@deftai/directive-core 0.55.0

package/dist/release-e2e/gh-ops.js

@@ -0,0 +1,72 @@
+import { resolveGh } from "../release/gh.js";
+import { spawnText } from "../release/spawn.js";
+export function provisionTempRepo(owner, slug, seams = {}) {
+    const ghPath = resolveGh({ whichGh: seams.whichGh });
+    if (ghPath === null) {
+        return [false, "gh CLI not found on PATH"];
+    }
+    const full = `${owner}/${slug}`;
+    const spawn = seams.spawnText ?? spawnText;
+    const result = spawn(ghPath, [
+        "repo",
+        "create",
+        full,
+        "--private",
+        "--description",
+        "Auto-generated release-rehearsal repo (deft #716); safe to delete.",
+    ], { env: { ...process.env }, timeoutMs: 120_000 });
+    if (result.status !== 0) {
+        return [false, `gh repo create failed: ${result.stderr.trim()}`];
+    }
+    return [true, `created ${full} (private)`];
+}
+export function destroyTempRepo(owner, slug, seams = {}) {
+    const ghPath = resolveGh({ whichGh: seams.whichGh });
+    if (ghPath === null) {
+        return [false, "gh CLI not found on PATH"];
+    }
+    const full = `${owner}/${slug}`;
+    const spawn = seams.spawnText ?? spawnText;
+    const result = spawn(ghPath, ["repo", "delete", full, "--yes"], {
+        env: { ...process.env },
+        timeoutMs: 120_000,
+    });
+    if (result.status !== 0) {
+        return [false, `gh repo delete failed: ${result.stderr.trim()}`];
+    }
+    return [true, `deleted ${full}`];
+}
+export function verifyDraftRelease(owner, slug, version, seams = {}) {
+    const ghPath = resolveGh({ whichGh: seams.whichGh });
+    if (ghPath === null) {
+        return [false, "gh CLI not found on PATH"];
+    }
+    const tag = `v${version}`;
+    const full = `${owner}/${slug}`;
+    const spawn = seams.spawnText ?? spawnText;
+    const result = spawn(ghPath, ["release", "view", tag, "--repo", full, "--json", "isDraft,tagName,name,url"], { env: { ...process.env }, timeoutMs: 60_000 });
+    if (result.status !== 0) {
+        return [false, `gh release view failed: ${result.stderr.trim()}`];
+    }
+    let payload;
+    try {
+        payload = JSON.parse(result.stdout);
+    }
+    catch (exc) {
+        return [false, `gh release view returned non-JSON: ${String(exc)}`];
+    }
+    if (!payload.isDraft) {
+        return [
+            false,
+            `draft verify FAIL: expected isDraft=true on ${full} ${tag}, got ${JSON.stringify(payload)}`,
+        ];
+    }
+    if (payload.tagName !== tag) {
+        return [
+            false,
+            `draft verify FAIL: expected tagName=${JSON.stringify(tag)} on ${full}, got tagName=${JSON.stringify(payload.tagName)}`,
+        ];
+    }
+    return [true, `verified draft ${tag} on ${full}`];
+}
+//# sourceMappingURL=gh-ops.js.map

package/dist/release-e2e/git-ops.d.ts

@@ -0,0 +1,6 @@
+import type { E2ESeams } from "./types.js";
+export declare function cloneRepoToTemp(projectRoot: string, targetDir: string, seams?: E2ESeams): [boolean, string];
+export declare function setOriginToTempRepo(cloneDir: string, owner: string, slug: string, seams?: E2ESeams): [boolean, string];
+export declare function pushMirror(cloneDir: string, seams?: E2ESeams): [boolean, string];
+export declare function verifyTag(cloneDir: string, version: string, seams?: E2ESeams): [boolean, string];
+//# sourceMappingURL=git-ops.d.ts.map

package/dist/release-e2e/git-ops.js

@@ -0,0 +1,47 @@
+import { runGit as releaseRunGit } from "../release/git.js";
+import { spawnText } from "../release/spawn.js";
+function defaultRunGit(projectRoot, args, env, seams = {}) {
+    if (seams.runGit) {
+        return seams.runGit(projectRoot, args, env);
+    }
+    return releaseRunGit(projectRoot, args, { spawnText: seams.spawnText ?? spawnText }, env);
+}
+export function cloneRepoToTemp(projectRoot, targetDir, seams = {}) {
+    const env = { ...process.env, DEFT_PROJECT_ROOT: targetDir };
+    const spawn = seams.spawnText ?? spawnText;
+    const result = spawn("git", ["clone", projectRoot, targetDir], {
+        env,
+        timeoutMs: 300_000,
+    });
+    if (result.status !== 0) {
+        return [false, `git clone failed: ${result.stderr.trim()}`];
+    }
+    return [true, `cloned ${projectRoot} -> ${targetDir}`];
+}
+export function setOriginToTempRepo(cloneDir, owner, slug, seams = {}) {
+    const url = `https://github.com/${owner}/${slug}.git`;
+    const result = defaultRunGit(cloneDir, ["remote", "set-url", "origin", url], undefined, seams);
+    if (result.status !== 0) {
+        return [false, `git remote set-url failed: ${result.stderr.trim()}`];
+    }
+    return [true, `origin -> ${url}`];
+}
+export function pushMirror(cloneDir, seams = {}) {
+    const result = defaultRunGit(cloneDir, ["push", "origin", "refs/heads/*:refs/heads/*", "refs/tags/*:refs/tags/*"], undefined, seams);
+    if (result.status !== 0) {
+        return [false, `git push (heads+tags refspecs) failed: ${result.stderr.trim()}`];
+    }
+    return [true, "pushed heads + tags to temp origin"];
+}
+export function verifyTag(cloneDir, version, seams = {}) {
+    const tag = `v${version}`;
+    const result = defaultRunGit(cloneDir, ["ls-remote", "--tags", "origin", `refs/tags/${tag}`], undefined, seams);
+    if (result.status !== 0) {
+        return [false, `git ls-remote failed: ${result.stderr.trim()}`];
+    }
+    if (!result.stdout.trim()) {
+        return [false, `tag verify FAIL: ${tag} not present on temp origin`];
+    }
+    return [true, `verified tag ${tag} present on temp origin`];
+}
+//# sourceMappingURL=git-ops.js.map

package/dist/release-e2e/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./constants.js";
+export * from "./entrypoint.js";
+export * from "./flags.js";
+export * from "./gh-ops.js";
+export * from "./git-ops.js";
+export { cmdReleaseE2e, runE2e } from "./main.js";
+export * from "./npm-ops.js";
+export * from "./rehearsal.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/release-e2e/index.js

@@ -0,0 +1,10 @@
+export * from "./constants.js";
+export * from "./entrypoint.js";
+export * from "./flags.js";
+export * from "./gh-ops.js";
+export * from "./git-ops.js";
+export { cmdReleaseE2e, runE2e } from "./main.js";
+export * from "./npm-ops.js";
+export * from "./rehearsal.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/release-e2e/main.d.ts

@@ -0,0 +1,4 @@
+import type { E2EConfig, E2ESeams } from "./types.js";
+export declare function runE2e(config: E2EConfig, seams?: E2ESeams): number;
+export declare function cmdReleaseE2e(args: readonly string[], seams?: E2ESeams): number;
+//# sourceMappingURL=main.d.ts.map

package/dist/release-e2e/main.js

@@ -0,0 +1,78 @@
+import { resolveProjectRoot } from "../release/paths.js";
+import { EXIT_CONFIG_ERROR, EXIT_OK, EXIT_VIOLATION, RELEASE_E2E_HELP } from "./constants.js";
+import { emit, generateRepoSlug, parseE2EFlags } from "./flags.js";
+import { destroyTempRepo, provisionTempRepo } from "./gh-ops.js";
+import { runRehearsal } from "./rehearsal.js";
+export function runE2e(config, seams = {}) {
+    const slug = config.repoSlug ?? generateRepoSlug(seams);
+    const owner = config.owner;
+    if (config.dryRun) {
+        emit("Provision temp repo", `DRYRUN (would run \`gh repo create --private ${owner}/${slug}\`)`);
+        const npmPlan = config.skipNpm
+            ? "task release:rollback"
+            : "npm publish dry-run (4 packages) -> task release:rollback";
+        emit("Rehearsal", "DRYRUN (would run pipeline-mirror rehearsal: clone -> push heads+tags -> task release -> " +
+            `verify draft + tag -> ${npmPlan} against temp repo)`);
+        emit("Destroy temp repo", `DRYRUN (would run \`gh repo delete ${owner}/${slug} --yes\`)`);
+        return EXIT_OK;
+    }
+    const [provisionOk, provisionReason] = provisionTempRepo(owner, slug, seams);
+    if (!provisionOk) {
+        emit(`Provision ${owner}/${slug}`, `FAIL (${provisionReason})`);
+        return EXIT_VIOLATION;
+    }
+    emit(`Provision ${owner}/${slug}`, `OK (${provisionReason})`);
+    let rehearsalRc = EXIT_OK;
+    try {
+        const [ok, reason] = runRehearsal(owner, slug, config.projectRoot, undefined, seams, config.skipNpm);
+        if (ok) {
+            emit("Rehearsal", `OK (${reason})`);
+        }
+        else {
+            emit("Rehearsal", `FAIL (${reason})`);
+            rehearsalRc = EXIT_VIOLATION;
+        }
+    }
+    finally {
+        if (config.keepRepo) {
+            emit(`Destroy ${owner}/${slug}`, "SKIP (--keep-repo set; manual cleanup required: " +
+                `gh repo delete ${owner}/${slug} --yes)`);
+        }
+        else {
+            const [destroyOk, destroyReason] = destroyTempRepo(owner, slug, seams);
+            if (destroyOk) {
+                emit(`Destroy ${owner}/${slug}`, `OK (${destroyReason})`);
+            }
+            else {
+                emit(`Destroy ${owner}/${slug}`, `WARN (${destroyReason}); manual cleanup hint: gh repo delete ${owner}/${slug} --yes`);
+            }
+        }
+    }
+    return rehearsalRc;
+}
+export function cmdReleaseE2e(args, seams = {}) {
+    const flags = parseE2EFlags(args);
+    if (flags.help) {
+        process.stdout.write(RELEASE_E2E_HELP);
+        return EXIT_OK;
+    }
+    if (flags.unknown.length > 0) {
+        process.stderr.write(`release_e2e: error: unrecognized arguments: ${flags.unknown.join(" ")}\n`);
+        return EXIT_CONFIG_ERROR;
+    }
+    if (!flags.owner) {
+        process.stderr.write("Error: --owner must be a non-empty string.\n");
+        return EXIT_CONFIG_ERROR;
+    }
+    const projectRoot = resolveProjectRoot(flags.projectRoot);
+    const config = {
+        owner: flags.owner,
+        projectRoot,
+        dryRun: flags.dryRun,
+        keepRepo: flags.keepRepo,
+        skipNpm: flags.skipNpm,
+        repoSlug: null,
+    };
+    return runE2e(config, seams);
+}
+//# sourceMappingURL=main.js.map

package/dist/release-e2e/npm-ops.d.ts

@@ -0,0 +1,29 @@
+import type { E2ESeams } from "./types.js";
+/**
+ * Resolve a pnpm invocation prefix for the clone build. Prefers a `pnpm`
+ * binary on PATH; falls back to `corepack pnpm`. Returns null when neither is
+ * available.
+ */
+export declare function resolvePnpm(seams?: E2ESeams): string[] | null;
+/**
+ * Bump the four published package versions to <version> and resolve any
+ * `workspace:` dependency spec to `^<version>` (npm cannot publish the pnpm
+ * workspace protocol verbatim). Folds in the scope item-4 version-alignment
+ * assertion: each manifest is read back and must report exactly <version>.
+ */
+export declare function alignNpmPackageVersions(cloneDir: string, version: string): [boolean, string];
+/**
+ * Dry-run the npm publish for the four @deftai/directive* packages.
+ *
+ * Steps, all inside the throwaway clone:
+ *   1. Resolve `npm`. SOFT-SKIP (ok=true) when npm is absent so Node-less
+ *      operators are not blocked -- symmetric to --skip-npm.
+ *   2. Resolve pnpm (or `corepack pnpm`) and `pnpm install --frozen-lockfile`.
+ *   3. `pnpm -w run build`; dist/ must exist for the dist-only files allowlist.
+ *   4. Align the four package.json versions + resolve the workspace protocol.
+ *   5. `npm publish --dry-run --access public` per package in dependency order.
+ *
+ * Returns [ok, reason] like verifyDraftRelease / verifyTag.
+ */
+export declare function rehearseNpmPublish(cloneDir: string, version: string, seams?: E2ESeams): [boolean, string];
+//# sourceMappingURL=npm-ops.d.ts.map

package/dist/release-e2e/npm-ops.js

@@ -0,0 +1,149 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { defaultWhich, spawnText } from "../release/spawn.js";
+import { NPM_BUILD_TIMEOUT_SECONDS, NPM_INSTALL_TIMEOUT_SECONDS, NPM_PUBLISH_DRYRUN_TIMEOUT_SECONDS, NPM_PUBLISH_PACKAGES, } from "./constants.js";
+/**
+ * npm publish dry-run rehearsal (#1910) -- the TS port of the
+ * scripts/release_e2e.py helpers of the same name. Mirrors
+ * .github/workflows/npm-publish.yml so a broken `files` allowlist, version
+ * drift, or dependency-order bug surfaces in `task release:e2e` BEFORE a real
+ * `v*` tag fires the publish workflow, without ever touching the real registry.
+ */
+function resolveWhich(seams) {
+    return seams.which ?? seams.whichGh ?? defaultWhich;
+}
+/**
+ * Resolve a pnpm invocation prefix for the clone build. Prefers a `pnpm`
+ * binary on PATH; falls back to `corepack pnpm`. Returns null when neither is
+ * available.
+ */
+export function resolvePnpm(seams = {}) {
+    const which = resolveWhich(seams);
+    const pnpm = which("pnpm");
+    if (pnpm) {
+        return [pnpm];
+    }
+    const corepack = which("corepack");
+    if (corepack) {
+        return [corepack, "pnpm"];
+    }
+    return null;
+}
+function runNpmStep(cmd, cwd, env, label, timeoutSeconds, seams) {
+    const spawn = seams.spawnText ?? spawnText;
+    const head = cmd[0] ?? "";
+    const result = spawn(head, cmd.slice(1), {
+        cwd,
+        env,
+        timeoutMs: timeoutSeconds * 1000,
+    });
+    if (result.status !== 0) {
+        const detail = (result.stderr || result.stdout || "").trim();
+        return [false, `${label} failed (exit ${result.status}): ${detail.slice(-500)}`];
+    }
+    return [true, `${label} OK`];
+}
+/**
+ * Bump the four published package versions to <version> and resolve any
+ * `workspace:` dependency spec to `^<version>` (npm cannot publish the pnpm
+ * workspace protocol verbatim). Folds in the scope item-4 version-alignment
+ * assertion: each manifest is read back and must report exactly <version>.
+ */
+export function alignNpmPackageVersions(cloneDir, version) {
+    for (const pkg of NPM_PUBLISH_PACKAGES) {
+        const manifest = join(cloneDir, "packages", pkg, "package.json");
+        let data;
+        try {
+            data = JSON.parse(readFileSync(manifest, "utf8"));
+        }
+        catch (exc) {
+            return [
+                false,
+                `version-align FAIL: cannot read packages/${pkg}/package.json: ${String(exc)}`,
+            ];
+        }
+        data.version = version;
+        const deps = data.dependencies;
+        if (deps !== null && typeof deps === "object") {
+            const depMap = deps;
+            for (const [name, spec] of Object.entries(depMap)) {
+                if (typeof spec === "string" && spec.startsWith("workspace:")) {
+                    depMap[name] = `^${version}`;
+                }
+            }
+        }
+        let readback;
+        try {
+            writeFileSync(manifest, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+            readback = JSON.parse(readFileSync(manifest, "utf8"));
+        }
+        catch (exc) {
+            return [
+                false,
+                `version-align FAIL: cannot write packages/${pkg}/package.json: ${String(exc)}`,
+            ];
+        }
+        if (readback.version !== version) {
+            return [
+                false,
+                `version-align FAIL: packages/${pkg} version=` +
+                    `${JSON.stringify(readback.version)} != ${JSON.stringify(version)}`,
+            ];
+        }
+    }
+    return [true, `aligned 4 package versions to ${version} (+ resolved workspace protocol)`];
+}
+/**
+ * Dry-run the npm publish for the four @deftai/directive* packages.
+ *
+ * Steps, all inside the throwaway clone:
+ *   1. Resolve `npm`. SOFT-SKIP (ok=true) when npm is absent so Node-less
+ *      operators are not blocked -- symmetric to --skip-npm.
+ *   2. Resolve pnpm (or `corepack pnpm`) and `pnpm install --frozen-lockfile`.
+ *   3. `pnpm -w run build`; dist/ must exist for the dist-only files allowlist.
+ *   4. Align the four package.json versions + resolve the workspace protocol.
+ *   5. `npm publish --dry-run --access public` per package in dependency order.
+ *
+ * Returns [ok, reason] like verifyDraftRelease / verifyTag.
+ */
+export function rehearseNpmPublish(cloneDir, version, seams = {}) {
+    const which = resolveWhich(seams);
+    const npmPath = which("npm");
+    if (npmPath === null) {
+        return [true, "SKIP (npm not on PATH; Node-less operator)"];
+    }
+    const pnpmCmd = resolvePnpm(seams);
+    if (pnpmCmd === null) {
+        return [
+            false,
+            "npm present but neither pnpm nor corepack is on PATH -- " +
+                "cannot build the workspace for the dry-run",
+        ];
+    }
+    const env = { ...process.env, DEFT_PROJECT_ROOT: cloneDir };
+    let [ok, reason] = runNpmStep([...pnpmCmd, "install", "--frozen-lockfile"], cloneDir, env, "pnpm install", NPM_INSTALL_TIMEOUT_SECONDS, seams);
+    if (!ok) {
+        return [false, reason];
+    }
+    [ok, reason] = runNpmStep([...pnpmCmd, "-w", "run", "build"], cloneDir, env, "pnpm build", NPM_BUILD_TIMEOUT_SECONDS, seams);
+    if (!ok) {
+        return [false, reason];
+    }
+    [ok, reason] = alignNpmPackageVersions(cloneDir, version);
+    if (!ok) {
+        return [false, reason];
+    }
+    for (const pkg of NPM_PUBLISH_PACKAGES) {
+        const pkgDir = join(cloneDir, "packages", pkg);
+        [ok, reason] = runNpmStep([npmPath, "publish", "--dry-run", "--access", "public"], pkgDir, env, `npm publish --dry-run packages/${pkg}`, NPM_PUBLISH_DRYRUN_TIMEOUT_SECONDS, seams);
+        if (!ok) {
+            return [false, reason];
+        }
+    }
+    return [
+        true,
+        "npm publish --dry-run clean for 4 packages " +
+            `(types -> core -> content -> cli) at v${version}`,
+    ];
+}
+//# sourceMappingURL=npm-ops.js.map

package/dist/release-e2e/rehearsal.d.ts

@@ -0,0 +1,3 @@
+import type { E2ESeams } from "./types.js";
+export declare function runRehearsal(owner: string, slug: string, projectRoot: string, version?: string, seams?: E2ESeams, skipNpm?: boolean): [boolean, string];
+//# sourceMappingURL=rehearsal.d.ts.map

package/dist/release-e2e/rehearsal.js

@@ -0,0 +1,51 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { REHEARSAL_VERSION } from "./constants.js";
+import { dispatchTaskRelease, dispatchTaskReleaseRollback } from "./entrypoint.js";
+import { emit } from "./flags.js";
+import { verifyDraftRelease } from "./gh-ops.js";
+import { cloneRepoToTemp, pushMirror, setOriginToTempRepo, verifyTag } from "./git-ops.js";
+import { rehearseNpmPublish } from "./npm-ops.js";
+export function runRehearsal(owner, slug, projectRoot, version = REHEARSAL_VERSION, seams = {}, skipNpm = false) {
+    const repoFull = `${owner}/${slug}`;
+    const mkdtemp = seams.mkdtemp ?? ((prefix) => mkdtempSync(join(tmpdir(), prefix)));
+    const rmTemp = seams.rmTemp ?? ((p) => rmSync(p, { recursive: true, force: true }));
+    const tmpdirPath = mkdtemp("deft-e2e-");
+    const cloneDir = join(tmpdirPath, "clone");
+    try {
+        const steps = [
+            ["clone", () => cloneRepoToTemp(projectRoot, cloneDir, seams)],
+            ["set-origin", () => setOriginToTempRepo(cloneDir, owner, slug, seams)],
+            ["push-mirror", () => pushMirror(cloneDir, seams)],
+            ["task release", () => dispatchTaskRelease(cloneDir, version, repoFull, seams)],
+            ["verify draft", () => verifyDraftRelease(owner, slug, version, seams)],
+            ["verify tag", () => verifyTag(cloneDir, version, seams)],
+        ];
+        if (!skipNpm) {
+            steps.push(["npm publish dry-run", () => rehearseNpmPublish(cloneDir, version, seams)]);
+        }
+        steps.push([
+            "task release:rollback",
+            () => dispatchTaskReleaseRollback(cloneDir, version, repoFull, seams),
+        ]);
+        for (const [label, step] of steps) {
+            const [ok, reason] = step();
+            emit(`  rehearsal step: ${label}`, `${ok ? "OK" : "FAIL"} (${reason})`);
+            if (!ok) {
+                return [false, `${label}: ${reason}`];
+            }
+        }
+        const npmNote = skipNpm ? " (npm dry-run skipped)" : " -> npm publish dry-run";
+        return [
+            true,
+            `pipeline-mirror rehearsal succeeded against ${repoFull} ` +
+                `(${steps.length} steps; clone -> push heads+tags -> task release -> ` +
+                `verify draft+tag${npmNote} -> rollback)`,
+        ];
+    }
+    finally {
+        rmTemp(tmpdirPath);
+    }
+}
+//# sourceMappingURL=rehearsal.js.map

package/dist/release-e2e/rollback-bridge.d.ts

@@ -0,0 +1,3 @@
+/** Invoke release_rollback.main via Python until the TS rollback module lands (#1729). */
+export declare function rollbackMain(argv: string[]): number;
+//# sourceMappingURL=rollback-bridge.d.ts.map

package/dist/release-e2e/rollback-bridge.js

@@ -0,0 +1,20 @@
+import { resolveScriptsDir } from "../release/paths.js";
+import { spawnText } from "../release/spawn.js";
+/** Invoke release_rollback.main via Python until the TS rollback module lands (#1729). */
+export function rollbackMain(argv) {
+    const scriptsDir = resolveScriptsDir();
+    const code = [
+        "import sys",
+        `sys.path.insert(0, ${JSON.stringify(scriptsDir)})`,
+        "import release_rollback",
+        `sys.exit(release_rollback.main(${JSON.stringify(argv)}))`,
+    ].join("\n");
+    const frameworkRoot = scriptsDir.replace(/[/\\]scripts$/, "") || process.cwd();
+    const result = spawnText("uv", ["run", "python", "-c", code], {
+        cwd: frameworkRoot,
+        env: { ...process.env, PYTHONUTF8: "1" },
+        timeoutMs: 300_000,
+    });
+    return result.status ?? 1;
+}
+//# sourceMappingURL=rollback-bridge.js.map

package/dist/release-e2e/types.d.ts

@@ -0,0 +1,40 @@
+import type { SpawnResult } from "../release/types.js";
+export interface E2EConfig {
+    owner: string;
+    projectRoot: string;
+    dryRun: boolean;
+    keepRepo: boolean;
+    /** When true, skip the npm publish dry-run rehearsal step (#1910). */
+    skipNpm: boolean;
+    /** Optional override slug (test injection). If null, a fresh slug is generated per run. */
+    repoSlug: string | null;
+}
+export interface ParsedE2EFlags {
+    help: boolean;
+    owner: string;
+    dryRun: boolean;
+    keepRepo: boolean;
+    projectRoot: string | null;
+    skipNpm: boolean;
+    unknown: string[];
+}
+export type EntrypointFn = (argv: string[]) => number;
+export interface E2ESeams {
+    whichGh?: (name: string) => string | null;
+    /** Generic PATH lookup for the npm publish dry-run rehearsal (#1910). */
+    which?: (name: string) => string | null;
+    spawnText?: (cmd: string, args: readonly string[], options?: {
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+        timeoutMs?: number;
+    }) => SpawnResult;
+    runGit?: (projectRoot: string, args: readonly string[], env?: NodeJS.ProcessEnv) => SpawnResult;
+    mkdtemp?: (prefix: string) => string;
+    rmTemp?: (path: string) => void;
+    generateRepoSlug?: () => string;
+    releaseEntrypoint?: EntrypointFn;
+    rollbackEntrypoint?: EntrypointFn;
+    now?: () => Date;
+    randomUuidHex?: () => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/release-e2e/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/release-publish/cli.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/release-publish/cli.js

@@ -0,0 +1,7 @@
+/* v8 ignore file -- thin shebang entry; covered via main.ts tests */
+import { fileURLToPath } from "node:url";
+import { cmdReleasePublish } from "./main.js";
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(cmdReleasePublish(process.argv.slice(2)));
+}
+//# sourceMappingURL=cli.js.map

package/dist/release-publish/constants.d.ts

@@ -0,0 +1,4 @@
+/** Byte-identical argparse --help from scripts/release_publish.py (Python 3.14). */
+export declare const RELEASE_PUBLISH_HELP: string;
+export declare const RELEASES_LIST_ENDPOINT_TEMPLATE = "repos/{repo}/releases?per_page=100";
+//# sourceMappingURL=constants.d.ts.map

package/dist/release-publish/constants.js

@@ -0,0 +1,24 @@
+/** Byte-identical argparse --help from scripts/release_publish.py (Python 3.14). */
+export const RELEASE_PUBLISH_HELP = "usage: release_publish [-h] [--dry-run] [--repo OWNER/REPO]\n" +
+    "                       [--project-root PATH]\n" +
+    "                       version\n" +
+    "\n" +
+    "Flip a draft GitHub release to public (#716 safety hardening). Companion to\n" +
+    "`task release` -- after reviewing the draft's binaries / notes / asset list,\n" +
+    "run `task release:publish -- <version>` to publish.\n" +
+    "\n" +
+    "positional arguments:\n" +
+    "  version              Release version, e.g. 0.21.0 (no leading 'v', strict\n" +
+    "                       X.Y.Z).\n" +
+    "\n" +
+    "options:\n" +
+    "  -h, --help           show this help message and exit\n" +
+    "  --dry-run            Print the publish plan without invoking gh release\n" +
+    "                       edit.\n" +
+    "  --repo OWNER/REPO    Override the GitHub repository (default: resolved from\n" +
+    "                       `git remote get-url origin`, falling back to\n" +
+    "                       'deftai/directive').\n" +
+    "  --project-root PATH  Repository root (default: $DEFT_PROJECT_ROOT or the\n" +
+    "                       parent of the scripts/ directory).\n";
+export const RELEASES_LIST_ENDPOINT_TEMPLATE = "repos/{repo}/releases?per_page=100";
+//# sourceMappingURL=constants.js.map

package/dist/release-publish/flags.d.ts

@@ -0,0 +1,5 @@
+import type { PublishFlags } from "./types.js";
+export declare function formatReleasePublishHelp(): string;
+export declare function parsePublishFlags(args: readonly string[]): PublishFlags;
+export declare function formatMissingVersionError(): string;
+//# sourceMappingURL=flags.d.ts.map

package/dist/release-publish/flags.js

@@ -0,0 +1,67 @@
+import { RELEASE_PUBLISH_HELP } from "./constants.js";
+export function formatReleasePublishHelp() {
+    return RELEASE_PUBLISH_HELP;
+}
+export function parsePublishFlags(args) {
+    let help = false;
+    let dryRun = false;
+    let repo = null;
+    let projectRoot = null;
+    let version = null;
+    const unknown = [];
+    const takeValue = (flag, i) => {
+        if (i + 1 >= args.length) {
+            unknown.push(`${flag} (missing value)`);
+            return null;
+        }
+        return args[i + 1] ?? null;
+    };
+    let i = 0;
+    while (i < args.length) {
+        const token = args[i] ?? "";
+        if (token === "-h" || token === "--help") {
+            help = true;
+        }
+        else if (token === "--dry-run") {
+            dryRun = true;
+        }
+        else if (token === "--repo") {
+            repo = takeValue(token, i);
+            if (repo !== null)
+                i += 1;
+        }
+        else if (token.startsWith("--repo=")) {
+            repo = token.slice("--repo=".length) || null;
+            if (!repo)
+                unknown.push("--repo= (empty value)");
+        }
+        else if (token === "--project-root") {
+            projectRoot = takeValue(token, i);
+            if (projectRoot !== null)
+                i += 1;
+        }
+        else if (token.startsWith("--project-root=")) {
+            projectRoot = token.slice("--project-root=".length) || null;
+            if (!projectRoot)
+                unknown.push("--project-root= (empty value)");
+        }
+        else if (token.startsWith("-")) {
+            unknown.push(token);
+        }
+        else if (version === null) {
+            version = token;
+        }
+        else {
+            unknown.push(token);
+        }
+        i += 1;
+    }
+    return { help, version, repo, projectRoot, dryRun, unknown };
+}
+export function formatMissingVersionError() {
+    return ("usage: release_publish [-h] [--dry-run] [--repo OWNER/REPO]\n" +
+        "                       [--project-root PATH]\n" +
+        "                       version\n" +
+        "release_publish: error: the following arguments are required: version\n");
+}
+//# sourceMappingURL=flags.js.map