@deftai/directive-core 0.80.0 → 0.82.0

package/dist/pr-wait-mergeable/semantic-green.js

@@ -0,0 +1,202 @@
+import { buildCiSummaryLine, evaluateCiGate } from "../pr-merge-readiness/ci-gate.js";
+import { defaultRunGh, fetchCheckRunsRest } from "../pr-merge-readiness/gh.js";
+import { EXIT_CONFIG_ERROR, EXIT_TIMEOUT_OR_ESCALATION } from "./constants.js";
+function emptyPayload() {
+    return {
+        pr_base_sha: null,
+        target_branch: null,
+        target_head_sha: null,
+        master_ci: {},
+    };
+}
+function fetchPrBase(prNumber, repo, runGh) {
+    const rc = runGh(["gh", "api", `repos/${repo}/pulls/${prNumber}`]);
+    if (rc.returncode !== 0) {
+        return {
+            baseRef: null,
+            baseSha: null,
+            error: `gh api /pulls/${prNumber} failed: ${rc.stderr.trim()}`,
+        };
+    }
+    if (!rc.stdout.trim()) {
+        return { baseRef: null, baseSha: null, error: "empty body from gh api /pulls/<N>" };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rc.stdout);
+    }
+    catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        return { baseRef: null, baseSha: null, error: `could not parse PR JSON: ${message}` };
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        return { baseRef: null, baseSha: null, error: "unexpected PR JSON shape (not a dict)" };
+    }
+    const base = payload.base;
+    if (base === null || typeof base !== "object" || Array.isArray(base)) {
+        return { baseRef: null, baseSha: null, error: "PR JSON missing base object" };
+    }
+    const baseRecord = base;
+    const baseRef = typeof baseRecord.ref === "string" && baseRecord.ref.length > 0 ? baseRecord.ref : null;
+    const baseSha = typeof baseRecord.sha === "string" && baseRecord.sha.length > 0 ? baseRecord.sha : null;
+    if (baseRef === null || baseSha === null) {
+        return { baseRef, baseSha, error: "PR JSON missing base.ref or base.sha" };
+    }
+    return { baseRef, baseSha, error: null };
+}
+function fetchBranchHeadSha(repo, branch, runGh) {
+    const encoded = branch.split("/").map(encodeURIComponent).join("/");
+    const rc = runGh(["gh", "api", `repos/${repo}/git/ref/heads/${encoded}`]);
+    if (rc.returncode !== 0) {
+        return {
+            sha: null,
+            error: `gh api /git/ref/heads/${branch} failed: ${rc.stderr.trim()}`,
+        };
+    }
+    if (!rc.stdout.trim()) {
+        return { sha: null, error: `empty body from gh api /git/ref/heads/${branch}` };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rc.stdout);
+    }
+    catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        return { sha: null, error: `could not parse branch ref JSON: ${message}` };
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        return { sha: null, error: "unexpected branch ref JSON shape (not a dict)" };
+    }
+    const object = payload.object;
+    if (object === null || typeof object !== "object" || Array.isArray(object)) {
+        return { sha: null, error: "branch ref JSON missing object.sha" };
+    }
+    const sha = object.sha;
+    if (typeof sha !== "string" || sha.length === 0) {
+        return { sha: null, error: "branch ref JSON missing object.sha" };
+    }
+    return { sha, error: null };
+}
+function evaluateTargetBranchCi(repo, headSha, runGh) {
+    const check = fetchCheckRunsRest(headSha, repo, runGh);
+    if (check.error.length > 0) {
+        return {
+            ok: false,
+            error: "Required CI check-runs on target branch HEAD could not be fetched; " +
+                `fail closed (#2385). ${check.error}`,
+            masterCi: { ready_state: "blocked", error: check.error },
+        };
+    }
+    const ciResult = evaluateCiGate(check.checkRuns);
+    const masterCi = {
+        ...ciResult.summary,
+        summary_line: buildCiSummaryLine(ciResult.summary),
+    };
+    if (ciResult.summary.ready_state !== "ready") {
+        const detail = ciResult.failures.length > 0
+            ? ciResult.failures.join(" ")
+            : `target branch CI ready_state=${ciResult.summary.ready_state}`;
+        return {
+            ok: false,
+            error: "Target branch CI is not green at current HEAD; block cascade merge until master is green (#2385). " +
+                detail,
+            masterCi,
+        };
+    }
+    return { ok: true, error: null, masterCi };
+}
+/** Pre-merge semantic-green gate for merge cascades (#2385). */
+export function evaluateSemanticGreen(prNumber, repo, options = {}) {
+    if (options.cascadeMode !== true) {
+        return { ok: true, outcome: null, exitCode: null, error: null, payload: emptyPayload() };
+    }
+    const runGh = options.runGh ?? defaultRunGh;
+    const prBase = fetchPrBase(prNumber, repo, runGh);
+    if (prBase.error !== null) {
+        return {
+            ok: false,
+            outcome: "config-error",
+            exitCode: EXIT_CONFIG_ERROR,
+            error: prBase.error,
+            payload: {
+                ...emptyPayload(),
+                pr_base_sha: prBase.baseSha,
+                target_branch: prBase.baseRef,
+            },
+        };
+    }
+    const targetBranch = options.baseBranch ?? prBase.baseRef;
+    if (targetBranch === null || targetBranch.length === 0) {
+        return {
+            ok: false,
+            outcome: "config-error",
+            exitCode: EXIT_CONFIG_ERROR,
+            error: "Could not resolve target branch for semantic-green gate (--base-branch or PR base.ref).",
+            payload: {
+                pr_base_sha: prBase.baseSha,
+                target_branch: null,
+                target_head_sha: null,
+                master_ci: {},
+            },
+        };
+    }
+    const branchHead = fetchBranchHeadSha(repo, targetBranch, runGh);
+    if (branchHead.error !== null) {
+        return {
+            ok: false,
+            outcome: "config-error",
+            exitCode: EXIT_CONFIG_ERROR,
+            error: branchHead.error,
+            payload: {
+                pr_base_sha: prBase.baseSha,
+                target_branch: targetBranch,
+                target_head_sha: null,
+                master_ci: {},
+            },
+        };
+    }
+    const payload = {
+        pr_base_sha: prBase.baseSha,
+        target_branch: targetBranch,
+        target_head_sha: branchHead.sha,
+        master_ci: {},
+    };
+    if (prBase.baseSha !== branchHead.sha) {
+        return {
+            ok: false,
+            outcome: "semantic-stale-base",
+            exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+            error: "PR base SHA is behind the current target branch HEAD (merge-tree-clean but semantically stale). " +
+                `Rebase/update-branch onto ${targetBranch} at ${branchHead.sha} and wait for fresh green CI before cascade merge (#2385). ` +
+                `pr_base=${prBase.baseSha} target_head=${branchHead.sha}`,
+            payload,
+        };
+    }
+    if (options.requireMasterCiGreen === true) {
+        const ci = evaluateTargetBranchCi(repo, branchHead.sha, runGh);
+        if (!ci.ok) {
+            return {
+                ok: false,
+                outcome: "master-ci-not-green",
+                exitCode: EXIT_TIMEOUT_OR_ESCALATION,
+                error: ci.error,
+                payload: {
+                    ...payload,
+                    master_ci: ci.masterCi,
+                },
+            };
+        }
+        return {
+            ok: true,
+            outcome: null,
+            exitCode: null,
+            error: null,
+            payload: {
+                ...payload,
+                master_ci: ci.masterCi,
+            },
+        };
+    }
+    return { ok: true, outcome: null, exitCode: null, error: null, payload };
+}
+//# sourceMappingURL=semantic-green.js.map

package/dist/pr-wait-mergeable/types.d.ts

@@ -5,6 +5,7 @@ export interface WaitMergeableResult {
     readonly exitCode: number;
     readonly monitorResult: Record<string, unknown>;
     readonly protectedCheck: Record<string, unknown>;
+    readonly semanticGreen: Record<string, unknown>;
     readonly mergeStdout: string;
     readonly mergeStderr: string;
     readonly error: string | null;

package/dist/pr-watch/constants.d.ts

@@ -39,10 +39,10 @@ export declare const DEFAULT_POLL_SECONDS = 90;
  */
 export declare const WATCH_HELP: string;
 /**
- * Consecutive polls with a review PRESENT but stuck on a stale (non-HEAD)
- * commit before the loop surfaces STALL instead of waiting the full cap. Keeps
- * a Greptile review that never re-reviews the new HEAD from silently eating the
- * whole 30-minute budget (#1039 STALL terminal).
+ * Consecutive polls where the CLEAN gate is wedged on HEAD (!has_blocking &&
+ * !is_clean with a holdout other than sha_match) before STALL (#1039). Stale-SHA
+ * reads (sha_match holdout) do NOT advance this counter — re-review in flight
+ * waits until max-wait cap (#2313 / #1259 INCOMPLETE_BUT_RATED).
  */
 export declare const DEFAULT_STALL_THRESHOLD = 3;
 /**

package/dist/pr-watch/constants.js

@@ -61,10 +61,10 @@ export const WATCH_HELP = "usage: task pr:watch -- <pr_number> [options]\n" +
     "  1  NEW_P0_P1   Blocking findings on the current (SHA-matched) review\n" +
     "  2  ERRORED | STALL | TIMEOUT | CI_BLOCKED | RUNNER_CAPACITY_STALL | config / usage error\n";
 /**
- * Consecutive polls with a review PRESENT but stuck on a stale (non-HEAD)
- * commit before the loop surfaces STALL instead of waiting the full cap. Keeps
- * a Greptile review that never re-reviews the new HEAD from silently eating the
- * whole 30-minute budget (#1039 STALL terminal).
+ * Consecutive polls where the CLEAN gate is wedged on HEAD (!has_blocking &&
+ * !is_clean with a holdout other than sha_match) before STALL (#1039). Stale-SHA
+ * reads (sha_match holdout) do NOT advance this counter — re-review in flight
+ * waits until max-wait cap (#2313 / #1259 INCOMPLETE_BUT_RATED).
  */
 export const DEFAULT_STALL_THRESHOLD = 3;
 /**

package/dist/pr-watch/watch.js

@@ -99,9 +99,11 @@ export function watch(prNumber, repo, options = {}) {
         if (!oneShot && ciBlockedStreak >= DEFAULT_CI_BLOCKED_THRESHOLD) {
             return build(VERDICT_CI_BLOCKED, EXIT_TERMINAL_ERROR, probe, poll);
         }
-        // Stall = a review IS present but stuck on a non-HEAD commit; surface it
-        // rather than burning the whole cap waiting for a re-review that isn't coming.
-        if (probe.found && !probe.shaMatch) {
+        // STALL (#1039): wedged CLEAN-gate on HEAD — !has_blocking && !is_clean for N
+        // consecutive polls with a holdout OTHER than sha_match. Stale-SHA reads
+        // (clean_gate_holdout=sha_match) are INCOMPLETE for HEAD per #1259 / #2313 —
+        // keep polling until cap, not early STALL while re-review is in flight.
+        if (!probe.hasBlocking && !probe.isClean && probe.cleanGateHoldout !== "sha_match") {
             stallStreak += 1;
         }
         else {

package/dist/product-signal/actor-name.d.ts

@@ -0,0 +1,18 @@
+import { type RunGhApiFn } from "../scm/gh-rest.js";
+export type ActorNameSource = "user-md" | "gh-login" | "unnamed";
+export interface ResolvedActorName {
+    readonly actorName: string;
+    readonly actorNameSource: ActorNameSource;
+    readonly displayName: string;
+}
+/** Normalize for thread-key matching (#2693 D8). */
+export declare function normalizeActorKey(name: string): string;
+/** Parse addressing-name from USER.md Personal section (#2693 D8). */
+export declare function parseAddressingNameFromUserMd(text: string): string | null;
+export interface ResolveActorNameOptions {
+    readonly projectRoot?: string;
+    readonly runGhApiFn?: RunGhApiFn;
+}
+/** Resolve actorName with USER.md -> gh-login -> unnamed precedence (#2693 D8). */
+export declare function resolveActorName(options?: ResolveActorNameOptions): ResolvedActorName;
+//# sourceMappingURL=actor-name.d.ts.map

package/dist/product-signal/actor-name.js

@@ -0,0 +1,94 @@
+import { readFileSync } from "node:fs";
+import { runGhApi } from "../scm/gh-rest.js";
+import { resolveUserMdPath } from "../user-config/resolve-user-md.js";
+/** Normalize for thread-key matching (#2693 D8). */
+export function normalizeActorKey(name) {
+    return name.trim().replace(/\s+/g, " ").toLowerCase();
+}
+/** Parse addressing-name from USER.md Personal section (#2693 D8). */
+export function parseAddressingNameFromUserMd(text) {
+    const lines = text.split(/\r?\n/);
+    let inPersonal = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (/^##\s+personal\b/i.test(trimmed)) {
+            inPersonal = true;
+            continue;
+        }
+        if (inPersonal && /^##\s+/.test(trimmed)) {
+            break;
+        }
+        const nameMatch = trimmed.match(/^(?:-\s*)?(?:\*\*)?Name(?:\*\*)?\s*:\s*(.+)$/i) ??
+            trimmed.match(/^(?:-\s*)?(?:\*\*)?addressing-name(?:\*\*)?\s*:\s*(.+)$/i);
+        if (nameMatch?.[1] !== undefined) {
+            const value = nameMatch[1].replace(/\*\*/g, "").trim();
+            if (value.length > 0) {
+                return value;
+            }
+        }
+        if (!inPersonal) {
+            const topMatch = trimmed.match(/^(?:\*\*)?Name(?:\*\*)?\s*:\s*(.+)$/i);
+            if (topMatch?.[1] !== undefined) {
+                const value = topMatch[1].replace(/\*\*/g, "").trim();
+                if (value.length > 0) {
+                    return value;
+                }
+            }
+        }
+    }
+    return null;
+}
+function readGhLogin(runGhApiFn) {
+    try {
+        const result = (runGhApiFn ?? runGhApi)(["user"], { timeout: 15 });
+        if (result.returncode !== 0) {
+            return null;
+        }
+        const parsed = JSON.parse(result.stdout.trim());
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const login = parsed.login;
+            if (typeof login === "string" && login.trim().length > 0) {
+                return login.trim();
+            }
+        }
+    }
+    catch {
+        // best-effort
+    }
+    return null;
+}
+/** Resolve actorName with USER.md -> gh-login -> unnamed precedence (#2693 D8). */
+export function resolveActorName(options = {}) {
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const userMd = resolveUserMdPath({ projectRoot });
+    if (userMd.found) {
+        try {
+            const text = readFileSync(userMd.path, "utf8");
+            const fromUser = parseAddressingNameFromUserMd(text);
+            if (fromUser !== null) {
+                return {
+                    actorName: fromUser,
+                    actorNameSource: "user-md",
+                    displayName: fromUser,
+                };
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    const ghLogin = readGhLogin(options.runGhApiFn);
+    if (ghLogin !== null) {
+        return {
+            actorName: ghLogin,
+            actorNameSource: "gh-login",
+            displayName: ghLogin,
+        };
+    }
+    return {
+        actorName: "unnamed",
+        actorNameSource: "unnamed",
+        displayName: "unnamed",
+    };
+}
+//# sourceMappingURL=actor-name.js.map

package/dist/product-signal/consent.d.ts

@@ -0,0 +1,30 @@
+export declare const PRODUCT_SIGNAL_CONSENT_FILENAME = "product-signal-consent.json";
+/** Consent record schema version (#2693 D2). */
+export declare const PRODUCT_SIGNAL_CONSENT_VERSION = 1;
+/** Phase-1 consent tier permitting qualitative outbound (#2693 D2). */
+export declare const PRODUCT_SIGNAL_CONSENT_TIER = "product-signal";
+export interface ProductSignalConsentRecord {
+    readonly consentVersion: number;
+    readonly grantedAt: string;
+    readonly tier: string;
+    readonly revokedAt?: string;
+}
+export interface ResolveConsentPathOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly homeDir?: string;
+}
+/** Platform-config consent path adjacent to USER.md (#2693 D2). */
+export declare function resolveProductSignalConsentPath(options?: ResolveConsentPathOptions): string;
+/** Read consent file; returns null when absent, invalid, or revoked. */
+export declare function readProductSignalConsent(options?: ResolveConsentPathOptions): ProductSignalConsentRecord | null;
+/** True when a non-revoked consent grant exists. */
+export declare function isProductSignalConsented(options?: ResolveConsentPathOptions): boolean;
+export interface WriteConsentOptions extends ResolveConsentPathOptions {
+    readonly now?: Date;
+}
+/** Write a fresh consent grant (#2693 D17 yes path). */
+export declare function grantProductSignalConsent(options?: WriteConsentOptions): ProductSignalConsentRecord;
+/** Revoke consent by setting revokedAt (#2693 D2). */
+export declare function revokeProductSignalConsent(options?: WriteConsentOptions): boolean;
+//# sourceMappingURL=consent.d.ts.map

package/dist/product-signal/consent.js

@@ -0,0 +1,116 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { platformUserConfigDir } from "../user-config/resolve-user-md.js";
+export const PRODUCT_SIGNAL_CONSENT_FILENAME = "product-signal-consent.json";
+/** Consent record schema version (#2693 D2). */
+export const PRODUCT_SIGNAL_CONSENT_VERSION = 1;
+/** Phase-1 consent tier permitting qualitative outbound (#2693 D2). */
+export const PRODUCT_SIGNAL_CONSENT_TIER = "product-signal";
+function resolveHomeDirForConsent(options) {
+    if (options.homeDir !== undefined) {
+        return options.homeDir;
+    }
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    if (platform === "win32") {
+        const userProfile = env.USERPROFILE?.trim();
+        if (userProfile) {
+            return userProfile;
+        }
+    }
+    const home = env.HOME?.trim();
+    if (home) {
+        return home;
+    }
+    return homedir();
+}
+/** Platform-config consent path adjacent to USER.md (#2693 D2). */
+export function resolveProductSignalConsentPath(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const homeDir = resolveHomeDirForConsent(options);
+    return join(platformUserConfigDir(platform, env, homeDir), PRODUCT_SIGNAL_CONSENT_FILENAME);
+}
+function parseConsentRecord(raw) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        return null;
+    }
+    const rec = raw;
+    if (typeof rec.consentVersion !== "number" || typeof rec.grantedAt !== "string") {
+        return null;
+    }
+    if (typeof rec.tier !== "string") {
+        return null;
+    }
+    const revokedAt = typeof rec.revokedAt === "string" ? rec.revokedAt : undefined;
+    return {
+        consentVersion: rec.consentVersion,
+        grantedAt: rec.grantedAt,
+        tier: rec.tier,
+        revokedAt,
+    };
+}
+/** Read consent file; returns null when absent, invalid, or revoked. */
+export function readProductSignalConsent(options = {}) {
+    const path = resolveProductSignalConsentPath(options);
+    if (!existsSync(path)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        const record = parseConsentRecord(parsed);
+        if (record === null) {
+            return null;
+        }
+        if (record.revokedAt !== undefined && record.revokedAt.trim().length > 0) {
+            return null;
+        }
+        return record;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when a non-revoked consent grant exists. */
+export function isProductSignalConsented(options = {}) {
+    return readProductSignalConsent(options) !== null;
+}
+/** Write a fresh consent grant (#2693 D17 yes path). */
+export function grantProductSignalConsent(options = {}) {
+    const now = options.now ?? new Date();
+    const record = {
+        consentVersion: PRODUCT_SIGNAL_CONSENT_VERSION,
+        grantedAt: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
+        tier: PRODUCT_SIGNAL_CONSENT_TIER,
+    };
+    const path = resolveProductSignalConsentPath(options);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, "utf8");
+    return record;
+}
+/** Revoke consent by setting revokedAt (#2693 D2). */
+export function revokeProductSignalConsent(options = {}) {
+    const path = resolveProductSignalConsentPath(options);
+    if (!existsSync(path)) {
+        return false;
+    }
+    const now = options.now ?? new Date();
+    let existing = null;
+    try {
+        existing = parseConsentRecord(JSON.parse(readFileSync(path, "utf8")));
+    }
+    catch {
+        return false;
+    }
+    if (existing === null) {
+        return false;
+    }
+    const revoked = {
+        ...existing,
+        revokedAt: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
+    };
+    writeFileSync(path, `${JSON.stringify(revoked, null, 2)}\n`, "utf8");
+    return true;
+}
+//# sourceMappingURL=consent.js.map

package/dist/product-signal/gates.d.ts

@@ -0,0 +1,17 @@
+export type ProductSignalOutcome = "submitted" | "dry-run" | "disabled" | "no-consent" | "no-network" | "non-interactive" | "sink-unreachable" | "sink-unauthorized" | "validation" | "error-config";
+export interface GateEvaluation {
+    readonly allowed: boolean;
+    readonly outcome: ProductSignalOutcome;
+    readonly message: string;
+}
+export interface EvaluateGatesOptions {
+    readonly projectRoot: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly requireConsent?: boolean;
+    readonly stdinIsTTY?: boolean;
+}
+/** Pre-submit gate evaluation (#2693 D11 soft-skip matrix). */
+export declare function evaluateProductSignalGates(options: EvaluateGatesOptions): GateEvaluation;
+/** Map GhRestError-like conditions to soft-skip outcomes (#2693 D18). */
+export declare function classifySinkError(stderr: string, exitCode: number): ProductSignalOutcome;
+//# sourceMappingURL=gates.d.ts.map

package/dist/product-signal/gates.js

@@ -0,0 +1,66 @@
+import { resolveProductSignal } from "../policy/product-signal.js";
+import { isProductSignalConsented } from "./consent.js";
+import { isHeadlessSession } from "./headless.js";
+/** Pre-submit gate evaluation (#2693 D11 soft-skip matrix). */
+export function evaluateProductSignalGates(options) {
+    const env = options.env ?? process.env;
+    const policy = resolveProductSignal(options.projectRoot);
+    if (!policy.enabled) {
+        return {
+            allowed: false,
+            outcome: "disabled",
+            message: "product-signal disabled (plan.policy.productSignal.enabled=false).",
+        };
+    }
+    if (env.DEFT_NO_NETWORK === "1") {
+        return {
+            allowed: false,
+            outcome: "no-network",
+            message: "product-signal skipped (DEFT_NO_NETWORK=1).",
+        };
+    }
+    if (isHeadlessSession({ env, stdinIsTTY: options.stdinIsTTY })) {
+        if (options.requireConsent !== false && !isProductSignalConsented({ env })) {
+            return {
+                allowed: false,
+                outcome: "non-interactive",
+                message: "product-signal skipped in headless/non-interactive session (no consent on file).",
+            };
+        }
+    }
+    if (options.requireConsent !== false && !isProductSignalConsented({ env })) {
+        return {
+            allowed: false,
+            outcome: "no-consent",
+            message: "product-signal requires consent (`task product-signal:consent -- --grant`).",
+        };
+    }
+    if (policy.error !== null) {
+        return {
+            allowed: false,
+            outcome: "error-config",
+            message: `product-signal policy error: ${policy.error}`,
+        };
+    }
+    return {
+        allowed: true,
+        outcome: "submitted",
+        message: "gates passed",
+    };
+}
+/** Map GhRestError-like conditions to soft-skip outcomes (#2693 D18). */
+export function classifySinkError(stderr, exitCode) {
+    const text = stderr.toLowerCase();
+    if (text.includes("401") ||
+        text.includes("403") ||
+        text.includes("404") ||
+        text.includes("not found") ||
+        text.includes("permission")) {
+        return "sink-unauthorized";
+    }
+    if (exitCode !== 0) {
+        return "sink-unreachable";
+    }
+    return "sink-unreachable";
+}
+//# sourceMappingURL=gates.js.map

package/dist/product-signal/github-private-sink-adapter.d.ts

@@ -0,0 +1,28 @@
+import { type GhRestSeams } from "../scm/gh-rest.js";
+import type { ProductSignalPayload, ProductSignalSurface } from "./payload.js";
+import type { SubmitAdapter, SubmitResult } from "./submit-adapter.js";
+export declare const PRODUCT_SIGNAL_MARKER_PREFIX = "<!-- deft:product-signal v1";
+export declare const SURFACE_LABELS: Record<ProductSignalSurface, string>;
+/** Build HTML comment marker for standing-thread lookup (#2693 D8). */
+export declare function buildThreadMarker(installId: string, actorName: string, surface: ProductSignalSurface): string;
+/** Merge labels for PATCH updates (GitHub replaces the full label set). */
+export declare function mergeIssueLabels(existing: Record<string, unknown>, next: readonly string[]): string[];
+export interface GitHubPrivateSinkAdapterOptions {
+    readonly sinkRepo: string;
+    readonly seams?: GhRestSeams;
+}
+/** Phase-1 GitHub private sink adapter (#2693 D5/D8). */
+export declare class GitHubPrivateSinkAdapter implements SubmitAdapter {
+    readonly id = "github-private-sink";
+    private readonly repo;
+    private readonly seams;
+    constructor(options: GitHubPrivateSinkAdapterOptions);
+    submit(payload: ProductSignalPayload, extras?: {
+        readonly gapText?: string | null;
+    }): Promise<SubmitResult>;
+    private submitPortrait;
+    private submitPulse;
+    /** Append a Gap: comment on the standing pulse thread (#2693 D19). */
+    appendGapCommentOnPulse(payload: ProductSignalPayload, gapText: string): SubmitResult;
+}
+//# sourceMappingURL=github-private-sink-adapter.d.ts.map