@deftai/directive 0.88.0 → 0.90.0

package/dist/authz.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare function main(argv?: string[]): number;
+export default main;
+//# sourceMappingURL=authz.d.ts.map

package/dist/authz.js

@@ -0,0 +1,363 @@
+#!/usr/bin/env node
+/**
+ * Authz CLI (#2944 Wave 1 + #1095 Wave 4): human-origin grants + UAT lease +
+ * AFK closed-verb templates (mint via mintHumanOriginGrant only).
+ *
+ *   deft authz:show
+ *   deft authz:uat-start -- --campaign <id> [--actor <name>] [--note <text>]
+ *   deft authz:uat-suspend
+ *   deft authz:grant -- --operations edit,push --surfaces 'src/**' --cohort <id> ...
+ *   deft authz:grant -- --template release-publish --target 0.30.0
+ *   deft authz:grant -- --template finish-loop
+ *   deft authz:revoke -- <grant-id>
+ */
+import { AFK_TEMPLATE_NAMES, AUTHZ_OPERATIONS, CLOSED_VERB_TEMPLATE_NAMES, FINISH_LOOP_TEMPLATE_NAME, isAfkTemplateName, isClosedVerbTemplateName, isFinishLoopTemplateName, mintAfkTemplateGrant, mintHumanOriginGrant, revokeGrant, showAuthzSnapshot, startUatLease, suspendUatLease, } from "@deftai/directive-core/authz";
+function parseOps(raw) {
+    const allowed = new Set(AUTHZ_OPERATIONS);
+    const out = [];
+    for (const part of raw.split(/[,\s]+/)) {
+        const op = part.trim().toLowerCase();
+        if (op.length === 0)
+            continue;
+        if (!allowed.has(op)) {
+            throw new Error(`unknown operation '${op}'; expected one of ${AUTHZ_OPERATIONS.join(", ")}`);
+        }
+        out.push(op);
+    }
+    return out;
+}
+function parseArgv(argv) {
+    const base = {
+        cmd: "show",
+        projectRoot: process.cwd(),
+        campaign: null,
+        actor: "operator",
+        note: null,
+        operations: [],
+        surfaces: [],
+        cohort: null,
+        planRef: null,
+        repo: null,
+        branch: null,
+        storyIds: [],
+        issueIds: [],
+        expiresAt: null,
+        singleUse: false,
+        grantId: null,
+        template: null,
+        target: null,
+        format: "text",
+    };
+    const args = [...argv];
+    // Drop leading `--` separators from task-style invocation.
+    while (args[0] === "--")
+        args.shift();
+    if (args.length > 0 && !args[0]?.startsWith("-")) {
+        const cmd = args.shift();
+        if (cmd === "show" ||
+            cmd === "uat-start" ||
+            cmd === "uat-suspend" ||
+            cmd === "grant" ||
+            cmd === "revoke") {
+            base.cmd = cmd;
+        }
+        else if (cmd.startsWith("grant-")) {
+            base.cmd = "revoke";
+            base.grantId = cmd;
+        }
+        else {
+            return { ...base, error: `unknown authz subcommand: ${cmd}` };
+        }
+    }
+    while (args[0] === "--")
+        args.shift();
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === undefined)
+            break;
+        if (a === "--project-root" || a === "--projectRoot") {
+            base.projectRoot = args[++i] ?? base.projectRoot;
+            continue;
+        }
+        if (a === "--campaign") {
+            base.campaign = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--actor") {
+            base.actor = args[++i] ?? base.actor;
+            continue;
+        }
+        if (a === "--note") {
+            base.note = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--operations" || a === "--ops") {
+            try {
+                base.operations = parseOps(args[++i] ?? "");
+            }
+            catch (err) {
+                return { ...base, error: String(err) };
+            }
+            continue;
+        }
+        if (a === "--surfaces") {
+            const raw = args[++i] ?? "";
+            base.surfaces = raw
+                .split(/[,\s]+/)
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+            continue;
+        }
+        if (a === "--cohort") {
+            base.cohort = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--plan-ref" || a === "--planRef") {
+            base.planRef = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--repo") {
+            base.repo = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--branch") {
+            base.branch = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--stories" || a === "--story-ids") {
+            const raw = args[++i] ?? "";
+            base.storyIds = raw
+                .split(/[,\s]+/)
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+            continue;
+        }
+        if (a === "--issues" || a === "--issue-ids") {
+            const raw = args[++i] ?? "";
+            base.issueIds = raw
+                .split(/[,\s]+/)
+                .map((s) => Number(s.trim()))
+                .filter((n) => Number.isFinite(n));
+            continue;
+        }
+        if (a === "--expires" || a === "--expires-at") {
+            base.expiresAt = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--single-use") {
+            base.singleUse = true;
+            continue;
+        }
+        if (a === "--format") {
+            const fmt = (args[++i] ?? "text").toLowerCase();
+            base.format = fmt === "json" ? "json" : "text";
+            continue;
+        }
+        if (a === "--grant-id") {
+            base.grantId = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--template") {
+            base.template = args[++i] ?? null;
+            continue;
+        }
+        if (a === "--target") {
+            base.target = args[++i] ?? null;
+            continue;
+        }
+        if (!a.startsWith("-") && base.cmd === "revoke" && base.grantId === null) {
+            base.grantId = a;
+            continue;
+        }
+        if (a === "--help" || a === "-h") {
+            return { ...base, error: "help" };
+        }
+    }
+    return base;
+}
+function helpText() {
+    return [
+        "Usage:",
+        "  deft authz:show [--format json]",
+        "  deft authz:uat-start -- --campaign <id> [--actor <name>] [--note <text>]",
+        "  deft authz:uat-suspend",
+        "  deft authz:grant -- --operations edit,push --surfaces 'src/**' --cohort <id> \\",
+        "      [--stories 2944] [--plan-ref <id>] [--repo owner/name] [--branch <b>] [--expires ISO]",
+        "  deft authz:grant -- --template release-publish --target 0.30.0 [--actor <name>] [--expires ISO]",
+        "  deft authz:grant -- --template finish-loop [--actor <name>] [--expires ISO]",
+        "  deft authz:revoke -- <grant-id>",
+        "",
+        "Human-origin grants are minted only via this CLI (origin.kind=operator-cli).",
+        "Self-authored xBRIEF/lifecycle/dispatch tokens never satisfy implement gates (#2944).",
+        "",
+        `AFK templates (#1095 / #871): ${AFK_TEMPLATE_NAMES.join(", ")}`,
+        `  Closed-verb (#1095): ${CLOSED_VERB_TEMPLATE_NAMES.join(", ")} — require --target`,
+        `  Finish-loop (#871): ${FINISH_LOOP_TEMPLATE_NAME} — edit/push/pr/merge (no release ops)`,
+        "  Templates call mintHumanOriginGrant only — no second session-auth mint engine.",
+        "  Env bypass for a single shell: DEFT_ALLOW_RELEASE_PUBLISH=1 / DEFT_ALLOW_FINISH_LOOP=1.",
+    ].join("\n");
+}
+export function main(argv = process.argv.slice(2)) {
+    const args = parseArgv(argv);
+    if (args.error === "help") {
+        process.stdout.write(`${helpText()}\n`);
+        return 0;
+    }
+    if (args.error !== undefined) {
+        process.stderr.write(`authz: ${args.error}\n`);
+        process.stderr.write(`${helpText()}\n`);
+        return 2;
+    }
+    try {
+        switch (args.cmd) {
+            case "show": {
+                const snap = showAuthzSnapshot(args.projectRoot);
+                if (args.format === "json") {
+                    process.stdout.write(`${JSON.stringify(snap, null, 2)}\n`);
+                    return 0;
+                }
+                const uat = snap.state.uat;
+                if (uat === null) {
+                    process.stdout.write("UAT lease: inactive\n");
+                }
+                else {
+                    process.stdout.write(`UAT lease: ${uat.active ? "ACTIVE" : "suspended"} campaign=${uat.campaignId}\n`);
+                    process.stdout.write(`  started=${uat.startedAt} by=${uat.startedBy.actor} (${uat.startedBy.kind})\n`);
+                    if (uat.suspendedAt)
+                        process.stdout.write(`  suspended=${uat.suspendedAt}\n`);
+                }
+                process.stdout.write(`Active human-origin grants: ${snap.activeGrants.length}\n`);
+                for (const g of snap.activeGrants) {
+                    process.stdout.write(`  - ${g.id} ops=[${g.scope.operations.join(",")}] ` +
+                        `cohort=${g.scope.cohortId ?? "-"} surfaces=${g.scope.surfaces.join("|") || "*"}\n`);
+                }
+                const rejected = snap.allGrants.length - snap.activeGrants.length;
+                if (rejected > 0) {
+                    process.stdout.write(`(${rejected} grant file(s) present but not active/human-origin)\n`);
+                }
+                return 0;
+            }
+            case "uat-start": {
+                if (args.campaign === null || args.campaign.trim().length === 0) {
+                    process.stderr.write("authz:uat-start requires --campaign <id>\n");
+                    return 2;
+                }
+                const { lease } = startUatLease({
+                    projectRoot: args.projectRoot,
+                    campaignId: args.campaign,
+                    actor: args.actor,
+                    note: args.note,
+                });
+                process.stdout.write(`✓ UAT lease ACTIVE campaign=${lease.campaignId} (human-origin operator-cli)\n`);
+                process.stdout.write("  Product edit/push/PR/merge denied until a named fix cohort grant is minted.\n");
+                process.stdout.write("  Tests, evidence capture, and issue filing remain allowed.\n");
+                return 0;
+            }
+            case "uat-suspend": {
+                const state = suspendUatLease({
+                    projectRoot: args.projectRoot,
+                    actor: args.actor,
+                });
+                if (state.uat === null) {
+                    process.stdout.write("UAT lease was already inactive.\n");
+                }
+                else {
+                    process.stdout.write(`✓ UAT lease suspended campaign=${state.uat.campaignId} at ${state.uat.suspendedAt}\n`);
+                }
+                return 0;
+            }
+            case "grant": {
+                // AFK template path (#1095 / #871): presets only — still mintHumanOriginGrant.
+                if (args.template !== null && args.template.trim().length > 0) {
+                    if (!isAfkTemplateName(args.template)) {
+                        process.stderr.write(`authz:grant unknown --template '${args.template}'; expected one of: ${AFK_TEMPLATE_NAMES.join(", ")}\n`);
+                        return 2;
+                    }
+                    if (isClosedVerbTemplateName(args.template) &&
+                        (args.target === null || args.target.trim().length === 0)) {
+                        process.stderr.write(`authz:grant --template ${args.template} requires --target <version>\n`);
+                        return 2;
+                    }
+                    const grant = mintAfkTemplateGrant({
+                        projectRoot: args.projectRoot,
+                        template: args.template,
+                        target: args.target,
+                        actor: args.actor,
+                        expiresAt: args.expiresAt,
+                        singleUse: args.singleUse,
+                        planRef: args.planRef,
+                        repo: args.repo,
+                        branch: args.branch,
+                        surfaces: args.surfaces,
+                        storyIds: args.storyIds,
+                        issueIds: args.issueIds,
+                        cohortId: args.cohort,
+                    });
+                    process.stdout.write(`✓ human-origin grant minted id=${grant.id} origin=${grant.origin.kind} ` +
+                        `template=${args.template}\n`);
+                    if (isFinishLoopTemplateName(args.template)) {
+                        process.stdout.write(`  ops=[${grant.scope.operations.join(",")}] ` +
+                            `(finish-loop walk-away; release-* NOT authorized)\n`);
+                    }
+                    else {
+                        process.stdout.write(`  ops=[${grant.scope.operations.join(",")}] target surfaces=${grant.scope.surfaces.join(", ")}\n`);
+                    }
+                    process.stdout.write("  Authorization SoT: Wave 1 grant store (.deft/authz/grants) — not session-auth.\n");
+                    return 0;
+                }
+                if (args.operations.length === 0) {
+                    process.stderr.write("authz:grant requires --operations <edit,push,...> or --template <finish-loop|release-*> \n");
+                    return 2;
+                }
+                const grant = mintHumanOriginGrant({
+                    projectRoot: args.projectRoot,
+                    actor: args.actor,
+                    operations: args.operations,
+                    surfaces: args.surfaces,
+                    cohortId: args.cohort,
+                    planRef: args.planRef,
+                    repo: args.repo,
+                    branch: args.branch,
+                    storyIds: args.storyIds,
+                    issueIds: args.issueIds,
+                    expiresAt: args.expiresAt,
+                    singleUse: args.singleUse,
+                });
+                process.stdout.write(`✓ human-origin grant minted id=${grant.id} origin=${grant.origin.kind}\n`);
+                process.stdout.write(`  ops=[${grant.scope.operations.join(",")}] cohort=${grant.scope.cohortId ?? "-"}\n`);
+                if (grant.scope.surfaces.length > 0) {
+                    process.stdout.write(`  surfaces=${grant.scope.surfaces.join(", ")}\n`);
+                }
+                return 0;
+            }
+            case "revoke": {
+                if (args.grantId === null) {
+                    process.stderr.write("authz:revoke requires <grant-id>\n");
+                    return 2;
+                }
+                const revoked = revokeGrant({
+                    projectRoot: args.projectRoot,
+                    grantId: args.grantId,
+                });
+                if (revoked === null) {
+                    process.stderr.write(`authz: grant not found: ${args.grantId}\n`);
+                    return 1;
+                }
+                process.stdout.write(`✓ grant revoked id=${revoked.id} at ${revoked.semantics.revokedAt}\n`);
+                return 0;
+            }
+            default:
+                process.stderr.write(`${helpText()}\n`);
+                return 2;
+        }
+    }
+    catch (err) {
+        process.stderr.write(`authz: ${String(err)}\n`);
+        return 1;
+    }
+}
+export default main;
+if (import.meta.url === `file://${process.argv[1]?.replace(/\\/g, "/")}`) {
+    process.exitCode = main();
+}
+//# sourceMappingURL=authz.js.map

package/dist/cli-router/route-argv.js

@@ -36,6 +36,7 @@ export const PR_VERB_MAP = {
     "check-closing-keywords": "pr-closing-keywords",
     "wait-mergeable-and-merge": "pr-wait-mergeable",
     watch: "pr-watch",
+    "finish-loop": "pr-finish-loop",
 };
 /** verify:* aliases that map to non-verify-* handler stems. */
 export const VERIFY_VERB_MAP = {
@@ -74,8 +75,18 @@ export const SUBCOMMAND_ROUTES = {
     "policy:enable-directive": ["policy", "enable-directive"],
     "policy:enforce-branches": ["policy", "enforce-branches"],
     "policy:allow-direct-commits": ["policy", "allow-direct-commits"],
+    "policy:allow-bot-merge": ["policy", "allow-bot-merge"],
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
     "policy:clear-value-feedback": ["policy", "clear-value-feedback"],
+    "authz:show": ["authz", "show"],
+    "authz:uat-start": ["authz", "uat-start"],
+    "authz:uat-suspend": ["authz", "uat-suspend"],
+    "authz:grant": ["authz", "grant"],
+    "authz:revoke": ["authz", "revoke"],
+    "escalation:file": ["escalation-cli", "file"],
+    "escalation:list": ["escalation-cli", "list"],
+    "escalation:resolve": ["escalation-cli", "resolve"],
+    "escalation:batch-approve": ["escalation-cli", "batch-approve"],
     "product-signal:status": ["product-signal", "status"],
     "product-signal:enable": ["product-signal", "enable"],
     "product-signal:consent": ["product-signal", "consent"],
@@ -89,9 +100,11 @@ export const SUBCOMMAND_ROUTES = {
     "github-body:issue-create": ["github-body", "issue-create"],
     "github-body:issue-edit": ["github-body", "issue-edit"],
     "github-body:issue-fetch": ["github-body", "issue-fetch"],
+    "github-body:issue-lint": ["github-body", "issue-lint"],
     "github-body:comment-create": ["github-body", "comment-create"],
     "github-body:comment-edit": ["github-body", "comment-edit"],
     "github-body:pr-edit": ["github-body", "pr-edit"],
+    "github-body:pr-lint": ["github-body", "pr-lint"],
     "plan-sequence:set": ["plan-sequence", "set"],
     "plan-sequence:current": ["plan-sequence", "current"],
     "plan-sequence:clear": ["plan-sequence", "clear"],

package/dist/directive-finish-loop.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function run(argv: string[]): number;
+//# sourceMappingURL=directive-finish-loop.d.ts.map

package/dist/directive-finish-loop.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { cmdDirectiveFinishLoop } from "@deftai/directive-core/dist/finish-loop/main.js";
+export function run(argv) {
+    return cmdDirectiveFinishLoop(argv);
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=directive-finish-loop.js.map

package/dist/dispatch.d.ts

@@ -10,13 +10,17 @@ export interface DispatchIo {
     writeErr: (text: string) => void;
 }
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
-export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "lifecycle-event", "session-start", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-content-manifest", "verify-skill-external-fetch-gate", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
+export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-content-manifest", "verify-skill-external-fetch-gate", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
 export declare const CORE_MODULE_VERBS: readonly ["scm", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const POLICY_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
+/** Colon aliases for authz subcommands (#2944). */
+export declare const AUTHZ_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
+/** Colon aliases for escalation subcommands (#518). */
+export declare const ESCALATION_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for plan-sequence subcommands (#2402). */
 export declare const PLAN_SEQUENCE_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for product-signal subcommands (#2693). */

package/dist/dispatch.js

@@ -50,12 +50,16 @@ export const CLI_MODULE_VERBS = [
     "commit-lint",
     "coverage-hotspots",
     "policy",
+    "authz",
+    "escalation-cli",
     "pr-closing-keywords",
     "pr-merge-readiness",
     "pr-monitor",
     "pr-protected-issues",
     "pr-wait-mergeable",
     "pr-watch",
+    "pr-finish-loop",
+    "directive-finish-loop",
     "preflight-cache",
     "preflight-gh",
     "probe-session",
@@ -65,7 +69,9 @@ export const CLI_MODULE_VERBS = [
     "release-rollback",
     "scope-lifecycle",
     "lifecycle-event",
+    "lifecycle-stats",
     "session-start",
+    "session-ready",
     "plan-sequence",
     "slice",
     "subagent-monitor",
@@ -103,6 +109,7 @@ export const CLI_MODULE_VERBS = [
     "verify-biome-config",
     "verify-bridge-drift",
     "verify-capacity",
+    "verify-contained-writes",
     "verify-content-manifest",
     "verify-skill-external-fetch-gate",
     "verify-contract-drift",
@@ -193,12 +200,30 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:show": "show",
     "policy:enforce-branches": "enforce-branches",
     "policy:allow-direct-commits": "allow-direct-commits",
+    "policy:allow-bot-merge": "allow-bot-merge",
     "policy:enable-value-feedback": "enable-value-feedback",
     "policy:clear-value-feedback": "clear-value-feedback",
     "policy:disable-directive": "disable-directive",
     "policy:enable-directive": "enable-directive",
 };
 const POLICY_ACTION_COLON_ALIASES = Object.fromEntries(Object.keys(POLICY_ACTION_ALIAS_SUBCOMMANDS).map((alias) => [alias, "policy"]));
+/** Colon aliases for authz subcommands (#2944). */
+export const AUTHZ_ACTION_ALIAS_SUBCOMMANDS = {
+    "authz:show": "show",
+    "authz:uat-start": "uat-start",
+    "authz:uat-suspend": "uat-suspend",
+    "authz:grant": "grant",
+    "authz:revoke": "revoke",
+};
+const AUTHZ_ACTION_COLON_ALIASES = Object.fromEntries(Object.keys(AUTHZ_ACTION_ALIAS_SUBCOMMANDS).map((alias) => [alias, "authz"]));
+/** Colon aliases for escalation subcommands (#518). */
+export const ESCALATION_ACTION_ALIAS_SUBCOMMANDS = {
+    "escalation:file": "file",
+    "escalation:list": "list",
+    "escalation:resolve": "resolve",
+    "escalation:batch-approve": "batch-approve",
+};
+const ESCALATION_ACTION_COLON_ALIASES = Object.fromEntries(Object.keys(ESCALATION_ACTION_ALIAS_SUBCOMMANDS).map((alias) => [alias, "escalation-cli"]));
 /** Colon aliases for plan-sequence subcommands (#2402). */
 export const PLAN_SEQUENCE_ALIAS_SUBCOMMANDS = {
     "plan-sequence:set": "set",
@@ -251,6 +276,7 @@ export const VERB_ALIASES = {
     "verify:rule-ownership": "rule-ownership-lint",
     "rule:ownership-lint": "rule-ownership-lint",
     "verify:biome-config": "verify-biome-config",
+    "verify:contained-writes": "verify-contained-writes",
     "verify:content-manifest": "verify-content-manifest",
     "verify:skill-external-fetch-gate": "verify-skill-external-fetch-gate",
     "verify:contract-drift": "verify-contract-drift",
@@ -275,6 +301,8 @@ export const VERB_ALIASES = {
     "triage:scope": "triage-scope",
     ...TRIAGE_ACTION_COLON_ALIASES,
     ...POLICY_ACTION_COLON_ALIASES,
+    ...AUTHZ_ACTION_COLON_ALIASES,
+    ...ESCALATION_ACTION_COLON_ALIASES,
     ...PRODUCT_SIGNAL_COLON_ALIASES,
     "agents:refresh": "agents-refresh",
     "migrate:preflight": "migrate-preflight",
@@ -285,7 +313,9 @@ export const VERB_ALIASES = {
     "issue:sync-from-xbrief": "issue-sync-from-xbrief",
     upgrade: "install-upgrade",
     "session:start": "session-start",
+    "session:ready": "session-ready",
     "lifecycle:event": "lifecycle-event",
+    "lifecycle:stats": "lifecycle-stats",
     "toolchain:check": "toolchain-check",
     "ts:check-lane": "ts-check-lane",
     "spec:validate": "spec-validate",
@@ -295,6 +325,8 @@ export const VERB_ALIASES = {
     "docs:rule-map": "rule-map",
     "project:export-spec": "export-spec",
     "pr:watch": "pr-watch",
+    "pr:finish-loop": "pr-finish-loop",
+    "directive:finish-loop": "directive-finish-loop",
     doctor: "doctor",
     "eval:health": "eval-health",
     "feedback:file": "feedback-file",
@@ -311,6 +343,7 @@ const SUBDIR_CLI_STEMS = {
     "verify-stubs": "verify-source-cli/verify-stubs",
     "rule-ownership-lint": "verify-source-cli/rule-ownership-lint",
     "verify-biome-config": "verify-source-cli/verify-biome-config",
+    "verify-contained-writes": "verify-source-cli/verify-contained-writes",
     "verify-content-manifest": "verify-source-cli/verify-content-manifest",
     "verify-skill-external-fetch-gate": "verify-source-cli/verify-skill-external-fetch-gate",
     "verify-contract-drift": "verify-source-cli/verify-contract-drift",
@@ -2487,10 +2520,18 @@ const CURATED_HELP_GROUPS = [
         title: "Session & ritual",
         commands: [
             { name: "session:start", summary: "Record session-start ritual state" },
+            {
+                name: "session:ready",
+                summary: "One-shot recovery to gated write-ready (session + ritual + cache)",
+            },
             {
                 name: "lifecycle:event",
                 summary: "Record review-cycle plan:approved approval events",
             },
+            {
+                name: "lifecycle:stats",
+                summary: "Local xBRIEF lifecycle folder counts for process rollups",
+            },
         ],
     },
     {
@@ -2598,6 +2639,8 @@ export async function dispatch(argv, io = defaultIo()) {
         const handler = await loadHandler(canonical, io);
         const triageSubcommand = verb !== undefined ? TRIAGE_ACTION_ALIAS_SUBCOMMANDS[verb] : undefined;
         const policySubcommand = verb !== undefined ? POLICY_ACTION_ALIAS_SUBCOMMANDS[verb] : undefined;
+        const authzSubcommand = verb !== undefined ? AUTHZ_ACTION_ALIAS_SUBCOMMANDS[verb] : undefined;
+        const escalationSubcommand = verb !== undefined ? ESCALATION_ACTION_ALIAS_SUBCOMMANDS[verb] : undefined;
         const planSequenceSubcommand = verb !== undefined ? PLAN_SEQUENCE_ALIAS_SUBCOMMANDS[verb] : undefined;
         const productSignalSubcommand = verb !== undefined ? PRODUCT_SIGNAL_ALIAS_SUBCOMMANDS[verb] : undefined;
         const handlerArgv = canonical === "framework-commands" && verb !== undefined && verb !== canonical
@@ -2606,11 +2649,15 @@ export async function dispatch(argv, io = defaultIo()) {
                 ? [triageSubcommand, ...rest]
                 : policySubcommand !== undefined && canonical === "policy"
                     ? [policySubcommand, ...rest]
-                    : planSequenceSubcommand !== undefined && canonical === "plan-sequence"
-                        ? [planSequenceSubcommand, ...rest]
-                        : productSignalSubcommand !== undefined && canonical === "product-signal"
-                            ? [productSignalSubcommand, ...rest]
-                            : rest;
+                    : authzSubcommand !== undefined && canonical === "authz"
+                        ? [authzSubcommand, ...rest]
+                        : escalationSubcommand !== undefined && canonical === "escalation-cli"
+                            ? [escalationSubcommand, ...rest]
+                            : planSequenceSubcommand !== undefined && canonical === "plan-sequence"
+                                ? [planSequenceSubcommand, ...rest]
+                                : productSignalSubcommand !== undefined && canonical === "product-signal"
+                                    ? [productSignalSubcommand, ...rest]
+                                    : rest;
         return await invokeHandler(handler, handlerArgv);
     }
     catch (err) {

package/dist/escalation-cli.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare function main(argv?: string[]): number;
+export default main;
+//# sourceMappingURL=escalation-cli.d.ts.map