@deftai/directive-core 0.55.0

package/dist/preflight-gh/classifier.js

@@ -0,0 +1,415 @@
+/**
+ * preflight-gh/classifier.ts -- Detection-bound gate for destructive gh verbs (#1019).
+ *
+ * TypeScript port of scripts/preflight_gh.py. Faithfully mirrors the Python
+ * classifier: classify_command, evaluate_command, run_self_test, and the
+ * self-test fixture table. Three-state exit:
+ *   0 -- command is allowed (not destructive) or bypass is active
+ *   1 -- command is destructive and no bypass
+ *   2 -- config error / self-test disagreement
+ */
+import * as os from "node:os";
+/** Environment variable that enables the per-shell bypass (mirrors Python). */
+export const ENV_BYPASS = "DEFT_ALLOW_DESTRUCTIVE_GH_VERBS";
+/** Default branch refs treated as protected against force-push. */
+export const DEFAULT_BRANCHES = new Set(["master", "main"]);
+const OK_VERDICT = {
+    allowed: true,
+    category: null,
+    detail: "not destructive",
+    recovery: "",
+};
+// ---------------------------------------------------------------------------
+// Tokeniser
+// ---------------------------------------------------------------------------
+/**
+ * Split a command string into argv-like tokens (POSIX shlex-equivalent).
+ *
+ * Mirrors Python's `shlex.split(command, posix=True)` but falls back to
+ * whitespace splitting on malformed quotes, same as the Python version.
+ */
+export function tokensFromString(command) {
+    const tokens = [];
+    let current = "";
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i] ?? "";
+        if (inSingle) {
+            if (ch === "'") {
+                inSingle = false;
+            }
+            else {
+                current += ch;
+            }
+        }
+        else if (inDouble) {
+            if (ch === '"') {
+                inDouble = false;
+            }
+            else if (ch === "\\") {
+                const next = command[i + 1];
+                if (next !== undefined && (next === '"' || next === "\\")) {
+                    current += next;
+                    i++;
+                }
+                else {
+                    current += ch;
+                }
+            }
+            else {
+                current += ch;
+            }
+        }
+        else if (ch === "'") {
+            inSingle = true;
+        }
+        else if (ch === '"') {
+            inDouble = true;
+        }
+        else if (/\s/.test(ch)) {
+            if (current.length > 0) {
+                tokens.push(current);
+                current = "";
+            }
+        }
+        else {
+            current += ch;
+        }
+    }
+    if (current.length > 0) {
+        tokens.push(current);
+    }
+    return tokens;
+}
+// ---------------------------------------------------------------------------
+// Classifier helpers
+// ---------------------------------------------------------------------------
+function envBypassActive() {
+    const raw = (process.env[ENV_BYPASS] ?? "").trim().toLowerCase();
+    return ["1", "true", "yes", "on"].includes(raw);
+}
+function isGhHead(token) {
+    return token.toLowerCase() === "gh" || token.toLowerCase() === "ghx";
+}
+function apiInvocationIsDelete(tokens) {
+    const valueTaking = new Set([
+        "-x",
+        "--method",
+        "-h",
+        "--header",
+        "-f",
+        "--field",
+        "-F",
+        "--raw-field",
+        "--input",
+        "--jq",
+        "-q",
+        "--template",
+        "-t",
+        "--hostname",
+        "--cache",
+    ]);
+    for (let i = 0; i < tokens.length; i++) {
+        const tok = tokens[i] ?? "";
+        const low = tok.toLowerCase();
+        if ((low === "-x" || low === "--method") &&
+            i + 1 < tokens.length &&
+            tokens[i + 1]?.toUpperCase() === "DELETE") {
+            return true;
+        }
+        if (low.startsWith("-x=") || low.startsWith("--method=")) {
+            const value = tok.split("=", 2)[1] ?? "";
+            if (value.toUpperCase() === "DELETE")
+                return true;
+        }
+        // -XDELETE combined form
+        if (low.startsWith("-x") && low.length > 2 && low.slice(2).toUpperCase() === "DELETE") {
+            return true;
+        }
+        // Skip value-taking flags (skip the value token that follows)
+        if (valueTaking.has(low) && !tok.includes("=")) {
+            i++; // skip value
+        }
+    }
+    return false;
+}
+function apiEndpoint(tokens) {
+    const valueTaking = new Set([
+        "-x",
+        "--method",
+        "-h",
+        "--header",
+        "-f",
+        "--field",
+        "-F",
+        "--raw-field",
+        "--input",
+        "--jq",
+        "-q",
+        "--template",
+        "-t",
+        "--hostname",
+        "--cache",
+    ]);
+    let i = 0;
+    while (i < tokens.length) {
+        const tok = tokens[i] ?? "";
+        if (!tok.startsWith("-")) {
+            return tok;
+        }
+        if (tok.includes("=")) {
+            i++;
+            continue;
+        }
+        // -XDELETE combined
+        if (tok.toLowerCase().startsWith("-x") && tok.length > 2) {
+            i++;
+            continue;
+        }
+        if (valueTaking.has(tok.toLowerCase()) && i + 1 < tokens.length) {
+            i += 2;
+            continue;
+        }
+        i++;
+    }
+    return null;
+}
+function endpointIsRepoRoot(endpoint) {
+    const lower = endpoint.toLowerCase();
+    // repos/<owner>/<repo> -- but not repos/.../issues/... etc.
+    // Matches: repos/owner/repo or repos/owner/repo/contents/...
+    // The Python checks: endpoint matches `repos/<owner>/<repo>` (allow sub-paths too)
+    if (!lower.startsWith("repos/"))
+        return false;
+    const parts = endpoint.split("/");
+    // repos / owner / repo [/ ...]
+    return parts.length >= 3 && (parts[1]?.length ?? 0) > 0 && (parts[2]?.length ?? 0) > 0;
+}
+// ---------------------------------------------------------------------------
+// Destructive category detectors
+// ---------------------------------------------------------------------------
+function detectDeleteRepo(tokens) {
+    if (tokens.length < 2)
+        return null;
+    const head = tokens[0] ?? "";
+    if (!isGhHead(head))
+        return null;
+    // gh repo delete <target>
+    if (tokens[1]?.toLowerCase() === "repo" &&
+        tokens.length >= 3 &&
+        tokens[2]?.toLowerCase() === "delete") {
+        const target = tokens[3] ?? "<unspecified>";
+        return {
+            allowed: false,
+            category: "delete_repo",
+            detail: `gh repo delete ${target}`,
+            recovery: [
+                "  Repo deletion is irreversible. If this is intentional:",
+                `    • set the env-var bypass for this shell:  ${ENV_BYPASS}=1`,
+                "    • or run the deletion via the GitHub web UI so the",
+                "      reversible-archive prompt fires (preferred).",
+            ].join(os.EOL),
+        };
+    }
+    // gh api ... DELETE repos/<owner>/<repo>...
+    if (tokens[1]?.toLowerCase() === "api" && apiInvocationIsDelete(tokens.slice(2))) {
+        const endpoint = apiEndpoint(tokens.slice(2));
+        if (endpoint !== null && endpointIsRepoRoot(endpoint)) {
+            return {
+                allowed: false,
+                category: "delete_repo",
+                detail: `gh api -X DELETE ${endpoint}`,
+                recovery: [
+                    "  Repo / repo-subresource deletion via the API is",
+                    "  irreversible. If this is intentional:",
+                    `    • set the env-var bypass for this shell:  ${ENV_BYPASS}=1`,
+                ].join(os.EOL),
+            };
+        }
+    }
+    return null;
+}
+function detectAdminMerge(tokens) {
+    if (tokens.length < 2)
+        return null;
+    const head = tokens[0] ?? "";
+    if (!isGhHead(head))
+        return null;
+    if (tokens[1]?.toLowerCase() !== "pr")
+        return null;
+    const hasAdmin = tokens.some((t) => t.toLowerCase() === "--admin");
+    const hasMerge = tokens.some((t) => t.toLowerCase() === "merge");
+    if (!hasMerge || !hasAdmin)
+        return null;
+    return {
+        allowed: false,
+        category: "admin_merge",
+        detail: "gh pr merge --admin",
+        recovery: [
+            "  `gh pr merge --admin` bypasses required branch-protection reviews.",
+            "  Document the rationale before using. If genuinely required:",
+            `    • set the env-var bypass for this shell:  ${ENV_BYPASS}=1`,
+        ].join(os.EOL),
+    };
+}
+function detectForcePushDefault(tokens, defaultBranches = DEFAULT_BRANCHES) {
+    if (tokens.length < 2)
+        return null;
+    const head = tokens[0] ?? "";
+    if (head.toLowerCase() !== "git")
+        return null;
+    const allTokens = tokens.slice(1);
+    // detect push sub-command
+    if (!allTokens.some((t) => t.toLowerCase() === "push"))
+        return null;
+    // detect force flags or refspec shorthand (+branch)
+    const hasForce = allTokens.some((t) => t === "--force" || t === "-f") ||
+        allTokens.some((t) => t === "--force-with-lease");
+    const hasPlus = allTokens.some((t) => t.startsWith("+") && !t.startsWith("+-"));
+    if (!hasForce && !hasPlus)
+        return null;
+    // check if targeting a default branch
+    const branchesLower = new Set([...defaultBranches].map((b) => b.toLowerCase()));
+    const targetsBranch = allTokens.some((t) => {
+        if (t.startsWith("-"))
+            return false;
+        if (t.startsWith("+")) {
+            // +master or +refs/heads/master or HEAD:master
+            const ref = t.slice(1);
+            const parts = ref.split(":");
+            const dest = parts[parts.length - 1] ?? "";
+            return (branchesLower.has(dest.toLowerCase()) ||
+                branchesLower.has(dest.replace(/^refs\/heads\//, "").toLowerCase()));
+        }
+        // HEAD:master or origin/master notation
+        if (t.includes(":")) {
+            const dest = t.split(":")[1] ?? "";
+            return (branchesLower.has(dest.toLowerCase()) ||
+                branchesLower.has(dest.replace(/^refs\/heads\//, "").toLowerCase()));
+        }
+        return (branchesLower.has(t.toLowerCase()) ||
+            branchesLower.has(t.replace(/^refs\/heads\//, "").toLowerCase()));
+    });
+    if (!targetsBranch)
+        return null;
+    const forceKind = allTokens.some((t) => t === "--force-with-lease")
+        ? "--force-with-lease"
+        : allTokens.some((t) => t.startsWith("+") && !t.startsWith("+-"))
+            ? "refspec +"
+            : "--force";
+    return {
+        allowed: false,
+        category: "force_push_default",
+        detail: `git push ${forceKind} to default branch`,
+        recovery: [
+            "  Force-pushing to the default branch is irreversible and rewrites",
+            "  public history. If genuinely required:",
+            `    • set the env-var bypass for this shell:  ${ENV_BYPASS}=1`,
+            "    • or push to a feature branch and use a PR.",
+        ].join(os.EOL),
+    };
+}
+// ---------------------------------------------------------------------------
+// Public classifier
+// ---------------------------------------------------------------------------
+/**
+ * Classify a candidate command string.
+ *
+ * Mirrors `preflight_gh.py::classify_command`. Returns a Verdict with
+ * `allowed=false` and a destructive category name, or `{allowed:true,
+ * category:null}` when the command is benign.
+ */
+export function classifyCommand(command, defaultBranches = DEFAULT_BRANCHES) {
+    const tokens = tokensFromString(command);
+    return (detectDeleteRepo(tokens) ??
+        detectAdminMerge(tokens) ??
+        detectForcePushDefault(tokens, defaultBranches) ??
+        OK_VERDICT);
+}
+/**
+ * Evaluate a single candidate command; respects the env-var bypass.
+ *
+ * Returns `[exitCode, message]` -- mirrors `preflight_gh.py::evaluate_command`.
+ */
+export function evaluateCommand(command, defaultBranches = DEFAULT_BRANCHES) {
+    if (envBypassActive()) {
+        return [
+            0,
+            `⚠ deft destructive-gh-verb gate: ${ENV_BYPASS}=1 is set -- policy bypassed for this invocation.`,
+        ];
+    }
+    const verdict = classifyCommand(command, defaultBranches);
+    if (verdict.allowed) {
+        return [0, `✓ deft destructive-gh-verb gate: '${command}' -- not destructive.`];
+    }
+    const msg = [
+        `❌ deft destructive-gh-verb gate: refusing '${command}'.`,
+        `  Category: ${verdict.category}`,
+        `  Detail: ${verdict.detail}`,
+        verdict.recovery,
+    ]
+        .filter((l) => l.length > 0)
+        .join(os.EOL);
+    return [1, msg];
+}
+export const SELF_TEST_CASES = [
+    // delete_repo positives
+    ["gh repo delete deftai/directive", "delete_repo"],
+    ["gh repo delete deftai/directive --yes", "delete_repo"],
+    ["gh api -X DELETE repos/deftai/directive", "delete_repo"],
+    ["gh api --method DELETE repos/deftai/directive/contents/README.md", "delete_repo"],
+    ["gh api -XDELETE repos/deftai/directive", "delete_repo"],
+    // admin_merge positives
+    ["gh pr merge 123 --admin", "admin_merge"],
+    ["gh pr merge --admin --squash 123", "admin_merge"],
+    // force_push_default positives
+    ["git push --force origin master", "force_push_default"],
+    ["git push origin --force-with-lease main", "force_push_default"],
+    ["git push origin +master", "force_push_default"],
+    ["git push --force origin HEAD:master", "force_push_default"],
+    // Negatives -- benign commands MUST classify as allowed.
+    ["gh pr merge 123 --squash", null],
+    ["gh repo view deftai/directive", null],
+    ["gh api repos/deftai/directive", null],
+    ["gh api -X PATCH repos/deftai/directive/issues/1", null],
+    ["git push origin feat/my-branch", null],
+    ["git push --force origin feat/my-branch", null],
+    ["git push --force-with-lease origin feat/my-branch", null],
+    ["git push", null],
+    ["gh pr create --title Test --body foo", null],
+];
+/**
+ * Run every self-test fixture through the classifier.
+ *
+ * @param fixtures - Optional override fixture table (defaults to SELF_TEST_CASES).
+ *   Inject a contrived table in tests to exercise the failure-path branch.
+ *
+ * Returns `[exitCode, message]`. Exit 0 = all pass; exit 2 = disagreement
+ * (config error / classifier drift) -- mirrors `preflight_gh.py::run_self_test`.
+ */
+export function runSelfTest(fixtures) {
+    const cases = fixtures ?? SELF_TEST_CASES;
+    const failures = [];
+    for (const [command, expected] of cases) {
+        const verdict = classifyCommand(command);
+        const observed = verdict.allowed ? null : verdict.category;
+        if (observed !== expected) {
+            failures.push(`  ✗ ${JSON.stringify(command)} -- expected category=${JSON.stringify(expected)} but got category=${JSON.stringify(observed)} (detail=${JSON.stringify(verdict.detail)})`);
+        }
+    }
+    if (failures.length > 0) {
+        return [
+            2,
+            [
+                `❌ deft destructive-gh-verb gate (self-test): classifier disagreement on ${failures.length}/${cases.length} fixture(s).`,
+                ...failures,
+            ].join(os.EOL),
+        ];
+    }
+    return [
+        0,
+        `✓ deft destructive-gh-verb gate (self-test): ${cases.length}/${cases.length} fixtures classified as expected.`,
+    ];
+}
+//# sourceMappingURL=classifier.js.map

package/dist/preflight-gh/index.d.ts

@@ -0,0 +1,3 @@
+export type { Verdict } from "./classifier.js";
+export { classifyCommand, DEFAULT_BRANCHES, ENV_BYPASS, evaluateCommand, runSelfTest, SELF_TEST_CASES, tokensFromString, } from "./classifier.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/preflight-gh/index.js

@@ -0,0 +1,2 @@
+export { classifyCommand, DEFAULT_BRANCHES, ENV_BYPASS, evaluateCommand, runSelfTest, SELF_TEST_CASES, tokensFromString, } from "./classifier.js";
+//# sourceMappingURL=index.js.map

package/dist/release/changelog.d.ts

@@ -0,0 +1,9 @@
+/** Split CHANGELOG content into (body, link-footer). */
+export declare function splitBodyAndLinks(text: string): [string, string];
+/** Promote [Unreleased] to [<version>] - <today> and refresh the link footer. */
+export declare function promoteChangelog(text: string, version: string, repo: string, today: string, summary?: string | null): string;
+/** Extract the body of ## [<version>] - <date> for use as release notes. */
+export declare function sectionForVersion(text: string, version: string): string;
+/** Lead maintainer-mode GitHub release notes with the upgrade banner (#1413). */
+export declare function prependUpgradeBanner(notes: string, repo: string, projectRoot: string, readText: (path: string) => string | null): string;
+//# sourceMappingURL=changelog.d.ts.map

package/dist/release/changelog.js

@@ -0,0 +1,105 @@
+import { DEFAULT_REPO, FRESH_UNRELEASED_BLOCK, UNRELEASED_LINK_RE, UNRELEASED_RE, UPGRADE_BANNER_RELPATH, } from "./constants.js";
+/** Split CHANGELOG content into (body, link-footer). */
+export function splitBodyAndLinks(text) {
+    const lines = text.split(/(?<=\n)/);
+    let firstLinkIdx = null;
+    for (let idx = 0; idx < lines.length; idx += 1) {
+        const line = lines[idx] ?? "";
+        if (line.startsWith("[Unreleased]:") || /^\[\d+\.\d+\.\d+\]:/.test(line)) {
+            firstLinkIdx = idx;
+            break;
+        }
+    }
+    if (firstLinkIdx === null) {
+        return [text, ""];
+    }
+    return [lines.slice(0, firstLinkIdx).join(""), lines.slice(firstLinkIdx).join("")];
+}
+function extractPreviousVersion(footer) {
+    const match = UNRELEASED_LINK_RE.exec(footer);
+    return match?.groups?.prev ?? null;
+}
+/** Promote [Unreleased] to [<version>] - <today> and refresh the link footer. */
+export function promoteChangelog(text, version, repo, today, summary = null) {
+    if (!UNRELEASED_RE.test(text)) {
+        throw new Error("CHANGELOG.md does not contain a '## [Unreleased]' heading.");
+    }
+    if (summary !== null && (summary.includes("\n") || summary.includes("\r"))) {
+        throw new Error("--summary is single-line; got embedded newline. " +
+            "Author the blockquote on a single line.");
+    }
+    const [body, footer] = splitBodyAndLinks(text);
+    let promotedHeading = `## [${version}] - ${today}`;
+    if (summary) {
+        promotedHeading = `${promotedHeading}\n\n> ${summary}\n`;
+    }
+    const freshBlock = `${FRESH_UNRELEASED_BLOCK.trimEnd()}\n\n`;
+    const replacement = freshBlock + promotedHeading;
+    const newBody = body.replace(UNRELEASED_RE, () => replacement);
+    if (newBody === body) {
+        throw new Error("Failed to locate exactly one '## [Unreleased]' heading.");
+    }
+    const prev = extractPreviousVersion(footer);
+    const newUnreleasedLink = `[Unreleased]: https://github.com/${repo}/compare/v${version}...HEAD`;
+    const versionLink = prev
+        ? `[${version}]: https://github.com/${repo}/compare/v${prev}...v${version}`
+        : `[${version}]: https://github.com/${repo}/releases/tag/v${version}`;
+    let newFooter;
+    if (footer) {
+        const footerLines = footer.split(/(?<=\n)/);
+        let replaced = false;
+        const newFooterLines = [];
+        for (const line of footerLines) {
+            if (!replaced && line.startsWith("[Unreleased]:")) {
+                newFooterLines.push(`${newUnreleasedLink}\n`);
+                newFooterLines.push(`${versionLink}\n`);
+                replaced = true;
+                continue;
+            }
+            newFooterLines.push(line);
+        }
+        if (!replaced) {
+            newFooterLines.unshift(`${versionLink}\n`);
+            newFooterLines.unshift(`${newUnreleasedLink}\n`);
+        }
+        newFooter = newFooterLines.join("");
+    }
+    else {
+        newFooter = `${newUnreleasedLink}\n${versionLink}\n`;
+    }
+    return newBody + newFooter;
+}
+/** Extract the body of ## [<version>] - <date> for use as release notes. */
+export function sectionForVersion(text, version) {
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    // Avoid /m on $ — JS $ with multiline matches every line end, not only EOF (Python \\Z).
+    const pattern = new RegExp(`(?:^|\\n)##\\s+\\[${escaped}\\][^\\n]*\\n([\\s\\S]*?)(?=(?:\\n##\\s+\\[)|$)`);
+    const match = pattern.exec(text);
+    if (!match?.[1]) {
+        return "";
+    }
+    return match[1].trim();
+}
+/** Lead maintainer-mode GitHub release notes with the upgrade banner (#1413). */
+export function prependUpgradeBanner(notes, repo, projectRoot, readText) {
+    if (repo !== DEFAULT_REPO) {
+        return notes;
+    }
+    const bannerPath = `${projectRoot}/${UPGRADE_BANNER_RELPATH}`;
+    let banner;
+    try {
+        banner = readText(bannerPath);
+    }
+    catch {
+        return notes;
+    }
+    if (banner === null) {
+        return notes;
+    }
+    const normalized = banner.replace(/\r\n/g, "\n").trim();
+    if (!normalized) {
+        return notes;
+    }
+    return `${normalized}\n\n${notes}`;
+}
+//# sourceMappingURL=changelog.js.map

package/dist/release/cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/release/cli.js

@@ -0,0 +1,7 @@
+/* v8 ignore file -- thin shebang entry; covered via main.ts tests */
+import { fileURLToPath } from "node:url";
+import { cmdRelease } from "./main.js";
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(cmdRelease(process.argv.slice(2)));
+}
+//# sourceMappingURL=cli.js.map

package/dist/release/constants.d.ts

@@ -0,0 +1,22 @@
+/** Exit codes mirroring scripts/release.py. */
+export declare const EXIT_OK = 0;
+export declare const EXIT_VIOLATION = 1;
+export declare const EXIT_CONFIG_ERROR = 2;
+export declare const DEFAULT_REPO = "deftai/directive";
+export declare const DEFAULT_BASE_BRANCH = "master";
+export declare const UPGRADE_BANNER_RELPATH = ".github/release-notes/upgrade-banner.md";
+export declare const VERSION_RE: RegExp;
+export declare const TAG_RE: RegExp;
+export declare const UNRELEASED_RE: RegExp;
+export declare const UNRELEASED_LINK_RE: RegExp;
+export declare const FRESH_UNRELEASED_BLOCK: string;
+export declare const TOTAL_STEPS = 13;
+export declare const VERIFY_DRAFT_MAX_ATTEMPTS = 5;
+export declare const VERIFY_DRAFT_INTERVAL_SECONDS = 1;
+export declare const RELEASE_ARTIFACTS: readonly ["CHANGELOG.md", "ROADMAP.md", "pyproject.toml", "uv.lock"];
+export declare const BRANCH_GATE_BYPASS_ENV = "DEFT_ALLOW_DEFAULT_BRANCH_COMMIT";
+export declare const DESTRUCTIVE_GH_GATE_BYPASS_ENV = "DEFT_ALLOW_DESTRUCTIVE_GH_VERBS";
+export declare const PYPROJECT_VERSION_LINE_RE: RegExp;
+/** Byte-identical argparse --help from scripts/release.py (Python 3.12). */
+export declare const RELEASE_HELP: string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/release/constants.js

@@ -0,0 +1,85 @@
+/** Exit codes mirroring scripts/release.py. */
+export const EXIT_OK = 0;
+export const EXIT_VIOLATION = 1;
+export const EXIT_CONFIG_ERROR = 2;
+export const DEFAULT_REPO = "deftai/directive";
+export const DEFAULT_BASE_BRANCH = "master";
+export const UPGRADE_BANNER_RELPATH = ".github/release-notes/upgrade-banner.md";
+export const VERSION_RE = /^\d+\.\d+\.\d+$/;
+export const TAG_RE = /^v(\d+\.\d+\.\d+)$/;
+export const UNRELEASED_RE = /^##\s+\[Unreleased\]\s*$/m;
+export const UNRELEASED_LINK_RE = /^\[Unreleased\]:\s+https?:\/\/github\.com\/[^/]+\/[^/]+\/compare\/v(?<prev>\d+\.\d+\.\d+)\.\.\.HEAD\s*$/m;
+export const FRESH_UNRELEASED_BLOCK = "## [Unreleased]\n" +
+    "\n" +
+    "### Added\n" +
+    "\n" +
+    "### Changed\n" +
+    "\n" +
+    "### Fixed\n" +
+    "\n" +
+    "### Removed\n";
+export const TOTAL_STEPS = 13;
+export const VERIFY_DRAFT_MAX_ATTEMPTS = 5;
+export const VERIFY_DRAFT_INTERVAL_SECONDS = 1.0;
+export const RELEASE_ARTIFACTS = [
+    "CHANGELOG.md",
+    "ROADMAP.md",
+    "pyproject.toml",
+    "uv.lock",
+];
+export const BRANCH_GATE_BYPASS_ENV = "DEFT_ALLOW_DEFAULT_BRANCH_COMMIT";
+export const DESTRUCTIVE_GH_GATE_BYPASS_ENV = "DEFT_ALLOW_DESTRUCTIVE_GH_VERBS";
+export const PYPROJECT_VERSION_LINE_RE = /version\s*=\s*"[^"]*"/;
+/** Byte-identical argparse --help from scripts/release.py (Python 3.12). */
+export const RELEASE_HELP = "usage: release [-h] [--dry-run] [--skip-tag] [--skip-release] [--allow-dirty]\n" +
+    "               [--allow-vbrief-drift] [--skip-ci] [--skip-build] [--no-draft]\n" +
+    "               [--repo OWNER/REPO] [--base-branch BRANCH]\n" +
+    "               [--project-root PATH] [--summary TEXT]\n" +
+    "               version\n" +
+    "\n" +
+    "Automate the v0.X.Y release flow (#74): pre-flight, CI, CHANGELOG promote,\n" +
+    "ROADMAP refresh, build, tag, push, gh release. Halt-friendly: supports --dry-\n" +
+    "run / --skip-tag / --skip-release for safe rehearsals.\n" +
+    "\n" +
+    "positional arguments:\n" +
+    "  version               Release version, e.g. 0.21.0 (no leading 'v', strict\n" +
+    "                        X.Y.Z).\n" +
+    "\n" +
+    "options:\n" +
+    "  -h, --help            show this help message and exit\n" +
+    "  --dry-run             Print the full release plan without writing files or\n" +
+    "                        invoking external commands.\n" +
+    "  --skip-tag            Do not invoke git tag / git push origin <tag> (still\n" +
+    "                        updates CHANGELOG).\n" +
+    "  --skip-release        Do not invoke gh release create.\n" +
+    "  --allow-dirty         Bypass the dirty-tree pre-flight (use only for\n" +
+    "                        rehearsals).\n" +
+    "  --allow-vbrief-drift  Bypass the vBRIEF-lifecycle sync pre-flight gate\n" +
+    "                        (#734). Use only when the operator has reviewed the\n" +
+    "                        drift and explicitly accepts that closed-issue vBRIEFs\n" +
+    "                        may still live in non-terminal folders. The clean path\n" +
+    "                        is to run `task reconcile:issues -- --apply-lifecycle-\n" +
+    "                        fixes` first.\n" +
+    "  --skip-ci             Skip Step 3 (task ci:local / task check fallback).\n" +
+    "                        Used by `task release:e2e` to keep wall-clock\n" +
+    "                        manageable inside the auto-created temp repo (CI\n" +
+    "                        semantics are covered by the unit-test suite, not the\n" +
+    "                        e2e rehearsal).\n" +
+    "  --skip-build          Skip Step 6 (task build). Used by `task release:e2e`\n" +
+    "                        to keep wall-clock manageable; build artefacts are not\n" +
+    "                        needed for the draft-release verification step.\n" +
+    "  --no-draft            Publish the GitHub release immediately instead of\n" +
+    "                        creating a draft (default: --draft, paired with `task\n" +
+    "                        release:publish -- <version>`).\n" +
+    "  --repo OWNER/REPO     Override the GitHub repository (default: resolved from\n" +
+    "                        `git remote get-url origin`, falling back to\n" +
+    "                        'deftai/directive').\n" +
+    "  --base-branch BRANCH  Expected base branch for releases (default: master).\n" +
+    "  --project-root PATH   Repository root (default: $DEFT_PROJECT_ROOT or the\n" +
+    "                        parent of the scripts/ directory).\n" +
+    "  --summary TEXT        Optional one-line summary to inject as a Markdown\n" +
+    "                        blockquote at the top of the promoted CHANGELOG\n" +
+    "                        section. Flows through to the GitHub release body and\n" +
+    "                        the Slack announcement template (Phase 8). Recommended\n" +
+    "                        length 80-160 chars.\n";
+//# sourceMappingURL=constants.js.map

package/dist/release/flags.d.ts

@@ -0,0 +1,4 @@
+import type { ReleaseFlags } from "./types.js";
+export declare function parseReleaseFlags(args: readonly string[]): ReleaseFlags;
+export declare function formatReleaseHelp(): string;
+//# sourceMappingURL=flags.d.ts.map