@deftai/directive 0.119.0 → 0.119.2

package/dist/authz.js

@@ -13,10 +13,11 @@
  *   deft authz:grant -- --parent <parent.xbrief.json> --draft <draft.json> [--repo owner/name] [--confirm]
  *   deft authz:revoke -- <grant-id> [--confirm]
  *
- * **UAT-active hard refuse (#3110):** while any UAT lease is active, ALL mutating
- * verbs (`uat-start`, `uat-suspend`, `grant`, `revoke`) refuse unconditionally —
- * no TTY, no `--confirm`, no typed phrase path. Self-approval under UAT is
- * impossible by construction (agent PTY cannot mint operator-cli authority).
+ * **UAT-active mint refuse (#3110 / #4632):** while any UAT lease is active,
+ * `uat-start`, `grant`, and `revoke` refuse unconditionally — no TTY, `--confirm`,
+ * or typed phrase path. `uat-suspend` skips that mint-refuse and still requires
+ * multi-factor human presence (real operator console). Suspend reuses the typed
+ * phrase `mint`; it is not a remint.
  *
  * **Outside UAT:** mutating verbs require multi-factor human presence: interactive
  * TTY + controlling terminal + `--confirm` + typed phrase `mint`; agent/CI env
@@ -222,16 +223,19 @@ function helpText() {
         "",
         "Human-origin grants are minted only via this CLI (origin.kind=operator-cli).",
         "Self-authored xBRIEF/lifecycle/dispatch tokens never satisfy implement gates (#2944).",
-        "While any UAT lease is ACTIVE (#3110): ALL mutating verbs refuse unconditionally",
-        "  (grant / uat-start / uat-suspend / revoke) — no TTY, --confirm, or phrase path.",
-        "  Self-approval under UAT is impossible by construction. Mint grants BEFORE uat-start.",
+        "While any UAT lease is ACTIVE (#3110 / #4632): grant / uat-start / revoke refuse",
+        "  unconditionally — no TTY, --confirm, or phrase path. Self-approval remint under",
+        "  UAT is impossible by construction. Mint grants BEFORE uat-start.",
+        "  uat-suspend is reachable from a real operator console: listed agent/CI markers",
+        "  empty, stdin+stdout TTY, controlling terminal, --confirm, typed phrase 'mint'",
+        "  (suspend reuses the mint phrase; it is not a remint). Agent/CI and missing-factor",
+        "  seams still refuse (exit 2). After suspend, grant is available again through",
+        "  the same human-presence gate.",
         "Outside UAT, mutating verbs require multi-factor human presence (#3110):",
         "  - Interactive TTY (stdin+stdout) + controlling terminal (/dev/tty|\\\\.\\CONIN$)",
         "  - Explicit --confirm (argv flag alone never enough)",
         "  - Typed phrase 'mint' on the controlling TTY (PTY+--confirm alone never enough)",
         "  - Known agent/CI env markers always refuse (fail-closed).",
-        "  End UAT only after the lease is cleared out-of-band (state edit / suspend path",
-        "  that does not run while the lease is active) — or suspend before re-minting.",
         "",
         "Structural scope:decompose apply (#3239 / #3291):",
         "  Pass --parent + --draft (paths under project root). Digest is SHA-256 of exact",
@@ -263,17 +267,21 @@ export function main(argv = process.argv.slice(2), seams = {}) {
     }
     const resolved = resolveHumanPresenceMintSeams(seams);
     /**
-     * Mutating-verb gate stack (#3110):
-     * 1. Active UAT → hard refuse (no multi-factor escape; self-approval impossible)
-     * 2. Else multi-factor: TTY + controlling tty + --confirm + typed phrase; agent/CI markers refuse
+     * Mutating-verb gate stack (#3110 / #4632):
+     * 1. Active UAT mint-refuse for grant / uat-start / revoke (no multi-factor escape)
+     * 2. uat-suspend skips that mint-refuse so campaign-end stays reachable
+     * 3. Multi-factor human presence: TTY + controlling tty + --confirm + typed phrase;
+     *    agent/CI markers refuse. Suspend reuses phrase `mint`.
      * Required-arg validation runs before this so missing --campaign / --ops still report clearly.
      */
     const gateConfirm = () => {
         if (args.cmd === "show")
             return null;
-        const uatBlocked = refuseMintWhileUatActive(`authz:${args.cmd}`, args.projectRoot);
-        if (uatBlocked !== null)
-            return uatBlocked;
+        if (args.cmd !== "uat-suspend") {
+            const uatBlocked = refuseMintWhileUatActive(`authz:${args.cmd}`, args.projectRoot);
+            if (uatBlocked !== null)
+                return uatBlocked;
+        }
         return refuseNonInteractiveMint({
             verb: `authz:${args.cmd}`,
             confirm: args.confirm,
@@ -434,12 +442,18 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                             "The in-process simulator is test-only and is discarded on process exit.\n");
                         return 2;
                     }
+                    const resolved = onePrUnit.resolveProductionAppStore(process.env);
+                    if (!resolved.ok) {
+                        process.stderr.write(`${resolved.message}\n`);
+                        return 2;
+                    }
                     const claim = onePrUnit.mintOnePrUnitGrant({
                         actor: args.actor,
                         approvalRef: args.note ?? "authz:grant --template one-pr-unit",
                         rationale: args.note ?? "one-PR-unit",
                         origins: args.issueIds.map((issueId) => ({ repo: args.repo, issueId })),
                         repo: args.repo,
+                        store: resolved.store,
                     });
                     process.stdout.write(`✓ one-PR-unit claim minted id=${claim.id} state=${claim.state} (reserved unbound)\n`);
                     process.stdout.write("  Opaque id is not a bearer. Only the App store plus the bound PR node id authorizes.\n");

package/dist/gates-cli/_helpers.d.ts

@@ -5,13 +5,19 @@ export interface DeftTsResult {
 }
 /** Repo root (deft framework checkout). */
 export declare function repoRoot(): string;
-/** Built `deft-ts` dispatcher binary. */
+/** Built deft-ts dispatcher binary. Spawn leftovers use this path. */
 export declare function binPath(): string;
-/** Invoke `node packages/cli/dist/bin.js <verb> [...args]`. Pass an empty verb for `--help`. */
-export declare function runDeftTs(verb: string, args?: readonly string[], opts?: {
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-}): DeftTsResult;
+export interface RunDeftTsOptions {
+    readonly cwd?: string;
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * Invoke the CLI router in-process (#4591). Coverage excludes packages/cli/src/bin.ts,
+ * so a node+bin.js spawn does not credit the child and is the Windows execute-scan
+ * chokepoint documented in vitest.config.ts.
+ */
+export declare function runDeftTs(verb: string, args?: readonly string[], opts?: RunDeftTsOptions): Promise<DeftTsResult>;
+export declare function runDeftTsArgv(argv: readonly string[], opts?: RunDeftTsOptions): Promise<DeftTsResult>;
 export declare function initGitRepo(root: string): string;
 export declare function writeProjectDef(root: string, policy?: Record<string, unknown>): void;
 export declare function seedProject(policy?: Record<string, unknown>): string;

package/dist/gates-cli/_helpers.js

@@ -1,37 +1,81 @@
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { routeAndDispatch } from "../cli-router/index.js";
+import { resetHandlerCacheForTests } from "../dispatch.js";
 const gatesDir = dirname(fileURLToPath(import.meta.url));
 /** Repo root (deft framework checkout). */
 export function repoRoot() {
     return resolve(gatesDir, "..", "..", "..", "..");
 }
-/** Built `deft-ts` dispatcher binary. */
+/** Built deft-ts dispatcher binary. Spawn leftovers use this path. */
 export function binPath() {
     return join(repoRoot(), "packages/cli/dist/bin.js");
 }
-/** Invoke `node packages/cli/dist/bin.js <verb> [...args]`. Pass an empty verb for `--help`. */
-export function runDeftTs(verb, args = [], opts = {}) {
-    const root = repoRoot();
-    const argv = verb.length > 0 ? [binPath(), verb, ...args] : [binPath(), ...args];
-    const res = spawnSync(process.execPath, argv, {
-        cwd: opts.cwd ?? root,
-        env: {
-            ...process.env,
-            DEFT_ROOT: root,
+/**
+ * Invoke the CLI router in-process (#4591). Coverage excludes packages/cli/src/bin.ts,
+ * so a node+bin.js spawn does not credit the child and is the Windows execute-scan
+ * chokepoint documented in vitest.config.ts.
+ */
+export async function runDeftTs(verb, args = [], opts = {}) {
+    const argv = verb.length > 0 ? [verb, ...args] : [...args];
+    return runDeftTsArgv(argv, opts);
+}
+export async function runDeftTsArgv(argv, opts = {}) {
+    const out = [];
+    const err = [];
+    const prevOut = process.stdout.write.bind(process.stdout);
+    const prevErr = process.stderr.write.bind(process.stderr);
+    const prevCwd = process.cwd();
+    resetHandlerCacheForTests();
+    const envSnapshot = { ...process.env };
+    process.stdout.write = ((chunk) => {
+        out.push(String(chunk));
+        return true;
+    });
+    process.stderr.write = ((chunk) => {
+        err.push(String(chunk));
+        return true;
+    });
+    try {
+        Object.assign(process.env, {
+            DEFT_ROOT: repoRoot(),
             DEFT_CACHE_DISABLE: "1",
             PYTHONUTF8: "1",
             ...opts.env,
-        },
-        encoding: "utf8",
-    });
-    return {
-        exitCode: res.status ?? 1,
-        stdout: res.stdout ?? "",
-        stderr: res.stderr ?? "",
-    };
+        });
+        if (opts.cwd !== undefined) {
+            process.chdir(opts.cwd);
+        }
+        const exitCode = await routeAndDispatch(argv, {
+            writeOut: (text) => {
+                out.push(text);
+            },
+            writeErr: (text) => {
+                err.push(text);
+            },
+        });
+        return {
+            exitCode,
+            stdout: out.join(""),
+            stderr: err.join(""),
+        };
+    }
+    finally {
+        process.stdout.write = prevOut;
+        process.stderr.write = prevErr;
+        if (opts.cwd !== undefined) {
+            process.chdir(prevCwd);
+        }
+        for (const key of Object.keys(process.env)) {
+            if (!(key in envSnapshot)) {
+                delete process.env[key];
+            }
+        }
+        Object.assign(process.env, envSnapshot);
+    }
 }
 export function initGitRepo(root) {
     writeFileSync(join(root, "README.md"), "fixture\n", "utf8");

package/dist/render-cli/deft-ts-runner.d.ts

@@ -1,20 +1,17 @@
+import { type DeftTsResult, type RunDeftTsOptions } from "../gates-cli/_helpers.js";
+export type { DeftTsResult, RunDeftTsOptions };
 /** Repo root (four levels up from packages/cli/src/render-cli). */
 export declare function resolveRepoRoot(): string;
-/** Built deft-ts dispatcher entrypoint. */
+/** Built deft-ts dispatcher entrypoint. Spawn leftovers still resolve this path. */
 export declare function resolveBinPath(): string;
-export interface DeftTsResult {
-    readonly exitCode: number;
-    readonly stdout: string;
-    readonly stderr: string;
-}
-/** Invoke `node packages/cli/dist/bin.js [...argv]` and capture output. */
+/** Invoke `directive [...argv]` in-process (#4591). */
 export declare function runDeftTsArgv(argv: readonly string[], options?: {
     cwd?: string;
     env?: Record<string, string>;
-}): DeftTsResult;
-/** Invoke `node packages/cli/dist/bin.js <verb> [...args]` and capture output. */
+}): Promise<DeftTsResult>;
+/** Invoke `directive <verb> [...args]` in-process (#4591). */
 export declare function runDeftTs(verb: string, args?: readonly string[], options?: {
     cwd?: string;
     env?: Record<string, string>;
-}): DeftTsResult;
+}): Promise<DeftTsResult>;
 //# sourceMappingURL=deft-ts-runner.d.ts.map

package/dist/render-cli/deft-ts-runner.js

@@ -1,35 +1,19 @@
-import { spawnSync } from "node:child_process";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { binPath, repoRoot, runDeftTsArgv as runDeftTsArgvInProcess, runDeftTs as runDeftTsInProcess, } from "../gates-cli/_helpers.js";
 /** Repo root (four levels up from packages/cli/src/render-cli). */
 export function resolveRepoRoot() {
-    return resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
+    return repoRoot();
 }
-/** Built deft-ts dispatcher entrypoint. */
+/** Built deft-ts dispatcher entrypoint. Spawn leftovers still resolve this path. */
 export function resolveBinPath() {
-    return resolve(resolveRepoRoot(), "packages/cli/dist/bin.js");
+    return binPath();
 }
-/** Invoke `node packages/cli/dist/bin.js [...argv]` and capture output. */
-export function runDeftTsArgv(argv, options = {}) {
-    const bin = resolveBinPath();
-    const result = spawnSync(process.execPath, [bin, ...argv], {
-        cwd: options.cwd ?? resolveRepoRoot(),
-        encoding: "utf8",
-        env: {
-            ...process.env,
-            DEFT_CACHE_DISABLE: "1",
-            PYTHONUTF8: "1",
-            ...options.env,
-        },
-    });
-    return {
-        exitCode: result.status ?? 2,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
+/** Invoke `directive [...argv]` in-process (#4591). */
+export async function runDeftTsArgv(argv, options = {}) {
+    const opts = { cwd: options.cwd, env: options.env };
+    return runDeftTsArgvInProcess(argv, opts);
 }
-/** Invoke `node packages/cli/dist/bin.js <verb> [...args]` and capture output. */
-export function runDeftTs(verb, args = [], options = {}) {
-    return runDeftTsArgv([verb, ...args], options);
+/** Invoke `directive <verb> [...args]` in-process (#4591). */
+export async function runDeftTs(verb, args = [], options = {}) {
+    return runDeftTsInProcess(verb, args, { cwd: options.cwd, env: options.env });
 }
 //# sourceMappingURL=deft-ts-runner.js.map

package/dist/scope-record-observable-scope.js

@@ -170,7 +170,7 @@ export function run(argv, seams = {}) {
     }
     const path = writeObservableScopeRecord(projectRoot, rec);
     if (!args.quiet) {
-        process.stdout.write(`Wrote ${path}\nCommit this record on the merge base before the UI change PR.\n`);
+        process.stdout.write(`Wrote ${path}\nCommit this record on the merge base before the UI change PR. Demand this mint after the observableChange contract is authored, not at parking (#4588; predecessor #4383).\n`);
     }
     return 0;
 }

package/dist/verify-session-ritual.js

@@ -81,7 +81,14 @@ export function parseArgs(argv) {
             parsed.posture = posture;
         }
         else {
-            return { ...parsed, error: `unrecognized argument: ${arg}` };
+            const error = `unrecognized argument: ${arg}`;
+            if (arg === "--session-id" || arg?.startsWith("--session-id=")) {
+                return {
+                    ...parsed,
+                    error: `${error} Drop the flag and retry deft verify:session-ritual -- --tier=gated.`,
+                };
+            }
+            return { ...parsed, error };
         }
     }
     return parsed;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.119.0",
+  "version": "0.119.2",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -34,8 +34,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.119.0",
-    "@deftai/directive-content": "^0.119.0"
+    "@deftai/directive-core": "^0.119.2",
+    "@deftai/directive-content": "^0.119.2"
   },
   "scripts": {
     "build": "tsc -b"