@deftai/directive-core 0.88.0 → 0.89.0

package/dist/xbrief-migrate/migrate-project.js

@@ -1,5 +1,6 @@
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { checkGitClean } from "../migrate-preflight/index.js";
 import { applyAgentsRefresh } from "../platform/agents-md.js";
@@ -48,19 +49,30 @@ function mapRelativePath(relativePath) {
         : segment)
         .join("/");
 }
-function writeMigratedFile(srcPath, destPath) {
-    mkdirSync(dirname(destPath), { recursive: true });
+function writeMigratedFile(projectRoot, srcPath, destPath) {
+    // #2980 wave C: product write sink routes through containedWrite.
+    const root = resolve(projectRoot);
     if (srcPath.endsWith(LEGACY_ARTIFACT_SUFFIX)) {
         const parsed = JSON.parse(readFileSync(srcPath, "utf8"));
         const result = transformArtifactV06ToV08Transactional(parsed);
         if (!result.ok) {
             throw new Error(result.error);
         }
-        writeFileSync(destPath, `${JSON.stringify(result.artifact, null, 2)}\n`, "utf8");
+        containedWrite({
+            root,
+            target: destPath,
+            data: `${JSON.stringify(result.artifact, null, 2)}\n`,
+            mode: "replace",
+        });
         return;
     }
     const raw = readFileSync(srcPath, "utf8");
-    writeFileSync(destPath, rewriteEmbeddedTokens(raw), "utf8");
+    containedWrite({
+        root,
+        target: destPath,
+        data: rewriteEmbeddedTokens(raw),
+        mode: "replace",
+    });
 }
 function backupMigrationInputs(projectRoot, legacyDir, migratedDir) {
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
@@ -100,7 +112,7 @@ function migrateLegacyTree(projectRoot, legacyDir, options) {
             if (shouldOmitLegacyMigrationFile(rel))
                 continue;
             const destPath = join(stagedDir, mapRelativePath(rel));
-            writeMigratedFile(srcPath, destPath);
+            writeMigratedFile(projectRoot, srcPath, destPath);
         }
         overlayCanonicalTriageCache(migratedDir, stagedDir);
         renameOrReplace(stagedDir, migratedDir);
@@ -123,14 +135,16 @@ function migrateLegacyTree(projectRoot, legacyDir, options) {
 /** Idempotently write the legacy-root deprecation marker (#2270 / #2869). */
 function writeVbriefDeprecationMarker(projectRoot, legacyDir) {
     const markerPath = join(legacyDir, VBRIEF_DEPRECATION_MARKER_FILENAME);
-    // Refuse leaf or parent-dir symlink escapes before mkdir/write (#2869).
-    assertWriteTargetSafe(projectRoot, legacyDir);
-    assertWriteTargetSafe(projectRoot, markerPath);
-    mkdirSync(legacyDir, { recursive: true });
+    // Refuse leaf or parent-dir symlink escapes via containedWrite (#2869 / #2980 wave C).
     if (hasVbriefDeprecationMarker(legacyDir)) {
         return;
     }
-    writeFileSync(markerPath, VBRIEF_DEPRECATION_MARKER_BODY, "utf8");
+    containedWrite({
+        root: resolve(projectRoot),
+        target: markerPath,
+        data: VBRIEF_DEPRECATION_MARKER_BODY,
+        mode: "replace",
+    });
 }
 /**
  * Converge a leftover legacy `vbrief/` root to an unambiguous state (#2270).

package/dist/xbrief-migrate/transforms.d.ts

@@ -15,8 +15,10 @@ export declare function readDeclaredArtifactVersion(artifact: JsonObject): strin
 export declare function rewriteEmbeddedTokens(value: string): string;
 /**
  * Convert a single v0.6 in-document artifact to v0.8 semantics.
- * Idempotent: v0.8 artifacts are returned unchanged (deep-cloned).
- * Transactional: on failure the original input object is not mutated.
+ * Accepts classic `vBRIEFInfo@0.6` or hybrid `xBRIEFInfo@0.6` (layout renamed,
+ * envelope not bumped — #2970). Idempotent: v0.8 artifacts are returned
+ * unchanged (deep-cloned). Transactional: on failure the original input
+ * object is not mutated.
  */
 export declare function transformArtifactV06ToV08(input: JsonObject): JsonObject;
 /**

package/dist/xbrief-migrate/transforms.js

@@ -74,30 +74,53 @@ function isAlreadyV08Artifact(artifact) {
     const info = artifact[MIGRATED_INFO_ROOT_KEY];
     return isPlainObject(info) && info.version === VBRIEF_VERSION;
 }
+/**
+ * Resolve a v0.6 info block from classic `vBRIEFInfo` or hybrid `xBRIEFInfo@0.6`.
+ * Prefer the classic key when both are present. Layout rename ≠ envelope bump (#2970).
+ */
+function resolveV06InfoBlock(artifact) {
+    if (LEGACY_INFO_ROOT_KEY in artifact) {
+        const legacyInfo = artifact[LEGACY_INFO_ROOT_KEY];
+        if (!isPlainObject(legacyInfo)) {
+            throw new TransformError(`'${LEGACY_INFO_ROOT_KEY}' must be an object`);
+        }
+        const declaredVersion = legacyInfo.version;
+        if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
+            throw new TransformError(`expected ${LEGACY_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION}, got ${String(declaredVersion)}`);
+        }
+        return legacyInfo;
+    }
+    if (MIGRATED_INFO_ROOT_KEY in artifact) {
+        const hybridInfo = artifact[MIGRATED_INFO_ROOT_KEY];
+        if (!isPlainObject(hybridInfo)) {
+            throw new TransformError(`'${MIGRATED_INFO_ROOT_KEY}' must be an object`);
+        }
+        const declaredVersion = hybridInfo.version;
+        if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
+            throw new TransformError(`expected hybrid ${MIGRATED_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION} (or ${VBRIEF_VERSION} for already-migrated), got ${String(declaredVersion)}`);
+        }
+        return hybridInfo;
+    }
+    throw new TransformError(`missing required legacy info block '${LEGACY_INFO_ROOT_KEY}' or hybrid '${MIGRATED_INFO_ROOT_KEY}'@${LEGACY_VBRIEF_VERSION} for v0.6 -> v0.8 transform`);
+}
 /**
  * Convert a single v0.6 in-document artifact to v0.8 semantics.
- * Idempotent: v0.8 artifacts are returned unchanged (deep-cloned).
- * Transactional: on failure the original input object is not mutated.
+ * Accepts classic `vBRIEFInfo@0.6` or hybrid `xBRIEFInfo@0.6` (layout renamed,
+ * envelope not bumped — #2970). Idempotent: v0.8 artifacts are returned
+ * unchanged (deep-cloned). Transactional: on failure the original input
+ * object is not mutated.
  */
 export function transformArtifactV06ToV08(input) {
     const working = structuredClone(input);
     if (isAlreadyV08Artifact(working)) {
         return working;
     }
-    if (!(LEGACY_INFO_ROOT_KEY in working)) {
-        throw new TransformError(`missing required legacy info block '${LEGACY_INFO_ROOT_KEY}' for v0.6 -> v0.8 transform`);
-    }
-    const legacyInfo = working[LEGACY_INFO_ROOT_KEY];
-    if (!isPlainObject(legacyInfo)) {
-        throw new TransformError(`'${LEGACY_INFO_ROOT_KEY}' must be an object`);
-    }
-    const declaredVersion = legacyInfo.version;
-    if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
-        throw new TransformError(`expected ${LEGACY_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION}, got ${String(declaredVersion)}`);
-    }
+    const info = resolveV06InfoBlock(working);
+    // Drop both keys so a dual-key hybrid cannot leave a stale vBRIEFInfo behind.
     delete working[LEGACY_INFO_ROOT_KEY];
+    delete working[MIGRATED_INFO_ROOT_KEY];
     working[MIGRATED_INFO_ROOT_KEY] = {
-        ...legacyInfo,
+        ...info,
         version: VBRIEF_VERSION,
     };
     const rewritten = deepRewriteValues(working);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -75,6 +75,14 @@
       "types": "./dist/hooks/index.d.ts",
       "default": "./dist/hooks/index.js"
     },
+    "./authz": {
+      "types": "./dist/authz/index.d.ts",
+      "default": "./dist/authz/index.js"
+    },
+    "./escalation": {
+      "types": "./dist/escalation/index.d.ts",
+      "default": "./dist/escalation/index.js"
+    },
     "./plan-sequence": {
       "types": "./dist/plan-sequence/index.d.ts",
       "default": "./dist/plan-sequence/index.js"
@@ -179,6 +187,10 @@
       "types": "./dist/pr-watch/index.d.ts",
       "default": "./dist/pr-watch/index.js"
     },
+    "./finish-loop": {
+      "types": "./dist/finish-loop/index.d.ts",
+      "default": "./dist/finish-loop/index.js"
+    },
     "./vbrief-build": {
       "types": "./dist/vbrief-build/index.d.ts",
       "default": "./dist/vbrief-build/index.js"
@@ -318,8 +330,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.88.0",
-    "@deftai/directive-types": "^0.88.0",
+    "@deftai/directive-content": "^0.89.0",
+    "@deftai/directive-types": "^0.89.0",
     "archiver": "^8.0.0"
   },
   "scripts": {