@deftai/directive-core 0.73.0 → 0.74.0

package/dist/branch/evaluate.js

@@ -1,5 +1,6 @@
 import { recordBypassSignal, recordGateCatch } from "../events/attribution-ledger.js";
 import { disclosureLine } from "../policy/disclosure.js";
+import { policyColonInvocation } from "../policy/policy-invocation.js";
 import { ENV_BYPASS, resolvePolicy } from "../policy/resolve.js";
 import { currentBranch, GitNotFoundError } from "./git.js";
 export const DEFAULT_BRANCHES = new Set(["master", "main"]);
@@ -32,7 +33,7 @@ function buildBlockMessage(branch, result) {
     if (result.deprecationWarning !== null) {
         parts.push(`  Note: ${result.deprecationWarning}`);
     }
-    parts.push("", "  How to proceed:", "    • Create a feature branch:  git switch -c feat/<name>", "    • Or opt out via the typed surface:", "        task policy:allow-direct-commits -- --confirm", `    • Or set the emergency-escape env-var:  ${ENV_BYPASS}=1`, "", "  See README.md (Branch policy) and skills/deft-directive-setup/", "  Phase 2 Step 9 (capability-cost disclosure).");
+    parts.push("", "  How to proceed:", "    • Create a feature branch:  git switch -c feat/<name>", "    • Or opt out via the typed surface:", `        ${policyColonInvocation("allow-direct-commits", " -- --confirm")}`, `    • Or set the emergency-escape env-var:  ${ENV_BYPASS}=1`, "", "  See README.md (Branch policy) and skills/deft-directive-setup/", "  Phase 2 Step 9 (capability-cost disclosure).");
     return parts.join("\n");
 }
 /**

package/dist/check/orchestrator.d.ts

@@ -19,10 +19,13 @@ export interface CheckOrchestratorSeams {
     readonly spawnFn?: (cmd: string, args: string[], opts: {
         cwd: string;
         stdio: string;
+        env?: NodeJS.ProcessEnv;
     }) => {
         status: number | null;
         error?: Error;
     };
+    /** Child-process environment (default: process.env). */
+    readonly env?: NodeJS.ProcessEnv;
 }
 /**
  * True when `path` is the directive framework source checkout root (not a

package/dist/check/orchestrator.js

@@ -77,6 +77,7 @@ export function dispatchTaskCheck(frameworkRoot, projectRoot, seams = {}) {
     const result = spawn(taskBin, [target, "--taskfile", taskfilePath], {
         cwd,
         stdio: "inherit",
+        env: seams.env,
     });
     if (result.error !== undefined) {
         process.stderr.write(`check: failed to invoke task: ${result.error.message}\n`);
@@ -88,7 +89,7 @@ function defaultSpawn(cmd, args, opts) {
     const result = spawnSync(cmd, args, {
         cwd: opts.cwd,
         stdio: opts.stdio,
-        env: { ...process.env },
+        env: opts.env ?? process.env,
     });
     return { status: result.status, error: result.error };
 }

package/dist/codebase/map.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { assertProjectionContained } from "../fs/projection-containment.js";
 import { resolveProjectDefinitionPath } from "../layout/resolve.js";
 import { extractCodeStructure, loadJsonFile } from "../verify-source/code-structure-validate.js";
 import { CodeStructureConfigError, configErrorToDict, defaultCodeStructurePath, } from "./default-extractor.js";
@@ -239,6 +240,7 @@ export function writeCodebaseMap(projectRoot, options) {
     const resolvedOutput = isAbsolute(options.outputPath)
         ? options.outputPath
         : join(projectRoot, options.outputPath);
+    assertProjectionContained(projectRoot, resolvedOutput);
     if (!options.force && !isDeftGenerated(resolvedOutput)) {
         throw new Error(`refusing to overwrite non-generated MAP at ${resolvedOutput}; ` +
             `missing '${GENERATED_SENTINEL}' banner`);

package/dist/deposit/copy-tree.js

@@ -7,12 +7,29 @@
  *
  * Refs #1942 S1, #1477.
  */
-import { createReadStream, createWriteStream } from "node:fs";
-import { chmod, lstat, mkdir, readdir, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, readFile, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { pipeline } from "node:stream/promises";
 const DEFAULT_FILE_MODE = 0o644;
 const DEFAULT_DIR_MODE = 0o755;
+async function assertDestinationIsNotSymlink(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink()) {
+            throw new Error(`copyTree: refusing to write through destination symlink ${path}`);
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith("copyTree: refusing")) {
+            throw err;
+        }
+        if (err.code === "ENOENT") {
+            // Missing paths are created by the caller; only pre-existing symlinks matter.
+            return;
+        }
+        throw err;
+    }
+}
 async function copyFilePreserveMode(src, dst) {
     let mode = DEFAULT_FILE_MODE;
     try {
@@ -23,12 +40,19 @@ async function copyFilePreserveMode(src, dst) {
         // Stat failure is non-fatal — fall back to 0o644 (mirrors Go copyFile).
     }
     await mkdir(dirname(dst), { recursive: true, mode: DEFAULT_DIR_MODE });
-    await pipeline(createReadStream(src), createWriteStream(dst, { mode }));
-    // createWriteStream mode applies on create; chmod ensures the final bits match
-    // the source even when the destination file already existed.
-    await chmod(dst, mode);
+    await assertDestinationIsNotSymlink(dst);
+    const handle = await open(dst, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, mode);
+    try {
+        await handle.writeFile(await readFile(src));
+        // Use the opened handle, not the path, so chmod cannot follow a swapped symlink.
+        await handle.chmod(mode);
+    }
+    finally {
+        await handle.close();
+    }
 }
 async function copyDirContents(src, dst) {
+    await assertDestinationIsNotSymlink(dst);
     await mkdir(dst, { recursive: true, mode: DEFAULT_DIR_MODE });
     const entries = await readdir(src, { withFileTypes: true });
     for (const entry of entries) {

package/dist/doctor/checks.d.ts

@@ -30,6 +30,15 @@ export declare function checkCanonicalVendoredNpmSignpost(projectRoot: string, s
  * deposit is still a working install, just an unpinned one.
  */
 export declare function checkManifestVersionReportable(projectRoot: string, installRoot: string | null, seams?: CheckSeams): CheckResult;
+/** Relative path to the deposited v0.6 schema file superseded by xbrief-core-0.8.schema.json. */
+export declare const STALE_VBRIEF_CORE_SCHEMA_REL: string;
+/**
+ * #2368: on an already-migrated xbrief/ layout, a stale deposited
+ * `xbrief/schemas/vbrief-core.schema.json` (vBRIEFInfo v0.6) must NOT route
+ * operators to `migrate:xbrief` — that verb requires a vbrief/ tree. Point at
+ * `directive update` instead. Advisory only (exit-exempt).
+ */
+export declare function checkStaleXbriefSchemaDeposit(projectRoot: string, seams?: CheckSeams): CheckResult;
 /**
  * #2206: check that the consumer `.gitignore` carries the canonical Deft baseline
  * entries. Advisory (exit-exempt) because missing entries are an adoption risk, not

package/dist/doctor/checks.js

@@ -5,6 +5,8 @@ import { detectCanonicalVendoredManifest, isNpmManaged, NPM_MANAGED_SENTINEL_KEY
 import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { findSkillPathsInText } from "../text/redos-safe.js";
 import { stripGitignoreInlineComment } from "../triage/bootstrap/gitignore.js";
+import { LEGACY_INFO_ROOT_KEY, MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
+import { detectXbriefConvergence } from "../xbrief-migrate/detect.js";
 import { CANONICAL_UPGRADE_COMMAND, GO_BRIDGE_RELEASES_URL, UPGRADING_DOC_URL, } from "./constants.js";
 import { isDeprecationRedirectStub, locateManifest, manifestCandidatePaths, manifestReportableVersion, manifestTagToVersion, parseInstallManifest, parseInstallRootFromAgentsMd, parseManifest, } from "./manifest.js";
 import { readTextSafe } from "./paths.js";
@@ -459,6 +461,68 @@ function collectGitignorePresent(text) {
 function gitignoreLineIsCovered(present, line) {
     return present.has(line);
 }
+/** Relative path to the deposited v0.6 schema file superseded by xbrief-core-0.8.schema.json. */
+export const STALE_VBRIEF_CORE_SCHEMA_REL = join(MIGRATED_ARTIFACT_DIR, "schemas", "vbrief-core.schema.json");
+const MIGRATED_XBRIEF_LAYOUT_STATES = new Set([
+    "xbrief-only",
+    "xbrief-marker",
+]);
+/**
+ * #2368: on an already-migrated xbrief/ layout, a stale deposited
+ * `xbrief/schemas/vbrief-core.schema.json` (vBRIEFInfo v0.6) must NOT route
+ * operators to `migrate:xbrief` — that verb requires a vbrief/ tree. Point at
+ * `directive update` instead. Advisory only (exit-exempt).
+ */
+export function checkStaleXbriefSchemaDeposit(projectRoot, seams = {}) {
+    const checkName = "stale-xbrief-schema-deposit";
+    const convergence = detectXbriefConvergence(projectRoot);
+    if (!MIGRATED_XBRIEF_LAYOUT_STATES.has(convergence.state)) {
+        return {
+            name: checkName,
+            status: "skip",
+            detail: "Project is not on a fully migrated xbrief/ layout; stale schema deposit check does not apply.",
+            data: { convergence_state: convergence.state },
+        };
+    }
+    const schemaPath = join(projectRoot, STALE_VBRIEF_CORE_SCHEMA_REL);
+    const isFile = seams.isFile ?? ((p) => readText(p, seams) !== null);
+    if (!isFile(schemaPath)) {
+        return {
+            name: checkName,
+            status: "skip",
+            detail: `No deposited schema at ${STALE_VBRIEF_CORE_SCHEMA_REL}.`,
+            data: { schema_path: schemaPath },
+        };
+    }
+    const text = readText(schemaPath, seams);
+    if (text === null) {
+        return {
+            name: checkName,
+            status: "skip",
+            detail: `Deposited schema at ${STALE_VBRIEF_CORE_SCHEMA_REL} is unreadable.`,
+            data: { schema_path: schemaPath },
+        };
+    }
+    if (!text.includes(`"${LEGACY_INFO_ROOT_KEY}"`)) {
+        return {
+            name: checkName,
+            status: "pass",
+            detail: `Deposited schema at ${STALE_VBRIEF_CORE_SCHEMA_REL} is current (no ${LEGACY_INFO_ROOT_KEY} root key).`,
+            data: { schema_path: schemaPath },
+        };
+    }
+    return {
+        name: checkName,
+        status: "fail",
+        detail: `Stale deposited schema at ${STALE_VBRIEF_CORE_SCHEMA_REL} still carries the legacy ${LEGACY_INFO_ROOT_KEY} root key on an already-migrated xbrief/ layout. ` +
+            "Run `directive update` to refresh deposited schema files — not `deft migrate:xbrief` (no vbrief/ tree remains to convert).",
+        data: {
+            schema_path: schemaPath,
+            convergence_state: convergence.state,
+            suggested_fix: "directive update",
+        },
+    };
+}
 /**
  * #2206: check that the consumer `.gitignore` carries the canonical Deft baseline
  * entries. Advisory (exit-exempt) because missing entries are an adoption risk, not
@@ -515,6 +579,7 @@ export function deriveExitCode(checks, errors) {
         "canonical-vendored-npm-signpost",
         "manifest-version-reportable",
         "gitignore-coverage",
+        "stale-xbrief-schema-deposit",
     ]);
     if (errors.length > 0 || checks.some((c) => c.status === "error")) {
         return 2;
@@ -554,6 +619,7 @@ export function runChecksImpl(projectRoot, seams = {}) {
         checks.push(checkManifestVersionReportable(projectRoot, null, seams));
         checks.push(checkLegacyLayout(projectRoot, seams));
         checks.push(checkCanonicalVendoredNpmSignpost(projectRoot, seams));
+        checks.push(checkStaleXbriefSchemaDeposit(projectRoot, seams));
         checks.push(checkGitignoreCoverage(projectRoot, seams));
         return {
             projectRoot,
@@ -570,6 +636,7 @@ export function runChecksImpl(projectRoot, seams = {}) {
     checks.push(checkInstallPathConsistency(projectRoot, installRoot, seams));
     checks.push(checkLegacyLayout(projectRoot, seams));
     checks.push(checkCanonicalVendoredNpmSignpost(projectRoot, seams));
+    checks.push(checkStaleXbriefSchemaDeposit(projectRoot, seams));
     checks.push(checkGitignoreCoverage(projectRoot, seams));
     return {
         projectRoot,

package/dist/doctor/main.js

@@ -374,7 +374,8 @@ function runInstallIntegrityChecks(projectRoot, sink, addFinding, seams) {
             if ((name === "legacy-layout" ||
                 name === "canonical-vendored-npm-signpost" ||
                 name === "manifest-version-reportable" ||
-                name === "gitignore-coverage") &&
+                name === "gitignore-coverage" ||
+                name === "stale-xbrief-schema-deposit") &&
                 status === "fail") {
                 sink.warn(`${name}: ${detail}`);
                 addFinding({

package/dist/fs/projection-containment.d.ts

@@ -0,0 +1,35 @@
+/**
+ * projection-containment.ts — repo-controlled projection symlink guard (#2413).
+ *
+ * Projection writers (`codebase:map`, `triage:bootstrap`) write to well-known
+ * paths such as `.planning/codebase/MAP.md`, `.gitignore`, and `.gitattributes`.
+ * If a malicious repo author commits one of those paths (or a parent) as a
+ * symlink escaping the project tree, routine operator commands would follow the
+ * link and create/overwrite files outside the checkout.
+ *
+ * `assertProjectionContained` anchors on `realpath(projectDir)`, walks each
+ * existing component down to the write target, rejects symlinks that escape the
+ * tree, and asserts the deepest existing ancestor stays under the project root.
+ *
+ * Refs #2413.
+ */
+/** Non-zero exit code for a projection-containment refusal (needs-action). */
+export declare const PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE = 2;
+/** Thrown when a projection write target escapes the project tree. */
+export declare class ProjectionContainmentError extends Error {
+    readonly projectDir: string;
+    readonly targetPath: string;
+    readonly offendingPath: string;
+    constructor(message: string, details: {
+        projectDir: string;
+        targetPath: string;
+        offendingPath: string;
+    });
+}
+/**
+ * Refuse projection writes when the target (or a parent) is a symlink that
+ * escapes the resolved project tree. Throws {@link ProjectionContainmentError};
+ * MUST be called BEFORE any projection read/write/mkdir.
+ */
+export declare function assertProjectionContained(projectDir: string, targetPath: string): void;
+//# sourceMappingURL=projection-containment.d.ts.map

package/dist/fs/projection-containment.js

@@ -0,0 +1,118 @@
+/**
+ * projection-containment.ts — repo-controlled projection symlink guard (#2413).
+ *
+ * Projection writers (`codebase:map`, `triage:bootstrap`) write to well-known
+ * paths such as `.planning/codebase/MAP.md`, `.gitignore`, and `.gitattributes`.
+ * If a malicious repo author commits one of those paths (or a parent) as a
+ * symlink escaping the project tree, routine operator commands would follow the
+ * link and create/overwrite files outside the checkout.
+ *
+ * `assertProjectionContained` anchors on `realpath(projectDir)`, walks each
+ * existing component down to the write target, rejects symlinks that escape the
+ * tree, and asserts the deepest existing ancestor stays under the project root.
+ *
+ * Refs #2413.
+ */
+import { lstatSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+/** Non-zero exit code for a projection-containment refusal (needs-action). */
+export const PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE = 2;
+/** Thrown when a projection write target escapes the project tree. */
+export class ProjectionContainmentError extends Error {
+    projectDir;
+    targetPath;
+    offendingPath;
+    constructor(message, details) {
+        super(message);
+        this.name = "ProjectionContainmentError";
+        this.projectDir = details.projectDir;
+        this.targetPath = details.targetPath;
+        this.offendingPath = details.offendingPath;
+    }
+}
+/**
+ * Path-SEGMENT containment: is `child` equal to `parent` or nested under it?
+ * Uses `path.relative` so `/foo` is NOT treated as containing `/foobar`.
+ */
+function isContained(parent, child) {
+    if (parent === child) {
+        return true;
+    }
+    const rel = relative(parent, child);
+    return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}
+/**
+ * Refuse projection writes when the target (or a parent) is a symlink that
+ * escapes the resolved project tree. Throws {@link ProjectionContainmentError};
+ * MUST be called BEFORE any projection read/write/mkdir.
+ */
+export function assertProjectionContained(projectDir, targetPath) {
+    const projectAbs = resolve(projectDir);
+    let projectReal;
+    try {
+        projectReal = realpathSync(projectAbs);
+    }
+    catch {
+        throw new ProjectionContainmentError(`projection write refused: project directory ${projectAbs} does not exist`, { projectDir: projectAbs, targetPath: resolve(targetPath), offendingPath: projectAbs });
+    }
+    const targetAbs = resolve(targetPath);
+    const rel = relative(projectAbs, targetAbs);
+    if (rel.length === 0 || rel.startsWith("..") || isAbsolute(rel)) {
+        throw new ProjectionContainmentError(`projection write refused: target ${targetAbs} is not nested under the project tree ${projectAbs}`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: targetAbs });
+    }
+    const segments = rel.split(/[\\/]+/).filter((segment) => segment.length > 0);
+    let current = projectAbs;
+    let deepestExistingReal = projectReal;
+    for (const segment of segments) {
+        current = join(current, segment);
+        let info;
+        try {
+            info = lstatSync(current);
+        }
+        catch {
+            break;
+        }
+        if (info.isSymbolicLink()) {
+            let linkReal;
+            try {
+                linkReal = realpathSync(current);
+            }
+            catch {
+                throw new ProjectionContainmentError(`projection write refused: ${current} is a broken/dangling symlink on the projection path`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: current });
+            }
+            if (!isContained(projectReal, linkReal)) {
+                throw new ProjectionContainmentError(`projection write refused: ${current} is a symlink escaping the project tree ` +
+                    `(resolves to ${linkReal}, outside ${projectReal})`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: current });
+            }
+            deepestExistingReal = linkReal;
+            current = linkReal;
+        }
+        else {
+            try {
+                deepestExistingReal = realpathSync(current);
+            }
+            catch (err) {
+                throw new ProjectionContainmentError(`projection write refused: could not resolve ${current} on the projection path`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: current });
+            }
+        }
+    }
+    try {
+        const targetReal = realpathSync(targetAbs);
+        if (!isContained(projectReal, targetReal)) {
+            throw new ProjectionContainmentError(`projection write refused: projection target resolves outside the project tree ` +
+                `(${targetReal} is outside ${projectReal})`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: targetReal });
+        }
+        deepestExistingReal = targetReal;
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw err;
+        }
+        // Target does not exist yet; parent walk above is sufficient.
+    }
+    if (!isContained(projectReal, deepestExistingReal)) {
+        throw new ProjectionContainmentError(`projection write refused: projection path escapes the project tree ` +
+            `(${deepestExistingReal} is outside ${projectReal})`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: deepestExistingReal });
+    }
+}
+//# sourceMappingURL=projection-containment.js.map

package/dist/init-deposit/hygiene.d.ts

@@ -17,6 +17,12 @@ export declare function installerManagedMatchers(): InstallerManagedMatcher[];
 export declare function installerManagedGuardEre(): string;
 export declare function isInstallerManagedPath(path: string): boolean;
 export interface FrameworkStagePathsOptions {
+    /**
+     * Include the vendored `.deft/core` payload in the stage set. Defaults to
+     * `true` for init and real payload swaps. No-op updates set this to `false`
+     * so CRLF-only core noise cannot be staged while safe projections are repaired.
+     */
+    readonly includeCore?: boolean;
     /**
      * Include the project-root ``Taskfile.yml`` in the stage set. Defaults to
      * ``false``: unlike the other allowlisted paths, ``Taskfile.yml`` is a

package/dist/init-deposit/hygiene.js

@@ -82,7 +82,10 @@ export function frameworkStagePaths(projectDir, deftDir, options = {}) {
         paths.push(normalized);
     };
     const relDeft = relative(projectDir, deftDir);
-    if (relDeft && !relDeft.startsWith("..") && !relDeft.startsWith("/")) {
+    if (options.includeCore !== false &&
+        relDeft &&
+        !relDeft.startsWith("..") &&
+        !relDeft.startsWith("/")) {
         add(relDeft);
     }
     for (const matcher of installerManagedMatchers()) {
@@ -228,6 +231,7 @@ function actuallyStagedPaths(stagePaths, cachedNames) {
 export function depositStagePaths(projectDir, options = {}) {
     const deftDir = join(projectDir, CANONICAL_INSTALL_ROOT);
     const stagePaths = frameworkStagePaths(projectDir, deftDir, {
+        includeCore: options.includeCore,
         includeTaskfile: options.includeTaskfile ?? false,
     });
     const { staged } = stageFrameworkPaths(projectDir, stagePaths, options);

package/dist/init-deposit/refresh.d.ts

@@ -22,12 +22,15 @@ export interface RefreshDepositResult {
     readonly contentVersion: string;
     readonly engineVersion: string;
     readonly previousDepositVersion: string | null;
+    readonly alreadyCurrent: boolean;
+    readonly strategy: RefreshDepositStrategy;
     readonly agentsMdUpdated: boolean;
     readonly versionSkewNotice: string | null;
     readonly legacyLayout: boolean;
     readonly taskfileWired: boolean;
     readonly stagedPaths: string[];
 }
+export type RefreshDepositStrategy = "file-swap" | "no-op";
 export interface RefreshDepositSeams {
     resolveContentRoot?: () => Promise<string>;
     copyContent?: (src: string, dst: string) => Promise<void>;
@@ -35,6 +38,7 @@ export interface RefreshDepositSeams {
     readEngineVersion?: () => string;
     nowIso?: () => string;
     gitPorcelain?: (projectRoot: string) => string | null;
+    gitSemanticDiffNames?: GitSemanticDiffNames;
     detectLegacy?: (projectDir: string) => LegacyLayoutDetection;
     /**
      * #2266: `git ls-files` probe threaded into the non-destructive `.gitignore`
@@ -101,9 +105,19 @@ export declare function buildDefaultLadderFacts(projectDir: string, facts: Resol
  * manual npm/PATH steps (#2266 a3).
  */
 export declare function selfHealEngine(projectDir: string, facts: ResolutionFacts, io: InitDepositIo, seams?: SelfHealSeams): EngineResolution;
+export type GitSemanticDiffNames = (projectRoot: string, paths: readonly string[]) => readonly string[] | null;
+export interface FrameworkRefreshSideEffectsOptions {
+    readonly readPorcelain?: (root: string) => string | null;
+    readonly readSemanticDiffNames?: GitSemanticDiffNames;
+}
+export interface RefreshSideEffects {
+    readonly files: string[];
+    readonly crlfOnlyCoreFiles: string[];
+    readonly payloadSwapped?: boolean;
+}
 /** Framework-managed uncommitted paths after refresh (#1671). */
-export declare function frameworkRefreshSideEffects(projectDir: string, readPorcelain?: (root: string) => string | null): string[];
-export declare function printRefreshSideEffects(io: InitDepositIo, files: readonly string[]): void;
+export declare function frameworkRefreshSideEffects(projectDir: string, options?: FrameworkRefreshSideEffectsOptions): RefreshSideEffects;
+export declare function printRefreshSideEffects(io: InitDepositIo, effects: RefreshSideEffects): void;
 export declare function buildVersionSkewNotice(engineVersion: string, contentVersion: string, previousDepositVersion: string | null): string | null;
 export declare function buildUpdateSummaryJson(result: RefreshDepositResult, options: RefreshDepositArgs, updateState?: UpdateState): Record<string, unknown>;
 export declare function printUpdateComplete(result: RefreshDepositResult, io: InitDepositIo, updateState?: UpdateState): void;