 250 files) so long packs do not look hung.
-        const tickEvery = Math.max(1, Math.min(250, Math.ceil(total / 20)));
-        let i = 0;
-        for (const { absPath, archiveRel } of entries) {
-            archive.file(absPath, { name: `${ARCHIVE_ROOT}/${archiveRel}` });
-            i += 1;
-            if (i === total || i % tickEvery === 0) {
-                onProgress({ stage: "pack", current: i, total });
+    const uninstallNameHook = installBytePreservingMemberNames();
+    try {
+        await new Promise((resolvePromise, reject) => {
+            const out = createWriteStream(output);
+            const archive = fmt === "zip"
+                ? new ZipArchive({ zlib: { level: 9 } })
+                : new TarArchive({ gzip: true, gzipOptions: { level: 9 } });
+            out.on("close", () => resolvePromise());
+            out.on("error", (err) => reject(err));
+            archive.on("error", (err) => reject(err));
+            archive.pipe(out);
+            onProgress({ stage: "pack", detail: `format=${fmt}`, current: 0, total });
+            // Progress ticks every ~5% (or every 250 files) so long packs do not look hung.
+            const tickEvery = Math.max(1, Math.min(250, Math.ceil(total / 20)));
+            let i = 0;
+            for (const { absPath, archiveRel, archiveRelBytes } of entries) {
+                const memberBytes = archiveMemberBytes(archiveRelBytes ?? Buffer.from(archiveRel, "utf8"));
+                addArchiveFile(archive, absPath, archiverEntryName(memberBytes));
+                i += 1;
+                if (i === total || i % tickEvery === 0) {
+                    onProgress({ stage: "pack", current: i, total });
+                }
             }
-        }
-        onProgress({ stage: "finalize", detail: output });
-        void archive.finalize();
-    });
+            onProgress({ stage: "finalize", detail: output });
+            void archive.finalize();
+        });
+    }
+    finally {
+        uninstallNameHook();
+    }
     onProgress({ stage: "done", detail: output, current: total, total });
     return output;
 }

package/dist/release/closed-verb-gate.d.ts

@@ -0,0 +1,12 @@
+import type { ClosedVerbDecision } from "../authz/types.js";
+import type { ReleaseConfig, ReleaseSeams } from "./types.js";
+export declare const TAG_PUSH_CLOSED_VERB: "release-publish";
+export declare function evaluateReleaseTagPushGate(version: string, projectRoot: string, seams: ReleaseSeams, repo: string): ClosedVerbDecision;
+/**
+ * Fail closed before git tag + atomic tag push when skipTag is false.
+ * Dry-run and `--skip-tag` do not require a grant (no npm distribution).
+ * Returns EXIT_OK to continue, EXIT_VIOLATION to halt. Never spends the grant
+ * — draft-flip `release:publish` still owns markGrantUsed (#1095).
+ */
+export declare function assertTagPushClosedVerb(config: ReleaseConfig, seams: ReleaseSeams): number;
+//# sourceMappingURL=closed-verb-gate.d.ts.map

package/dist/release/closed-verb-gate.js

@@ -0,0 +1,51 @@
+/**
+ * Closed-verb gate on the tag-push / npm-publish boundary (#3527).
+ *
+ * Reuses the draft-flip evaluator (`evaluateReleasePublishGate`) so the
+ * distributing step carries the same authz tier. Does not delete or weaken
+ * the later `release:publish` draft-flip check.
+ */
+import { closedVerbEnvBypassKey } from "../authz/closed-verb.js";
+import { evaluateReleasePublishGate } from "../release-publish/pipeline.js";
+import { EXIT_OK, EXIT_VIOLATION, TOTAL_STEPS } from "./constants.js";
+function emitGate(label, status) {
+    process.stderr.write(`[10/${TOTAL_STEPS}] ${label}... ${status}\n`);
+}
+export const TAG_PUSH_CLOSED_VERB = "release-publish";
+export function evaluateReleaseTagPushGate(version, projectRoot, seams, repo) {
+    return evaluateReleasePublishGate(version, projectRoot, {
+        grants: seams.closedVerbGrants,
+        env: seams.closedVerbEnv,
+        repo,
+    });
+}
+/**
+ * Fail closed before git tag + atomic tag push when skipTag is false.
+ * Dry-run and `--skip-tag` do not require a grant (no npm distribution).
+ * Returns EXIT_OK to continue, EXIT_VIOLATION to halt. Never spends the grant
+ * — draft-flip `release:publish` still owns markGrantUsed (#1095).
+ */
+export function assertTagPushClosedVerb(config, seams) {
+    if (config.skipTag) {
+        return EXIT_OK;
+    }
+    const tag = `v${config.version}`;
+    const label = `Closed-verb gate ${TAG_PUSH_CLOSED_VERB} ${tag} (tag-push / npm-publish)`;
+    if (config.dryRun) {
+        emitGate(label, "DRYRUN (would require human-origin grant or DEFT_ALLOW_RELEASE_PUBLISH=1 before tag push)");
+        return EXIT_OK;
+    }
+    const gate = evaluateReleaseTagPushGate(config.version, config.projectRoot, seams, config.repo);
+    if (!gate.allowed) {
+        const bypassKey = gate.envBypassKey ??
+            closedVerbEnvBypassKey(TAG_PUSH_CLOSED_VERB, config.projectRoot) ??
+            "DEFT_ALLOW_RELEASE_PUBLISH";
+        emitGate(label, `FAIL (${gate.code}: ${gate.reason})`);
+        process.stderr.write(`[release] denied code=${gate.code} — set ${bypassKey}=1 or ` +
+            `mint \`deft authz:grant -- --template ${TAG_PUSH_CLOSED_VERB} --target ${config.version}\`\n`);
+        return EXIT_VIOLATION;
+    }
+    emitGate(label, `OK (${gate.code}${gate.humanApprovalRef !== null ? ` grant=${gate.humanApprovalRef}` : ""})`);
+    return EXIT_OK;
+}
+//# sourceMappingURL=closed-verb-gate.js.map

package/dist/release/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./auto-hatch.js";
 export * from "./build-dist.js";
+export * from "./closed-verb-gate.js";
 export * from "./constants.js";
 export * from "./coverage-debt-ledger.js";
 export * from "./flags.js";

package/dist/release/index.js

@@ -1,6 +1,7 @@
 /* v8 ignore file -- re-export barrel; covered via main.ts */
 export * from "./auto-hatch.js";
 export * from "./build-dist.js";
+export * from "./closed-verb-gate.js";
 export * from "./constants.js";
 export * from "./coverage-debt-ledger.js";
 export * from "./flags.js";

package/dist/release/pipeline.js

@@ -4,6 +4,7 @@ import { assertProjectionContained } from "../fs/projection-containment.js";
 import { readCoverageTotalsFromReport } from "../vitest-runner/coverage-debt.js";
 import { buildCoverageDebtIssueDraft, classifyStep5FailureWithFreshness, evaluateAutoHatch, formatAutoHatchBanner, parseExitCodeFromReason, reasonLooksLikeTimeout, } from "./auto-hatch.js";
 import { prependUpgradeBanner, promoteChangelog, sectionForVersion } from "./changelog.js";
+import { assertTagPushClosedVerb } from "./closed-verb-gate.js";
 import { EXIT_CONFIG_ERROR, EXIT_OK, EXIT_VIOLATION, RELEASE_ARTIFACTS, RELEASE_CHECK_TIMEOUT_MINUTES, TOTAL_STEPS, VERIFY_DRAFT_INTERVAL_SECONDS, VERIFY_DRAFT_MAX_ATTEMPTS, } from "./constants.js";
 import { createCoverageDebtIssue, probeOpenCoverageDebtLedger } from "./coverage-debt-ledger.js";
 import { checkTagAvailable, createGithubRelease, readTextFile, verifyReleaseDraft } from "./gh.js";
@@ -373,6 +374,12 @@ export function runPipeline(config, seams = {}) {
             return EXIT_VIOLATION;
         }
     }
+    // Step 10–11 boundary: closed-verb gate before tag + atomic push (#3527).
+    // npm publish fires on tag push; draft-flip `release:publish` stays (#1095).
+    const tagPushGate = assertTagPushClosedVerb(config, seams);
+    if (tagPushGate !== EXIT_OK) {
+        return tagPushGate;
+    }
     // Step 10: git tag.
     label = `Tag v${version}`;
     if (config.skipTag) {

package/dist/release/types.d.ts

@@ -1,3 +1,5 @@
+import type { EnvMap } from "../authz/closed-verb.js";
+import type { HumanOriginGrant } from "../authz/types.js";
 export interface ReleaseConfig {
     readonly version: string;
     readonly repo: string;
@@ -77,5 +79,15 @@ export interface ReleaseSeams {
     readonly headSha?: (projectRoot: string) => string | null;
     /** #3187 — CI detector; when true suite stamp is never trusted. */
     readonly isCi?: () => boolean;
+    /**
+     * #3527 — closed-verb grants for the tag-push / npm-publish gate.
+     * When omitted, production loads active human-origin grants from disk.
+     */
+    readonly closedVerbGrants?: readonly HumanOriginGrant[];
+    /**
+     * #3527 — env map for DEFT_ALLOW_RELEASE_PUBLISH. When omitted, process.env.
+     * Tests inject `{}` so a host env bypass cannot leak into fail-closed cases.
+     */
+    readonly closedVerbEnv?: EnvMap;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/render/constants.d.ts

@@ -1,6 +1,7 @@
 /** Canonical v0.6 status enum (matches `scripts/spec_validate.py`). */
 export declare const VALID_STATUSES: Set<string>;
-export declare const VALID_VBRIEF_VERSIONS: Set<string>;
+export { VALID_VBRIEF_VERSIONS } from "../vbrief-validate/constants.js";
+export { resolveInfoBlock } from "../vbrief-validate/schema.js";
 export declare const SPECIFICATION_NARRATIVE_KEY_ORDER: readonly ["Overview", "ProblemStatement", "Goals", "UserStories", "Requirements", "SuccessMetrics", "EdgeCases", "Architecture", "TechDecisions", "ImplementationPhases", "PreImplementationGates"];
 /** Migration capture narrative; omitted from default compact SPECIFICATION.md (#1566). */
 export declare const LEGACY_ARTIFACTS_NARRATIVE_KEY = "LegacyArtifacts";

package/dist/render/constants.js

@@ -10,7 +10,8 @@ export const VALID_STATUSES = new Set([
     "failed",
     "cancelled",
 ]);
-export const VALID_VBRIEF_VERSIONS = new Set(["0.6"]);
+export { VALID_VBRIEF_VERSIONS } from "../vbrief-validate/constants.js";
+export { resolveInfoBlock } from "../vbrief-validate/schema.js";
 export const SPECIFICATION_NARRATIVE_KEY_ORDER = [
     "Overview",
     "ProblemStatement",