@deftai/directive-core 0.55.0

package/dist/release-publish/gh-api.d.ts

@@ -0,0 +1,6 @@
+import type { NormalisedRelease, ReleasePublishSeams, ViewReleaseState } from "./types.js";
+export declare function normaliseReleasePayload(restPayload: Record<string, unknown>): NormalisedRelease;
+export declare function ghApiFindReleaseByTag(ghPath: string, repo: string, tag: string, seams?: ReleasePublishSeams): [ViewReleaseState, NormalisedRelease | null, string];
+export declare function viewRelease(version: string, repo: string, seams?: ReleasePublishSeams): [ViewReleaseState, NormalisedRelease | null, string];
+export declare function editReleasePublish(version: string, repo: string, releaseId?: number | null | undefined, seams?: ReleasePublishSeams): [boolean, string];
+//# sourceMappingURL=gh-api.d.ts.map

package/dist/release-publish/gh-api.js

@@ -0,0 +1,102 @@
+import { resolveGh } from "../release/gh.js";
+import { spawnText } from "../release/spawn.js";
+import { RELEASES_LIST_ENDPOINT_TEMPLATE } from "./constants.js";
+export function normaliseReleasePayload(restPayload) {
+    return {
+        isDraft: Boolean(restPayload.draft ?? false),
+        name: restPayload.name,
+        tagName: restPayload.tag_name,
+        url: restPayload.html_url,
+        id: restPayload.id,
+    };
+}
+export function ghApiFindReleaseByTag(ghPath, repo, tag, seams = {}) {
+    const endpoint = RELEASES_LIST_ENDPOINT_TEMPLATE.replace("{repo}", repo);
+    const spawn = seams.spawnText ?? spawnText;
+    let result;
+    try {
+        result = spawn(ghPath, ["api", "--paginate", endpoint], {
+            timeoutMs: 120_000,
+            env: { ...process.env },
+        });
+    }
+    catch {
+        return ["gh-error", null, "gh CLI not found on PATH"];
+    }
+    if (result.status !== 0) {
+        const stderr = (result.stderr ?? "").trim();
+        return ["gh-error", null, `gh api ${endpoint} failed: ${stderr}`];
+    }
+    let restPayload;
+    try {
+        restPayload = JSON.parse(result.stdout);
+    }
+    catch (exc) {
+        return ["gh-error", null, `gh api ${endpoint} returned non-JSON: ${String(exc)}`];
+    }
+    if (!Array.isArray(restPayload)) {
+        const typeName = restPayload === null ? "null" : typeof restPayload;
+        return ["gh-error", null, `gh api ${endpoint} returned non-list (${typeName})`];
+    }
+    for (const entry of restPayload) {
+        if (typeof entry !== "object" || entry === null) {
+            continue;
+        }
+        const record = entry;
+        if (record.tag_name !== tag) {
+            continue;
+        }
+        const payload = normaliseReleasePayload(record);
+        if (payload.isDraft) {
+            return ["draft", payload, ""];
+        }
+        return ["published", payload, ""];
+    }
+    return ["not-found", null, `release ${tag} not found on ${repo}`];
+}
+export function viewRelease(version, repo, seams = {}) {
+    const ghPath = resolveGh(seams);
+    if (ghPath === null) {
+        return ["gh-error", null, "gh CLI not found on PATH"];
+    }
+    const tag = `v${version}`;
+    return ghApiFindReleaseByTag(ghPath, repo, tag, seams);
+}
+export function editReleasePublish(version, repo, releaseId = undefined, seams = {}) {
+    const ghPath = resolveGh(seams);
+    if (ghPath === null) {
+        return [false, "gh CLI not found on PATH"];
+    }
+    const tag = `v${version}`;
+    const spawn = seams.spawnText ?? spawnText;
+    let resolvedId = releaseId;
+    if (resolvedId === undefined || resolvedId === null) {
+        const [state, payload, reason] = ghApiFindReleaseByTag(ghPath, repo, tag, seams);
+        if (state === "not-found") {
+            return [false, `release ${tag} not found on ${repo}`];
+        }
+        if (state === "gh-error") {
+            return [false, `could not resolve release id: ${reason}`];
+        }
+        if (!payload || payload.id === undefined || payload.id === null) {
+            return [false, `release ${tag} payload missing 'id' field`];
+        }
+        resolvedId = payload.id;
+    }
+    const endpoint = `repos/${repo}/releases/${resolvedId}`;
+    let result;
+    try {
+        result = spawn(ghPath, ["api", endpoint, "--method", "PATCH", "-F", "draft=false"], {
+            timeoutMs: 60_000,
+            env: { ...process.env },
+        });
+    }
+    catch {
+        return [false, "gh CLI not found on PATH"];
+    }
+    if (result.status !== 0) {
+        return [false, `gh api ${endpoint} (PATCH) failed: ${result.stderr.trim()}`];
+    }
+    return [true, `flipped ${tag} to published`];
+}
+//# sourceMappingURL=gh-api.js.map

package/dist/release-publish/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./constants.js";
+export * from "./flags.js";
+export * from "./gh-api.js";
+export * from "./main.js";
+export * from "./pipeline.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/release-publish/index.js

@@ -0,0 +1,8 @@
+/* v8 ignore file -- re-export barrel; covered via main.ts */
+export * from "./constants.js";
+export * from "./flags.js";
+export * from "./gh-api.js";
+export * from "./main.js";
+export * from "./pipeline.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/release-publish/main.d.ts

@@ -0,0 +1,3 @@
+import type { ReleasePublishSeams } from "./types.js";
+export declare function cmdReleasePublish(args: readonly string[], seams?: ReleasePublishSeams): number;
+//# sourceMappingURL=main.d.ts.map

package/dist/release-publish/main.js

@@ -0,0 +1,38 @@
+import { EXIT_CONFIG_ERROR } from "../release/constants.js";
+import { resolveProjectRoot, resolveRepo } from "../release/paths.js";
+import { validateVersion } from "../release/version.js";
+import { formatMissingVersionError, formatReleasePublishHelp, parsePublishFlags } from "./flags.js";
+import { runPublish } from "./pipeline.js";
+export function cmdReleasePublish(args, seams = {}) {
+    const flags = parsePublishFlags(args);
+    if (flags.help) {
+        process.stdout.write(formatReleasePublishHelp());
+        return 0;
+    }
+    if (flags.unknown.length > 0) {
+        process.stderr.write(`release_publish: error: unrecognized arguments: ${flags.unknown.join(" ")}\n`);
+        return EXIT_CONFIG_ERROR;
+    }
+    if (flags.version === null) {
+        process.stderr.write(formatMissingVersionError());
+        return EXIT_CONFIG_ERROR;
+    }
+    try {
+        validateVersion(flags.version);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Error: ${msg}\n`);
+        return EXIT_CONFIG_ERROR;
+    }
+    const projectRoot = resolveProjectRoot(flags.projectRoot);
+    const repo = resolveRepo(flags.repo, projectRoot, seams);
+    const config = {
+        version: flags.version,
+        repo,
+        projectRoot,
+        dryRun: flags.dryRun,
+    };
+    return runPublish(config, seams);
+}
+//# sourceMappingURL=main.js.map

package/dist/release-publish/pipeline.d.ts

@@ -0,0 +1,4 @@
+import type { PublishConfig, ReleasePublishSeams } from "./types.js";
+export declare function emit(label: string, status: string): void;
+export declare function runPublish(config: PublishConfig, seams?: ReleasePublishSeams): number;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/release-publish/pipeline.js

@@ -0,0 +1,46 @@
+import { EXIT_OK, EXIT_VIOLATION } from "../release/constants.js";
+import { editReleasePublish, viewRelease } from "./gh-api.js";
+export function emit(label, status) {
+    process.stderr.write(`[publish] ${label}... ${status}\n`);
+}
+export function runPublish(config, seams = {}) {
+    const { version, repo, dryRun } = config;
+    const tag = `v${version}`;
+    const viewLabel = `View ${tag} on ${repo}`;
+    if (dryRun) {
+        emit(viewLabel, `DRYRUN (would run \`gh api --paginate repos/${repo}/releases?per_page=100\` and filter for tag_name == ${tag})`);
+        emit(`Edit ${tag}`, `DRYRUN (would run \`gh api -X PATCH repos/${repo}/releases/<id> -F draft=false\`)`);
+        return EXIT_OK;
+    }
+    const [state, payload, reason] = viewRelease(version, repo, seams);
+    if (state === "not-found") {
+        emit(viewLabel, `FAIL (release ${tag} not found on ${repo}: ${reason})`);
+        return EXIT_VIOLATION;
+    }
+    if (state === "gh-error") {
+        emit(viewLabel, `FAIL (${reason})`);
+        return EXIT_VIOLATION;
+    }
+    if (state === "published") {
+        emit(viewLabel, `NOOP (${tag} is already published; nothing to do)`);
+        return EXIT_OK;
+    }
+    emit(viewLabel, `OK (draft found at ${payload?.url ?? "<no url>"})`);
+    const editLabel = `Edit ${tag} (--draft=false)`;
+    const [ok, editReason] = editReleasePublish(version, repo, payload?.id ?? undefined, seams);
+    if (!ok) {
+        emit(editLabel, `FAIL (${editReason})`);
+        return EXIT_VIOLATION;
+    }
+    emit(editLabel, `OK (${editReason})`);
+    const verifyLabel = `Verify ${tag} is published`;
+    const [state2, , reason2] = viewRelease(version, repo, seams);
+    if (state2 !== "published") {
+        emit(verifyLabel, `FAIL (post-edit state is '${state2}'; expected 'published'; reason: ${reason2})`);
+        return EXIT_VIOLATION;
+    }
+    emit(verifyLabel, `OK (${tag} is now public)`);
+    process.stderr.write(`Release ${tag} published successfully on ${repo}.\n`);
+    return EXIT_OK;
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/release-publish/types.d.ts

@@ -0,0 +1,25 @@
+import type { ReleaseSeams } from "../release/types.js";
+export interface PublishConfig {
+    readonly version: string;
+    readonly repo: string;
+    readonly projectRoot: string;
+    readonly dryRun: boolean;
+}
+export interface PublishFlags {
+    readonly help: boolean;
+    readonly version: string | null;
+    readonly repo: string | null;
+    readonly projectRoot: string | null;
+    readonly dryRun: boolean;
+    readonly unknown: readonly string[];
+}
+export interface NormalisedRelease {
+    readonly isDraft: boolean;
+    readonly name: string | null | undefined;
+    readonly tagName: string | null | undefined;
+    readonly url: string | null | undefined;
+    readonly id: number | null | undefined;
+}
+export type ViewReleaseState = "draft" | "published" | "not-found" | "gh-error";
+export type ReleasePublishSeams = ReleaseSeams;
+//# sourceMappingURL=types.d.ts.map

package/dist/release-publish/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/release-rollback/constants.d.ts

@@ -0,0 +1,18 @@
+/** Exit codes mirroring scripts/release_rollback.py (via release.py). */
+export declare const EXIT_OK = 0;
+export declare const EXIT_VIOLATION = 1;
+export declare const EXIT_CONFIG_ERROR = 2;
+/** Download-count guard time windows (seconds). */
+export declare const FIVE_MINUTES_SECONDS: number;
+export declare const THIRTY_MINUTES_SECONDS: number;
+/** Default threshold inside the 5-30 minute window. */
+export declare const DEFAULT_BOT_THRESHOLD = 10;
+/** Race-condition double-read sleep duration. */
+export declare const DOUBLE_READ_SLEEP_SECONDS = 5;
+/** Subject prefix for the auto-generated release-prep commit. */
+export declare const RELEASE_COMMIT_SUBJECT_PREFIX = "chore(release): v";
+/** Short usage line emitted by argparse on parse errors (not full --help). */
+export declare const ROLLBACK_USAGE_SHORT: string;
+/** Byte-identical argparse --help from scripts/release_rollback.py (Python 3.12). */
+export declare const ROLLBACK_HELP: string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/release-rollback/constants.js

@@ -0,0 +1,55 @@
+/** Exit codes mirroring scripts/release_rollback.py (via release.py). */
+export const EXIT_OK = 0;
+export const EXIT_VIOLATION = 1;
+export const EXIT_CONFIG_ERROR = 2;
+/** Download-count guard time windows (seconds). */
+export const FIVE_MINUTES_SECONDS = 5 * 60;
+export const THIRTY_MINUTES_SECONDS = 30 * 60;
+/** Default threshold inside the 5-30 minute window. */
+export const DEFAULT_BOT_THRESHOLD = 10;
+/** Race-condition double-read sleep duration. */
+export const DOUBLE_READ_SLEEP_SECONDS = 5;
+/** Subject prefix for the auto-generated release-prep commit. */
+export const RELEASE_COMMIT_SUBJECT_PREFIX = "chore(release): v";
+/** Short usage line emitted by argparse on parse errors (not full --help). */
+export const ROLLBACK_USAGE_SHORT = "usage: release_rollback [-h] [--dry-run] [--repo OWNER/REPO]\n" +
+    "                        [--base-branch BRANCH] [--project-root PATH]\n" +
+    "                        [--allow-low-downloads N] [--allow-data-loss]\n" +
+    "                        [--force-strict-0]\n" +
+    "                        version\n";
+/** Byte-identical argparse --help from scripts/release_rollback.py (Python 3.12). */
+export const ROLLBACK_HELP = "usage: release_rollback [-h] [--dry-run] [--repo OWNER/REPO]\n" +
+    "                        [--base-branch BRANCH] [--project-root PATH]\n" +
+    "                        [--allow-low-downloads N] [--allow-data-loss]\n" +
+    "                        [--force-strict-0]\n" +
+    "                        version\n" +
+    "\n" +
+    "State-aware release unwind (#716 safety hardening). Detects one of four post-\n" +
+    "release states (local-only / tag-pushed / released-low-downloads / released-\n" +
+    "high-downloads) and applies the matching tiered recovery.\n" +
+    "\n" +
+    "positional arguments:\n" +
+    "  version               Release version, e.g. 0.21.0 (no leading 'v', strict\n" +
+    "                        X.Y.Z).\n" +
+    "\n" +
+    "options:\n" +
+    "  -h, --help            show this help message and exit\n" +
+    "  --dry-run             Print the rollback plan without invoking gh / git\n" +
+    "                        side-effects.\n" +
+    "  --repo OWNER/REPO     Override repo (default: resolved from `git remote get-\n" +
+    "                        url origin`).\n" +
+    "  --base-branch BRANCH  Base branch (default: master).\n" +
+    "  --project-root PATH   Repository root (default: $DEFT_PROJECT_ROOT or\n" +
+    "                        scripts/.. ).\n" +
+    "  --allow-low-downloads N\n" +
+    "                        Accept up to N downloads (defaults to the time-window-\n" +
+    "                        derived value). The maximum of this flag and the time-\n" +
+    "                        window default wins, so passing N=5 with a 10-min-old\n" +
+    "                        release still allows up to 10.\n" +
+    "  --allow-data-loss     Accept any download count; explicit acknowledgment of\n" +
+    "                        consumer impact. Required when the release is > 30\n" +
+    "                        minutes old.\n" +
+    "  --force-strict-0      Override the time-window: require exactly 0 downloads\n" +
+    "                        regardless of release age. Use for security-incident\n" +
+    "                        hot-rollbacks where even bot scrapes are unacceptable.\n";
+//# sourceMappingURL=constants.js.map

package/dist/release-rollback/flags.d.ts

@@ -0,0 +1,4 @@
+import type { RollbackFlags } from "./types.js";
+export declare function parseRollbackFlags(args: readonly string[]): RollbackFlags;
+export declare function formatRollbackHelp(): string;
+//# sourceMappingURL=flags.d.ts.map

package/dist/release-rollback/flags.js

@@ -0,0 +1,136 @@
+import { DEFAULT_BASE_BRANCH } from "../release/constants.js";
+import { ROLLBACK_HELP } from "./constants.js";
+function isFlagToken(value) {
+    if (!value.startsWith("-")) {
+        return false;
+    }
+    if (value.startsWith("--")) {
+        return true;
+    }
+    // Single-dash letter flags (e.g. -h), not negative numbers (e.g. -1).
+    return /^-[a-zA-Z]/.test(value);
+}
+export function parseRollbackFlags(args) {
+    let help = false;
+    let dryRun = false;
+    let allowDataLoss = false;
+    let forceStrict0 = false;
+    let allowLowDownloads = 0;
+    let repo = null;
+    let baseBranch = DEFAULT_BASE_BRANCH;
+    let projectRoot = null;
+    let version = null;
+    const unknown = [];
+    let parseError = null;
+    const takeValue = (flag, i) => {
+        if (i + 1 >= args.length) {
+            unknown.push(`${flag} (missing value)`);
+            return null;
+        }
+        return args[i + 1] ?? null;
+    };
+    let i = 0;
+    while (i < args.length) {
+        const token = args[i] ?? "";
+        if (token === "-h" || token === "--help") {
+            help = true;
+        }
+        else if (token === "--dry-run") {
+            dryRun = true;
+        }
+        else if (token === "--allow-data-loss") {
+            allowDataLoss = true;
+        }
+        else if (token === "--force-strict-0") {
+            forceStrict0 = true;
+        }
+        else if (token === "--repo") {
+            repo = takeValue(token, i);
+            if (repo !== null)
+                i += 1;
+        }
+        else if (token.startsWith("--repo=")) {
+            repo = token.slice("--repo=".length) || null;
+            if (!repo)
+                unknown.push("--repo= (empty value)");
+        }
+        else if (token === "--base-branch") {
+            const v = takeValue(token, i);
+            if (v !== null) {
+                baseBranch = v;
+                i += 1;
+            }
+        }
+        else if (token.startsWith("--base-branch=")) {
+            const v = token.slice("--base-branch=".length);
+            if (v)
+                baseBranch = v;
+            else
+                unknown.push("--base-branch= (empty value)");
+        }
+        else if (token === "--project-root") {
+            projectRoot = takeValue(token, i);
+            if (projectRoot !== null)
+                i += 1;
+        }
+        else if (token.startsWith("--project-root=")) {
+            projectRoot = token.slice("--project-root=".length) || null;
+            if (!projectRoot)
+                unknown.push("--project-root= (empty value)");
+        }
+        else if (token === "--allow-low-downloads") {
+            if (i + 1 >= args.length) {
+                parseError = "argument --allow-low-downloads: expected one argument";
+            }
+            else {
+                const v = args[i + 1] ?? "";
+                if (isFlagToken(v)) {
+                    parseError = "argument --allow-low-downloads: expected one argument";
+                }
+                else {
+                    const parsed = Number.parseInt(v, 10);
+                    allowLowDownloads = Number.isNaN(parsed) ? 0 : parsed;
+                    i += 1;
+                }
+            }
+        }
+        else if (token.startsWith("--allow-low-downloads=")) {
+            const v = token.slice("--allow-low-downloads=".length);
+            const parsed = Number.parseInt(v, 10);
+            allowLowDownloads = Number.isNaN(parsed) ? 0 : parsed;
+        }
+        else if (token.startsWith("-")) {
+            unknown.push(token);
+        }
+        else if (version === null) {
+            version = token;
+        }
+        else {
+            unknown.push(token);
+        }
+        i += 1;
+        // argparse aborts on the first parse error and never reaches later tokens;
+        // match that so a swallowed value (e.g. `--allow-low-downloads --dry-run`)
+        // cannot leak the following flag into a parsed field.
+        if (parseError !== null) {
+            break;
+        }
+    }
+    return {
+        help,
+        version,
+        repo,
+        baseBranch,
+        projectRoot,
+        dryRun,
+        allowLowDownloads,
+        allowDataLoss,
+        forceStrict0,
+        unknown,
+        parseError,
+    };
+}
+export function formatRollbackHelp() {
+    return ROLLBACK_HELP;
+}
+//# sourceMappingURL=flags.js.map

package/dist/release-rollback/gh.d.ts

@@ -0,0 +1,5 @@
+import type { GhReleasePayload, RollbackSeams } from "./types.js";
+export declare function ghReleaseViewJson(version: string, repo: string, seams?: RollbackSeams): [boolean, GhReleasePayload | null, string];
+export declare function ghReleaseExists(version: string, repo: string, seams?: RollbackSeams): ["exists" | "not-found" | "error", GhReleasePayload | null, string];
+export declare function ghReleaseDelete(version: string, repo: string, seams?: RollbackSeams): [boolean, string];
+//# sourceMappingURL=gh.d.ts.map

package/dist/release-rollback/gh.js

@@ -0,0 +1,71 @@
+import { resolveGh, spawnText } from "../release/index.js";
+export function ghReleaseViewJson(version, repo, seams = {}) {
+    if (seams.ghReleaseViewJson) {
+        return seams.ghReleaseViewJson(version, repo);
+    }
+    const ghPath = resolveGh(seams);
+    if (ghPath === null) {
+        return [false, null, "gh CLI not found on PATH"];
+    }
+    const tag = `v${version}`;
+    const spawn = seams.spawnText ?? spawnText;
+    try {
+        const result = spawn(ghPath, [
+            "release",
+            "view",
+            tag,
+            "--repo",
+            repo,
+            "--json",
+            "isDraft,name,tagName,createdAt,publishedAt,assets,url",
+        ], {
+            timeoutMs: 60_000,
+            env: { ...process.env },
+        });
+        if (result.status !== 0) {
+            return [false, null, result.stderr.trim()];
+        }
+        try {
+            return [true, JSON.parse(result.stdout), ""];
+        }
+        catch (exc) {
+            return [false, null, `non-JSON: ${String(exc)}`];
+        }
+    }
+    catch {
+        return [false, null, "gh CLI not found on PATH"];
+    }
+}
+export function ghReleaseExists(version, repo, seams = {}) {
+    const [ok, payload, reason] = ghReleaseViewJson(version, repo, seams);
+    if (ok) {
+        return ["exists", payload, ""];
+    }
+    const lowered = reason.toLowerCase();
+    if (lowered.includes("not found")) {
+        return ["not-found", null, reason];
+    }
+    return ["error", null, reason];
+}
+export function ghReleaseDelete(version, repo, seams = {}) {
+    const ghPath = resolveGh(seams);
+    if (ghPath === null) {
+        return [false, "gh CLI not found on PATH"];
+    }
+    const tag = `v${version}`;
+    const spawn = seams.spawnText ?? spawnText;
+    try {
+        const result = spawn(ghPath, ["release", "delete", tag, "--repo", repo, "--yes", "--cleanup-tag"], {
+            timeoutMs: 60_000,
+            env: { ...process.env },
+        });
+        if (result.status !== 0) {
+            return [false, `gh release delete failed: ${result.stderr.trim()}`];
+        }
+        return [true, `deleted release ${tag} (with tag cleanup)`];
+    }
+    catch {
+        return [false, "gh CLI not found on PATH"];
+    }
+}
+//# sourceMappingURL=gh.js.map

package/dist/release-rollback/git.d.ts

@@ -0,0 +1,9 @@
+import type { RollbackSeams } from "./types.js";
+export declare function gitTagExistsLocal(projectRoot: string, version: string, seams?: RollbackSeams): boolean;
+export declare function gitTagExistsOrigin(projectRoot: string, version: string, seams?: RollbackSeams): boolean;
+export declare function gitDeleteLocalTag(projectRoot: string, version: string, seams?: RollbackSeams): [boolean, string];
+export declare function gitDeleteRemoteTag(projectRoot: string, version: string, seams?: RollbackSeams): [boolean, string];
+export declare function resolveReleasePrepSha(projectRoot: string, version: string, seams?: RollbackSeams): [string, string];
+export declare function gitRevertReleaseCommit(projectRoot: string, releasePrepSha: string, seams?: RollbackSeams): [boolean, string];
+export declare function gitPushBase(projectRoot: string, baseBranch: string, seams?: RollbackSeams): [boolean, string];
+//# sourceMappingURL=git.d.ts.map

package/dist/release-rollback/git.js

@@ -0,0 +1,87 @@
+import { runGit } from "../release/git.js";
+import { RELEASE_COMMIT_SUBJECT_PREFIX } from "./constants.js";
+export function gitTagExistsLocal(projectRoot, version, seams = {}) {
+    const tag = `v${version}`;
+    const result = runGit(projectRoot, ["tag", "-l", tag], seams);
+    return Boolean(result.stdout.trim());
+}
+export function gitTagExistsOrigin(projectRoot, version, seams = {}) {
+    const tag = `v${version}`;
+    const result = runGit(projectRoot, ["ls-remote", "--tags", "origin", `refs/tags/${tag}`], seams);
+    return Boolean(result.stdout.trim());
+}
+export function gitDeleteLocalTag(projectRoot, version, seams = {}) {
+    const tag = `v${version}`;
+    const result = runGit(projectRoot, ["tag", "-d", tag], seams);
+    if (result.status !== 0) {
+        return [false, `git tag -d failed: ${result.stderr.trim()}`];
+    }
+    return [true, `deleted local tag ${tag}`];
+}
+export function gitDeleteRemoteTag(projectRoot, version, seams = {}) {
+    const tag = `v${version}`;
+    const result = runGit(projectRoot, ["push", "--delete", "origin", tag], seams);
+    if (result.status !== 0) {
+        return [false, `git push --delete failed: ${result.stderr.trim()}`];
+    }
+    return [true, `deleted remote tag ${tag}`];
+}
+export function resolveReleasePrepSha(projectRoot, version, seams = {}) {
+    const tag = `v${version}`;
+    const revParse = runGit(projectRoot, ["rev-parse", `${tag}^{commit}`], seams);
+    if (revParse.status === 0) {
+        const sha = (revParse.stdout || "").trim();
+        if (sha) {
+            return [sha, ""];
+        }
+    }
+    const grepPattern = `^${RELEASE_COMMIT_SUBJECT_PREFIX}${version}`;
+    const grep = runGit(projectRoot, ["log", "--grep", grepPattern, "--format=%H", "-n", "1"], seams);
+    if (grep.status === 0) {
+        const lines = (grep.stdout || "").trim().split(/\r?\n/);
+        if (lines.length > 0) {
+            const sha = lines[0];
+            if (sha) {
+                return [sha, ""];
+            }
+        }
+    }
+    return [
+        "",
+        `could not resolve release-prep SHA for v${version} ` +
+            `(tried \`git rev-parse ${tag}^{commit}\` and ` +
+            `\`git log --grep='${grepPattern}'\`)`,
+    ];
+}
+export function gitRevertReleaseCommit(projectRoot, releasePrepSha, seams = {}) {
+    const result = runGit(projectRoot, ["revert", releasePrepSha, "--no-edit"], seams);
+    if (result.status === 0) {
+        return [
+            true,
+            `reverted release-prep commit ${releasePrepSha.slice(0, 12)} ` +
+                "(forward revert; no force-push required)",
+        ];
+    }
+    const abort = runGit(projectRoot, ["revert", "--abort"], seams);
+    let abortNote = "";
+    if (abort.status !== 0) {
+        abortNote = ` (additionally, \`git revert --abort\` failed: ${abort.stderr.trim()})`;
+    }
+    const stderr = (result.stderr || "").trim();
+    return [
+        false,
+        `git revert ${releasePrepSha.slice(0, 12)} conflicted: ${stderr}${abortNote}. ` +
+            `Manual recovery: re-run \`git revert ${releasePrepSha} --no-edit\`, ` +
+            "resolve conflicts (typically CHANGELOG.md / ROADMAP.md), " +
+            "`git revert --continue`, then `git push origin <base-branch>`. " +
+            "See the Manual recovery section in scripts/release_rollback.py.",
+    ];
+}
+export function gitPushBase(projectRoot, baseBranch, seams = {}) {
+    const result = runGit(projectRoot, ["push", "origin", baseBranch], seams);
+    if (result.status !== 0) {
+        return [false, `git push failed: ${result.stderr.trim()}`];
+    }
+    return [true, `pushed ${baseBranch} to origin (no force)`];
+}
+//# sourceMappingURL=git.js.map

package/dist/release-rollback/guard.d.ts

@@ -0,0 +1,12 @@
+import type { GhReleasePayload, RollbackSeams } from "./types.js";
+export declare function sumDownloads(payload: GhReleasePayload): number;
+export declare function releaseAgeSeconds(payload: GhReleasePayload, now?: Date): number;
+export declare function computeThreshold(ageSeconds: number, options: {
+    allowLowDownloads: number;
+    allowDataLoss: boolean;
+    forceStrict0: boolean;
+}): [number | null, string];
+export declare function doubleReadDownloads(version: string, repo: string, options?: {
+    sleepSeconds?: number;
+}, seams?: RollbackSeams): [boolean, number, number, string];
+//# sourceMappingURL=guard.d.ts.map