@deftai/directive 0.108.0 → 0.109.1

package/dist/dispatch.d.ts

@@ -10,7 +10,7 @@ export interface DispatchIo {
     writeErr: (text: string) => void;
 }
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
-export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "scope-record-approved-scope", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-skill-external-fetch-gate", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
+export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "scope-record-approved-scope", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
 export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -123,7 +123,11 @@ export const CLI_MODULE_VERBS = [
     "verify-contained-writes",
     "verify-telemetry-coverage",
     "verify-content-manifest",
+    "verify-deposit-closure",
+    "verify-consumer-hard-stops",
+    "verify-closing-keywords",
     "verify-skill-external-fetch-gate",
+    "verify-semantic-single-source",
     "verify-contract-drift",
     "verify-cursor-tier1",
     "verify-openclaw-tier1",
@@ -333,7 +337,11 @@ export const VERB_ALIASES = {
     "verify:contained-writes": "verify-contained-writes",
     "verify:telemetry-coverage": "verify-telemetry-coverage",
     "verify:content-manifest": "verify-content-manifest",
+    "verify:deposit-closure": "verify-deposit-closure",
+    "verify:consumer-hard-stops": "verify-consumer-hard-stops",
+    "verify:closing-keywords": "verify-closing-keywords",
     "verify:skill-external-fetch-gate": "verify-skill-external-fetch-gate",
+    "verify:semantic-single-source": "verify-semantic-single-source",
     "verify:contract-drift": "verify-contract-drift",
     "verify:cursor-tier1": "verify-cursor-tier1",
     "verify:openclaw-tier1": "verify-openclaw-tier1",
@@ -413,7 +421,11 @@ const SUBDIR_CLI_STEMS = {
     "verify-contained-writes": "verify-source-cli/verify-contained-writes",
     "verify-telemetry-coverage": "verify-source-cli/verify-telemetry-coverage",
     "verify-content-manifest": "verify-source-cli/verify-content-manifest",
+    "verify-deposit-closure": "verify-source-cli/verify-deposit-closure",
+    "verify-consumer-hard-stops": "verify-source-cli/verify-consumer-hard-stops",
+    "verify-closing-keywords": "verify-source-cli/verify-closing-keywords",
     "verify-skill-external-fetch-gate": "verify-source-cli/verify-skill-external-fetch-gate",
+    "verify-semantic-single-source": "verify-source-cli/verify-semantic-single-source",
     "verify-contract-drift": "verify-source-cli/verify-contract-drift",
     "verify-cursor-tier1": "verify-source-cli/verify-cursor-tier1",
     "verify-openclaw-tier1": "verify-source-cli/verify-openclaw-tier1",

package/dist/doctor.js

@@ -6,6 +6,7 @@ import { resolveContentPackageRoot } from "@deftai/directive-core/dist/content-r
 import { parseDoctorFlags } from "@deftai/directive-core/dist/doctor/flags.js";
 import { cmdDoctor } from "@deftai/directive-core/dist/doctor/main.js";
 import { findPackageAbsentDepositPathsSync } from "@deftai/directive-core/dist/init-deposit/hygiene.js";
+import { evaluateInstalledDepositClosure, renderDeclaredDepositClosureLine, } from "@deftai/directive-core/dist/validate-content/deposit-required.js";
 import { renderPrecutoverLine } from "@deftai/directive-core/dist/vbrief-validate/precutover.js";
 import { renderStaleHeaderLine, renderXbriefMigrationLine, } from "@deftai/directive-core/xbrief-migrate";
 /** Compare `.deft/core/` against `@deftai/directive-content` (#2804). */
@@ -56,9 +57,14 @@ export function run(argv) {
         process.stdout.write(`${renderXbriefMigrationLine(projectRoot)}\n`);
         process.stdout.write(`${renderStaleHeaderLine(projectRoot)}\n`);
         process.stdout.write(`${renderDepositFileSetHygieneLine(projectRoot, depositResult)}\n`);
+        const closure = evaluateInstalledDepositClosure(projectRoot);
+        process.stdout.write(`${renderDeclaredDepositClosureLine(closure)}\n`);
         if (flags.full && !depositResult.skipped && depositResult.absent.length > 0) {
             depositHygieneExit = 1;
         }
+        if (flags.full && !closure.skipped && (closure.missing.length > 0 || closure.error !== null)) {
+            depositHygieneExit = 1;
+        }
     }
     const doctorExit = cmdDoctor(argv);
     return Math.max(depositHygieneExit, doctorExit);

package/dist/verify-orphan-active.d.ts

@@ -5,6 +5,8 @@ interface ParsedArgs {
     issue: number | null;
     quiet: boolean;
     skipGh: boolean;
+    changedOnly: boolean;
+    baseRef: string | null;
     error?: string;
 }
 /** Parse verify-orphan-active CLI args. */

package/dist/verify-orphan-active.js

@@ -18,6 +18,8 @@ export function parseArgs(argv) {
         issue: null,
         quiet: false,
         skipGh: false,
+        changedOnly: false,
+        baseRef: null,
     };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -27,6 +29,20 @@ export function parseArgs(argv) {
         else if (arg === "--skip-gh") {
             parsed.skipGh = true;
         }
+        else if (arg === "--changed-only") {
+            parsed.changedOnly = true;
+        }
+        else if (arg === "--base-ref") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --base-ref: expected one argument" };
+            }
+            parsed.baseRef = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--base-ref=")) {
+            parsed.baseRef = arg.slice("--base-ref=".length);
+        }
         else if (arg === "--project-root") {
             const value = argv[i + 1];
             if (value === undefined) {
@@ -73,6 +89,18 @@ export function parseArgs(argv) {
             return { ...parsed, error: `unrecognized argument: ${arg}` };
         }
     }
+    // The two scopes answer different questions; silently preferring one would
+    // hide which residue the run actually covered (#3893).
+    if (parsed.changedOnly && parsed.issue !== null) {
+        return {
+            ...parsed,
+            error: "--changed-only and --issue are mutually exclusive: --issue is the after-merge " +
+                "one-origin scan, --changed-only is the merge-gate candidate scan",
+        };
+    }
+    if (parsed.baseRef !== null && !parsed.changedOnly) {
+        return { ...parsed, error: "--base-ref requires --changed-only" };
+    }
     return parsed;
 }
 /** Run the gate and return the process exit code. */
@@ -88,6 +116,8 @@ export function run(argv) {
         repo: args.repo,
         skipGh: args.skipGh,
         issue: args.issue,
+        changedOnly: args.changedOnly,
+        baseRef: args.baseRef,
     });
     if (result.message.length > 0) {
         if (result.stream === "stdout") {

package/dist/verify-source-cli/verify-closing-keywords.d.ts

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+export type RunGitFn = (args: readonly string[]) => {
+    readonly returncode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+};
+export type RangeResolution = {
+    readonly kind: "pr";
+    readonly pr: string;
+} | {
+    readonly kind: "range";
+    readonly range: string;
+} | {
+    readonly kind: "missing-base";
+    readonly reason: string;
+} | {
+    readonly kind: "stale-base";
+    readonly reason: string;
+};
+export declare function defaultRunGit(args: readonly string[]): {
+    returncode: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Resolve the candidate commit range against a merge-base, not a hardcoded
+ * origin/master two-dot range (#3969 Greptile leftover).
+ */
+export declare function resolveClosingKeywordsSource(env: NodeJS.ProcessEnv, runGit?: RunGitFn): RangeResolution;
+export declare function buildClosingKeywordsCheckArgv(env: NodeJS.ProcessEnv, extra?: readonly string[], runGit?: RunGitFn): {
+    argv: string[];
+    error?: string;
+};
+export declare function run(argv: string[], env?: NodeJS.ProcessEnv, invoke?: (args: readonly string[]) => number, runGit?: RunGitFn): number;
+//# sourceMappingURL=verify-closing-keywords.d.ts.map

package/dist/verify-source-cli/verify-closing-keywords.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { cmdPrCheckClosingKeywords } from "@deftai/directive-core/dist/pr-closing-keywords/main.js";
+const BASE_CANDIDATES = ["origin/master", "origin/main"];
+export function defaultRunGit(args) {
+    try {
+        const stdout = execFileSync("git", [...args], {
+            encoding: "utf8",
+            timeout: 30_000,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            returncode: typeof e.status === "number" ? e.status : 1,
+            stdout: typeof e.stdout === "string" ? e.stdout : "",
+            stderr: typeof e.stderr === "string" ? e.stderr : String(e.message ?? ""),
+        };
+    }
+}
+function firstLine(text) {
+    return text.trim().split(/\r?\n/)[0] ?? "";
+}
+function shaOf(result) {
+    if (result.returncode !== 0)
+        return null;
+    const sha = firstLine(result.stdout);
+    return /^[0-9a-f]{7,40}$/i.test(sha) ? sha : null;
+}
+function localDefaultFor(originRef) {
+    if (originRef.endsWith("/master") || originRef === "master")
+        return "master";
+    if (originRef.endsWith("/main") || originRef === "main")
+        return "main";
+    const slash = originRef.lastIndexOf("/");
+    return slash >= 0 ? originRef.slice(slash + 1) : null;
+}
+/** Remote-tracking ref name for `git fetch origin <name> --`. */
+function originFetchArg(originRef) {
+    if (!originRef.startsWith("origin/"))
+        return null;
+    const name = originRef.slice("origin/".length);
+    return name.length > 0 ? name : null;
+}
+/**
+ * Detect the locally observable stale-range enlargement without fetching:
+ * origin/<default> lags a descendant local default, and HEAD's merge-base
+ * against that local default is not the origin merge-base. Then
+ * origin/master..HEAD would include already-merged local-default commits.
+ */
+function staleRelativeToLocalDefault(originRef, originMergeBase, runGit) {
+    const localDefault = localDefaultFor(originRef);
+    if (localDefault === null)
+        return null;
+    const ahead = runGit(["merge-base", "--is-ancestor", originRef, localDefault]);
+    if (ahead.returncode !== 0)
+        return null;
+    const localMb = shaOf(runGit(["merge-base", localDefault, "HEAD"]));
+    if (localMb === null || localMb === originMergeBase)
+        return null;
+    return {
+        kind: "stale-base",
+        reason: originRef +
+            " lags local " +
+            localDefault +
+            " relative to HEAD, so the scan range would include already-merged commits. Recovery: git fetch origin " +
+            localDefault +
+            ".",
+    };
+}
+/**
+ * Resolve the candidate commit range against a merge-base, not a hardcoded
+ * origin/master two-dot range (#3969 Greptile leftover).
+ */
+export function resolveClosingKeywordsSource(env, runGit = defaultRunGit) {
+    const raw = env.GITHUB_PR_NUMBER ?? env.PR_NUMBER;
+    const pr = raw?.trim() ?? "";
+    if (/^\d+$/.test(pr)) {
+        return { kind: "pr", pr };
+    }
+    const bases = [
+        env.GITHUB_BASE_REF?.trim() ? `origin/${env.GITHUB_BASE_REF.trim()}` : null,
+        ...BASE_CANDIDATES,
+    ].filter((base) => base !== null && base.length > 0);
+    const seen = new Set();
+    for (const base of bases) {
+        if (seen.has(base))
+            continue;
+        seen.add(base);
+        const fetchArg = originFetchArg(base);
+        let fetched = false;
+        if (fetchArg !== null) {
+            // Scoped to this wrapper, not the whole check graph. CI uses --pr
+            // and never reaches this path.
+            fetched = runGit(["fetch", "origin", fetchArg, "--"]).returncode === 0;
+        }
+        const sha = shaOf(runGit(["merge-base", base, "HEAD"]));
+        if (sha === null)
+            continue;
+        if (!fetched) {
+            const stale = staleRelativeToLocalDefault(base, sha, runGit);
+            if (stale !== null)
+                return stale;
+            // Fetch failed and local evidence cannot prove freshness: do not
+            // scan a possibly stale origin merge-base.
+            continue;
+        }
+        return { kind: "range", range: `${sha}..HEAD` };
+    }
+    return {
+        kind: "missing-base",
+        reason: "no merge-base against origin/master or origin/main. Recovery: git fetch origin master.",
+    };
+}
+export function buildClosingKeywordsCheckArgv(env, extra = [], runGit = defaultRunGit) {
+    const source = resolveClosingKeywordsSource(env, runGit);
+    if (source.kind === "pr") {
+        return { argv: ["--mode", "fp", "--pr", source.pr, ...extra] };
+    }
+    if (source.kind === "missing-base" || source.kind === "stale-base") {
+        return { argv: [], error: source.reason };
+    }
+    return { argv: ["--mode", "fp", "--from-git-range", source.range, ...extra] };
+}
+export function run(argv, env = process.env, invoke = cmdPrCheckClosingKeywords, runGit = defaultRunGit) {
+    const built = buildClosingKeywordsCheckArgv(env, argv, runGit);
+    if (built.error !== undefined) {
+        process.stderr.write("verify:closing-keywords: fail -- " + built.error + "\n");
+        return 2;
+    }
+    return invoke(built.argv);
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-closing-keywords.js.map

package/dist/verify-source-cli/verify-consumer-hard-stops.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    repo: string;
+    projectRoot: string;
+    changelog: string | null;
+    error?: string;
+}
+export interface HardStopCliSeams {
+    readonly inventory?: readonly Record<string, unknown>[];
+    readonly changelogText?: string;
+}
+/** Parse verify-consumer-hard-stops CLI args (#3900 / #3713). */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function run(argv: string[], seams?: HardStopCliSeams): number;
+export {};
+//# sourceMappingURL=verify-consumer-hard-stops.d.ts.map

package/dist/verify-source-cli/verify-consumer-hard-stops.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { evaluateConsumerHardStopCensus, issueFromInventoryRow, parseClosesSet, } from "@deftai/directive-core/release";
+import { restIssueListOpenInventory } from "@deftai/directive-core/scm";
+/** Parse verify-consumer-hard-stops CLI args (#3900 / #3713). */
+export function parseArgs(argv) {
+    const parsed = { repo: "deftai/directive", projectRoot: ".", changelog: null };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--repo") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --repo: expected one argument" };
+            parsed.repo = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--repo=")) {
+            parsed.repo = arg.slice("--repo=".length);
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--changelog") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --changelog: expected one argument" };
+            parsed.changelog = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--changelog=")) {
+            parsed.changelog = arg.slice("--changelog=".length);
+        }
+        else {
+            return { ...parsed, error: "unrecognized argument: " + String(arg) };
+        }
+    }
+    return parsed;
+}
+export function run(argv, seams = {}) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write("verify_consumer_hard_stops: " + args.error + "\n");
+        return 2;
+    }
+    const root = resolve(args.projectRoot);
+    let changelogText = seams.changelogText;
+    if (changelogText === undefined) {
+        const changelogPath = resolve(root, args.changelog ?? "CHANGELOG.md");
+        try {
+            changelogText = readFileSync(changelogPath, "utf8");
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            process.stderr.write("verify_consumer_hard_stops: could not read CHANGELOG (" + reason + ")\n");
+            return 2;
+        }
+    }
+    let rows;
+    try {
+        rows = seams.inventory ?? restIssueListOpenInventory(args.repo);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write("verify_consumer_hard_stops: fail -- could not list open issues. Recovery: check gh auth and REST quota. " +
+            reason +
+            "\n");
+        return 2;
+    }
+    const issues = [];
+    for (const row of rows) {
+        const issue = issueFromInventoryRow(row);
+        if (issue !== null)
+            issues.push(issue);
+    }
+    const result = evaluateConsumerHardStopCensus({
+        issues,
+        closesSet: parseClosesSet(changelogText),
+    });
+    if (result.stream === "stdout") {
+        process.stdout.write(result.message + "\n");
+    }
+    else {
+        process.stderr.write(result.message + "\n");
+    }
+    return result.code;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-consumer-hard-stops.js.map

package/dist/verify-source-cli/verify-deposit-closure.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    packRootExplicit: boolean;
+    error?: string;
+}
+/** Parse verify-deposit-closure CLI args (#3900 / #3601 C1). */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/** Run the gate and return the process exit code. */
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=verify-deposit-closure.d.ts.map

package/dist/verify-source-cli/verify-deposit-closure.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { evaluateDepositClosureAtRoot } from "@deftai/directive-core/verify-source";
+/** Parse verify-deposit-closure CLI args (#3900 / #3601 C1). */
+export function parseArgs(argv) {
+    const parsed = { projectRoot: ".", packRootExplicit: false };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--project-root" || arg === "--pack-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument " + arg + ": expected one argument" };
+            }
+            parsed.projectRoot = value;
+            parsed.packRootExplicit = arg === "--pack-root";
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg?.startsWith("--pack-root=")) {
+            parsed.projectRoot = arg.slice("--pack-root=".length);
+            parsed.packRootExplicit = true;
+        }
+        else {
+            return { ...parsed, error: "unrecognized argument: " + String(arg) };
+        }
+    }
+    return parsed;
+}
+/** Run the gate and return the process exit code. */
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write("verify_deposit_closure: " + args.error + "\n");
+        return 2;
+    }
+    const root = resolve(args.projectRoot);
+    const result = evaluateDepositClosureAtRoot(root, args.packRootExplicit);
+    if (result.stream === "stdout") {
+        process.stdout.write(result.message + "\n");
+    }
+    else {
+        process.stderr.write(result.message + "\n");
+    }
+    return result.code;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-deposit-closure.js.map

package/dist/verify-source-cli/verify-semantic-single-source.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    error?: string;
+}
+/** Parse verify-semantic-single-source CLI args (#3600 / #3899 C2). */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/** Run the C2 gate and return the process exit code. */
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=verify-semantic-single-source.d.ts.map

package/dist/verify-source-cli/verify-semantic-single-source.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { evaluateSemanticSingleSource } from "@deftai/directive-core/verify-source";
+/** Parse verify-semantic-single-source CLI args (#3600 / #3899 C2). */
+export function parseArgs(argv) {
+    const parsed = { projectRoot: "." };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--project-root" || arg === "--pack-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: `argument ${arg}: expected one argument` };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg?.startsWith("--pack-root=")) {
+            parsed.projectRoot = arg.slice("--pack-root=".length);
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+/** Run the C2 gate and return the process exit code. */
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write(`verify_semantic_single_source: ${args.error}\n`);
+        return 2;
+    }
+    const result = evaluateSemanticSingleSource(resolve(args.projectRoot));
+    if (result.stream === "stdout") {
+        process.stdout.write(`${result.message}\n`);
+    }
+    else {
+        process.stderr.write(`${result.message}\n`);
+    }
+    return result.code;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-semantic-single-source.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.108.0",
+  "version": "0.109.1",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -34,8 +34,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.108.0",
-    "@deftai/directive-content": "^0.108.0"
+    "@deftai/directive-core": "^0.109.1",
+    "@deftai/directive-content": "^0.109.1"
   },
   "scripts": {
     "build": "tsc -b"