intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/release.js

@@ -0,0 +1,716 @@
+/**
+ * dna release — read-only release/deploy gate planning.
+ */
+import { execFile } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve as resolvePath } from "node:path";
+import { relative, resolve } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const VERCEL_CLI = "npx -y vercel@latest";
+const SUPABASE_CLI = "npx -y supabase@latest";
+const CLOUD_FUNCTIONS = ["issue-api-token", "bootstrap-account", "ingest-report", "list-receipts", "manage-api-tokens", "list-projects", "publish-template", "list-template-publications", "revoke-template-publication"];
+const WEB_SURFACE_RULES = [
+    {
+        id: "online",
+        label: "IntentDNA online public system",
+        prefix: "apps/online/",
+        include: (file) => isOnlineDeploySurfaceFile(file),
+        requirement: "required",
+        requiredWhen: "apps/online public, embed, management, or static handoff surface changed",
+        cwd: "apps/online",
+        buildCommand: "npm --prefix apps/online run build",
+        testCommand: "npm --prefix apps/online test",
+        previewCommand: "npm --prefix apps/online run preview",
+        deployCommand: `${VERCEL_CLI} deploy --prod`,
+        verificationRoutes: ["/", "/?mode=public", "/?mode=public&embed=1"],
+        verification: [
+            "Confirm Vercel CLI is available through npx or an equivalent installed vercel command.",
+            "Capture the deployment URL from Vercel CLI stdout.",
+            "Wait for the deployment to complete before route verification.",
+            "Verify the listed online routes, including public/embed plus any changed management routes.",
+            "Record the deployed URL and checked routes in the release evidence or final report.",
+        ],
+    },
+    {
+        id: "dashboard",
+        label: "IntentDNA dashboard projection",
+        prefix: "apps/dashboard/",
+        requirement: "conditional",
+        requiredWhen: "dashboard changes are intended for external preview through a deployed URL",
+        cwd: "apps/dashboard",
+        buildCommand: "npm --prefix apps/dashboard run build",
+        testCommand: "npm --prefix apps/dashboard test",
+        previewCommand: "npm --prefix apps/dashboard run preview",
+        deployCommand: `${VERCEL_CLI} deploy --prod`,
+        verificationRoutes: ["/", "/workflows", "/evidence", "/health"],
+        verification: [
+            "Confirm Vercel CLI is available through npx or an equivalent installed vercel command.",
+            "Capture the deployment URL from Vercel CLI stdout when the dashboard is externally reviewed.",
+            "Wait for the deployment to complete before route verification.",
+            "Verify overview, workflows, evidence, and health remain read-only projection views.",
+            "Record the deployed URL and checked routes in the release evidence or final report.",
+        ],
+    },
+    {
+        id: "public-static",
+        label: "Public static or article surface",
+        prefix: "public/",
+        requirement: "required",
+        requiredWhen: "public static assets, public articles, launch pages, or preview pages changed",
+        cwd: ".",
+        buildCommand: "npm run build",
+        testCommand: "npm test",
+        previewCommand: "run the owning app preview for the changed public route",
+        deployCommand: `${VERCEL_CLI} deploy --prod`,
+        verificationRoutes: [],
+        verification: [
+            "Confirm Vercel CLI is available through npx or an equivalent installed vercel command.",
+            "Capture the deployment URL from Vercel CLI stdout.",
+            "Wait for the deployment to complete before route verification.",
+            "Verify the changed public article, launch page, or asset is visible at its deployed route.",
+            "Record the deployed URL and checked routes in the release evidence or final report.",
+        ],
+    },
+];
+const CLOUD_FILE_PREFIXES = [
+    "supabase/",
+    "src/cli/commands/cloud.ts",
+    "src/cli/commands/auth.ts",
+    "src/cli/commands/report.ts",
+    "src/cli/commands/templates.ts",
+    ".omx/plans/prd-intentdna-supabase-saas-backend.md",
+    ".omx/plans/test-spec-intentdna-supabase-saas-backend.md",
+];
+const CLOUD_RELEASE_CHECKS = [
+    {
+        id: "cloud-contract-check",
+        label: "Local Supabase migration/function contract check",
+        command: "node dist/cli/index.js cloud contract-check --json",
+    },
+    {
+        id: "cloud-edge-check",
+        label: "Local Supabase Edge Function typecheck",
+        command: "node dist/cli/index.js cloud edge-check --json",
+    },
+    {
+        id: "cloud-deploy-plan",
+        label: "Guarded Supabase live deploy execution dry-run",
+        command: "node dist/cli/index.js cloud deploy-execute --dry-run --json",
+    },
+    {
+        id: "cloud-function-health",
+        label: "Deployed Supabase Edge Function health checks",
+        command: "node dist/cli/index.js cloud function-health --json",
+    },
+    {
+        id: "cloud-secrets-check",
+        label: "Remote Supabase Function secret name presence check",
+        command: "node dist/cli/index.js cloud secrets-check --json",
+    },
+    {
+        id: "cloud-vercel-env-check",
+        label: "Vercel production public Supabase env presence check",
+        command: "node dist/cli/index.js cloud vercel-env-check --json",
+    },
+    {
+        id: "cloud-ingest-smoke",
+        label: "Live signed report upload smoke with local receipt acceptance check",
+        command: "node dist/cli/index.js cloud smoke-execute --yes --json > <cloud-smoke-receipt.json> && node dist/cli/index.js cloud smoke-receipt-check --receipt <cloud-smoke-receipt.json> --json",
+    },
+];
+const BOUNDARIES = [
+    "dna CLI/core/runtime, docs, and internal wiki changes do not require Vercel deployment by themselves.",
+    "Vercel is required only for web/public deployed surfaces that reviewers or users access through a deployed URL.",
+    "Supabase SaaS changes require cloud contract, Edge Function, deploy-plan, remote secret-name presence, Vercel public env presence, function health, and live ingest-smoke evidence before production release claims.",
+    "Deployment is separate from organization rollout and runtime sync.",
+    "A web deploy is not complete until the deployed URL is opened or fetched and the intended visible change is verified.",
+    "A cloud deploy is not complete until Supabase migrations/functions/secrets and ingestion smoke evidence are recorded.",
+    "Dashboard remains a read-only projection; deployment must not turn it into policy truth or a workflow builder.",
+];
+function releaseEvidenceBoundaries() {
+    return [
+        ...BOUNDARIES,
+        "Release evidence records deploy-plan outputs, supplied deployed URL checks, and supplied cloud checks; it does not run Vercel or Supabase commands.",
+        "Build/test success is local readiness evidence only and is not release completion.",
+        "Release completion requires a deployed URL plus verification of every route listed by deploy-plan when web surfaces changed.",
+        "Release completion requires every cloud check listed by deploy-plan when Supabase SaaS surfaces changed.",
+        "Release evidence is separate from runtime sync, org rollout, dashboard state, and policy truth.",
+    ];
+}
+function normalizePath(projectDir, file) {
+    const trimmed = file.trim();
+    if (!trimmed)
+        return "";
+    const relativePath = trimmed.startsWith("/")
+        ? relative(projectDir, trimmed)
+        : trimmed;
+    return relativePath.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function unique(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function commandInCwd(cwd, command) {
+    return cwd === "." ? command : `cd ${cwd} && ${command}`;
+}
+function deploymentUrlVariable(surfaceId) {
+    return `${surfaceId.replace(/[^a-z0-9]+/gi, "_").replace(/^_+|_+$/g, "").toUpperCase()}_DEPLOYMENT_URL`;
+}
+async function gitLines(projectDir, args) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd: projectDir,
+        timeout: 5000,
+        maxBuffer: 1024 * 1024,
+    });
+    return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+async function collectChangedFiles(projectDir, files) {
+    if (files && files.length > 0) {
+        return {
+            source: "explicit_files",
+            files: unique(files.map((file) => normalizePath(projectDir, file))),
+            warnings: [],
+        };
+    }
+    try {
+        const changed = [
+            ...await gitLines(projectDir, ["diff", "--name-only", "--cached"]),
+            ...await gitLines(projectDir, ["diff", "--name-only"]),
+            ...await gitLines(projectDir, ["ls-files", "--others", "--exclude-standard"]),
+        ];
+        return {
+            source: changed.length > 0 ? "git_worktree" : "none",
+            files: unique(changed.map((file) => normalizePath(projectDir, file))),
+            warnings: [],
+        };
+    }
+    catch (err) {
+        return {
+            source: "none",
+            files: [],
+            warnings: [`Could not inspect git changes: ${err instanceof Error ? err.message : String(err)}`],
+        };
+    }
+}
+function buildSurfacePlans(files) {
+    const webSurfaces = [];
+    for (const rule of WEB_SURFACE_RULES) {
+        const surfaceFiles = files.filter((file) => {
+            const matchesPrefix = file === rule.prefix.slice(0, -1) || file.startsWith(rule.prefix);
+            return matchesPrefix && (rule.include ? rule.include(file) : true);
+        });
+        if (surfaceFiles.length === 0)
+            continue;
+        const urlVariable = deploymentUrlVariable(rule.id);
+        const verificationRoutes = routesForSurface(rule, surfaceFiles);
+        webSurfaces.push({
+            id: rule.id,
+            label: rule.label,
+            kind: "web",
+            requirement: rule.requirement,
+            requiredWhen: rule.requiredWhen,
+            cwd: rule.cwd,
+            files: surfaceFiles,
+            localCommands: [`${VERCEL_CLI} --version`, rule.buildCommand, rule.testCommand, rule.previewCommand],
+            deploymentUrlVariable: urlVariable,
+            deployCommand: `${urlVariable}=$(${commandInCwd(rule.cwd, rule.deployCommand)})`,
+            readinessCommand: commandInCwd(rule.cwd, `${VERCEL_CLI} inspect "$${urlVariable}" --wait`),
+            verificationCommands: verificationRoutes.map((route) => commandInCwd(rule.cwd, `${VERCEL_CLI} curl ${shellQuote(route)} --deployment "$${urlVariable}"`)),
+            verification: rule.verification,
+        });
+    }
+    const cloudSurface = buildCloudSurfacePlan(files);
+    return cloudSurface ? [...webSurfaces, cloudSurface] : webSurfaces;
+}
+function isCloudFile(file) {
+    return CLOUD_FILE_PREFIXES.some((prefix) => file === prefix.replace(/\/$/, "") || file.startsWith(prefix));
+}
+function buildCloudSurfacePlan(files) {
+    const cloudFiles = files.filter(isCloudFile);
+    if (cloudFiles.length === 0)
+        return undefined;
+    const functionDeployCommands = CLOUD_FUNCTIONS.map((name) => `${SUPABASE_CLI} functions deploy ${name}`);
+    return {
+        id: "supabase-cloud",
+        label: "IntentDNA Supabase SaaS backend",
+        kind: "cloud",
+        requirement: "required",
+        requiredWhen: "Supabase migrations, Edge Functions, cloud auth/report CLI, or SaaS backend plans changed",
+        cwd: ".",
+        files: cloudFiles,
+        localCommands: [
+            "npm run build",
+            "npm test",
+            "node dist/cli/index.js cloud credential-check --json",
+            "node dist/cli/index.js cloud contract-check --json",
+            "node dist/cli/index.js cloud edge-check --json",
+            "node dist/cli/index.js cloud deploy-plan --json",
+            "node dist/cli/index.js cloud deploy-execute --dry-run --json",
+            "node dist/cli/index.js cloud secrets-check --json",
+            "node dist/cli/index.js cloud smoke-execute --dry-run --json",
+        ],
+        deploymentUrlVariable: "INTENTDNA_CLOUD_URL",
+        deployCommand: [
+            `${SUPABASE_CLI} link --project-ref "$SUPABASE_PROJECT_REF"`,
+            `${SUPABASE_CLI} db push`,
+            `${SUPABASE_CLI} secrets set INTENTDNA_TOKEN_PEPPER="$INTENTDNA_TOKEN_PEPPER"`,
+            `${SUPABASE_CLI} secrets set SUPABASE_SECRET_KEYS="$SUPABASE_SECRET_KEYS"`,
+            `${SUPABASE_CLI} secrets set INTENTDNA_INGEST_MAX_BYTES=10485760`,
+            ...functionDeployCommands,
+        ].join(" && "),
+        readinessCommand: "node dist/cli/index.js cloud deploy-plan --json",
+        verificationCommands: [
+            "node dist/cli/index.js cloud contract-check --json",
+            "node dist/cli/index.js cloud edge-check --json",
+            "node dist/cli/index.js cloud deploy-execute --dry-run --json",
+            "node dist/cli/index.js cloud function-health --json",
+            "node dist/cli/index.js cloud secrets-check --json",
+            "node dist/cli/index.js cloud vercel-env-check --json",
+            "node dist/cli/index.js cloud smoke-execute --dry-run --json",
+            "node dist/cli/index.js cloud smoke-execute --yes --json > <cloud-smoke-receipt.json>",
+            "node dist/cli/index.js cloud smoke-receipt-check --receipt <cloud-smoke-receipt.json> --json",
+        ],
+        verification: [
+            "Run cloud contract-check and edge-check locally before any Supabase deployment claim.",
+            "Confirm deploy-plan is ready or records the exact missing Supabase credentials/secrets.",
+            "Confirm Vercel production has the browser-safe public Supabase env names before online SaaS projection claims.",
+            "After Supabase deployment, verify the deployed ingest-report function and run a signed report upload smoke.",
+            "Record cloud checks in release evidence with --checked-cloud-check for each completed check.",
+            "Cloud release evidence is persistence/auth/transport evidence; it does not grant runtime authority.",
+        ],
+        cloudChecks: CLOUD_RELEASE_CHECKS,
+    };
+}
+function routesForSurface(rule, files) {
+    if (rule.id === "online")
+        return onlineRoutesForFiles(rule.verificationRoutes, files);
+    if (rule.id !== "public-static")
+        return unique(rule.verificationRoutes);
+    const routes = files.map(publicRouteForFile).filter((route) => route !== undefined);
+    return unique(routes).slice(0, 5);
+}
+function isOnlineDeploySurfaceFile(file) {
+    if (!file.startsWith("apps/online/"))
+        return false;
+    if (file.startsWith("apps/online/src/"))
+        return true;
+    if (file.startsWith("apps/online/public/"))
+        return true;
+    if (file === "apps/online/index.html")
+        return true;
+    if (file === "apps/online/package.json")
+        return true;
+    if (file === "apps/online/package-lock.json")
+        return true;
+    if (file === "apps/online/tsconfig.json")
+        return true;
+    if (file === "apps/online/vite.config.ts" || file === "apps/online/vite.config.mts")
+        return true;
+    return false;
+}
+function onlineRoutesForFiles(baseRoutes, files) {
+    const routes = [...baseRoutes];
+    const add = (route) => {
+        if (!routes.includes(route))
+            routes.push(route);
+    };
+    for (const file of files) {
+        if (file === "apps/online/src/app/main.ts" || file === "apps/online/src/main.ts") {
+            add("/runtime");
+            add("/templates");
+            add("/readiness");
+            continue;
+        }
+        if (file.includes("template") || file.includes("marketplace"))
+            add("/templates");
+        if (file.includes("runtime") || file.includes("report") || file.includes("cloud"))
+            add("/runtime");
+        if (file.includes("readiness") || file.includes("release"))
+            add("/readiness");
+    }
+    return unique(routes);
+}
+function publicRouteForFile(file) {
+    if (!file.startsWith("public/"))
+        return undefined;
+    const route = `/${file.slice("public/".length)}`;
+    if (route === "/")
+        return "/";
+    if (route.endsWith("/index.html"))
+        return route.slice(0, -"index.html".length) || "/";
+    if (route.endsWith(".html"))
+        return route.slice(0, -".html".length) || "/";
+    return route;
+}
+function planStatus(changedFiles, surfaces) {
+    if (changedFiles.length === 0)
+        return "no_changes";
+    if (surfaces.some((surface) => surface.requirement === "required"))
+        return "deployment_required";
+    if (surfaces.some((surface) => surface.requirement === "conditional"))
+        return "deployment_conditional";
+    return "deployment_not_required";
+}
+function deployGuidance(status, surfaces) {
+    if (status === "deployment_required" || status === "deployment_conditional") {
+        const commands = surfaces.flatMap((surface) => [
+            ...surface.localCommands,
+            surface.deployCommand,
+            surface.readinessCommand,
+            ...surface.verificationCommands,
+        ]);
+        const verification = unique(surfaces.flatMap((surface) => surface.verification));
+        const verificationCommands = surfaces.flatMap((surface) => [
+            surface.readinessCommand,
+            ...surface.verificationCommands,
+        ]);
+        const hasWebSurface = surfaces.some((surface) => surface.kind === "web");
+        const hasCloudSurface = surfaces.some((surface) => surface.kind === "cloud");
+        const recordEvidence = hasCloudSurface && !hasWebSurface
+            ? "Record completed cloud checks in release evidence."
+            : "Verify the deployed URL and record checked routes.";
+        const nextCommands = status === "deployment_conditional"
+            ? [
+                "Confirm whether the changed dashboard/projection surface needs external deployed review.",
+                ...commands,
+                hasCloudSurface ? "Record completed cloud checks if Supabase SaaS surfaces changed." : "Verify the deployed URL if deployment is required.",
+            ]
+            : [...commands, recordEvidence];
+        return { commands, verification, verificationCommands, nextCommands };
+    }
+    if (status === "no_changes") {
+        return {
+            commands: [],
+            verification: ["No changed files were provided or detected, so no deploy gate is open."],
+            verificationCommands: [],
+            nextCommands: ["Make a scoped change or pass files explicitly: dna release deploy-plan <files...>"],
+        };
+    }
+    return {
+        commands: [],
+        verification: ["No web/public deployed surface changed, so Vercel deployment is not required."],
+        verificationCommands: [],
+        nextCommands: ["Continue local verification for the changed CLI/core/runtime/docs/wiki slice."],
+    };
+}
+function normalizeCheckedRoutes(routes) {
+    return unique((routes ?? [])
+        .flatMap((route) => route.split(","))
+        .map((route) => route.trim())
+        .filter(Boolean)
+        .map((route) => route.startsWith("/") ? route : `/${route}`));
+}
+function normalizeCheckedCloudChecks(checks) {
+    return unique((checks ?? [])
+        .flatMap((check) => check.split(","))
+        .map((check) => check.trim())
+        .filter(Boolean));
+}
+function expectedRoutes(plan) {
+    return unique(plan.surfaces.filter((surface) => surface.kind === "web").flatMap((surface) => surface.verificationCommands.map((command) => {
+        const match = command.match(/curl '([^']+)' --deployment/);
+        return match?.[1] ?? "";
+    })));
+}
+function expectedCloudChecks(plan) {
+    return unique(plan.surfaces.flatMap((surface) => surface.cloudChecks?.map((check) => check.id) ?? []));
+}
+function evidenceStatus(plan, deploymentUrl, checkedRoutes, checkedCloudChecks) {
+    if (plan.status === "deployment_not_required" || plan.status === "no_changes")
+        return "not_required";
+    const routes = expectedRoutes(plan);
+    if (routes.length > 0 && !deploymentUrl)
+        return "pending_deployed_url";
+    const missing = routes.filter((route) => !checkedRoutes.includes(route));
+    if (missing.length > 0)
+        return "pending_route_verification";
+    const missingCloudChecks = expectedCloudChecks(plan).filter((check) => !checkedCloudChecks.includes(check));
+    return missingCloudChecks.length === 0 ? "verified" : "pending_cloud_verification";
+}
+function defaultEvidencePath(projectDir) {
+    return join(projectDir, ".dna", "release", "latest-release-evidence.json");
+}
+function buildReleaseEvidenceArtifact(plan, opts, evidencePath, generatedAt = new Date().toISOString()) {
+    const checkedRoutes = normalizeCheckedRoutes(opts.checkedRoute);
+    const checkedCloudChecks = normalizeCheckedCloudChecks(opts.checkedCloudCheck);
+    const deploymentUrl = opts.deploymentUrl?.trim() || undefined;
+    const routes = expectedRoutes(plan);
+    const missingRoutes = routes.filter((route) => !checkedRoutes.includes(route));
+    const cloudChecks = expectedCloudChecks(plan);
+    const missingCloudChecks = cloudChecks.filter((check) => !checkedCloudChecks.includes(check));
+    const status = evidenceStatus(plan, deploymentUrl, checkedRoutes, checkedCloudChecks);
+    const deploymentRequired = routes.length > 0 && (plan.status === "deployment_required" || plan.status === "deployment_conditional");
+    const cloudRequired = cloudChecks.length > 0;
+    return {
+        schema_version: "intentdna.release_evidence.v1",
+        generated_at: generatedAt,
+        status,
+        deploy_plan: plan,
+        deployment: {
+            required: deploymentRequired,
+            url: deploymentUrl,
+            url_recorded: Boolean(deploymentUrl),
+            route_verification_complete: deploymentRequired ? missingRoutes.length === 0 && Boolean(deploymentUrl) : true,
+            checked_routes: checkedRoutes,
+            missing_routes: deploymentRequired ? missingRoutes : [],
+        },
+        cloud: {
+            required: cloudRequired,
+            check_verification_complete: cloudRequired ? missingCloudChecks.length === 0 : true,
+            checked_checks: checkedCloudChecks,
+            missing_checks: cloudRequired ? missingCloudChecks : [],
+        },
+        surfaces: plan.surfaces.map((surface) => ({
+            id: surface.id,
+            label: surface.label,
+            kind: surface.kind,
+            requirement: surface.requirement,
+            deploymentUrlVariable: surface.deploymentUrlVariable,
+            deployCommand: surface.deployCommand,
+            readinessCommand: surface.readinessCommand,
+            routes: surface.kind === "web"
+                ? surface.verificationCommands.map((command) => {
+                    const route = command.match(/curl '([^']+)' --deployment/)?.[1] ?? "";
+                    return {
+                        route,
+                        verified: checkedRoutes.includes(route),
+                        verificationCommand: command,
+                    };
+                })
+                : [],
+            cloud_checks: surface.cloudChecks?.map((check) => ({
+                ...check,
+                verified: checkedCloudChecks.includes(check.id),
+            })),
+        })),
+        evidence: {
+            local_commands: unique(plan.surfaces.flatMap((surface) => surface.localCommands)),
+            deploy_command: plan.surfaces[0]?.deployCommand,
+            readiness_commands: plan.surfaces.map((surface) => surface.readinessCommand),
+            route_verification_commands: plan.surfaces
+                .filter((surface) => surface.kind === "web")
+                .flatMap((surface) => surface.verificationCommands),
+            cloud_verification_commands: plan.surfaces
+                .filter((surface) => surface.kind === "cloud")
+                .flatMap((surface) => surface.verificationCommands),
+            release_complete: status === "verified" || status === "not_required",
+        },
+        files: {
+            evidence: evidencePath,
+        },
+        boundaries: releaseEvidenceBoundaries(),
+        nextCommands: status === "verified" || status === "not_required"
+            ? ["Record this release evidence artifact in the final report."]
+            : [
+                ...(!deploymentUrl ? plan.surfaces.map((surface) => surface.deployCommand) : []),
+                ...plan.verificationCommands,
+                "Re-run dna release evidence with --deployment-url/--checked-route for every verified route and --checked-cloud-check for every completed cloud check.",
+            ],
+        mutationBoundary: "Release evidence may write an evidence JSON file when --output is used, but it does not build, deploy, verify URLs, sync runtime artifacts, mutate dashboard state, or change policy truth.",
+    };
+}
+async function writeJson(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(value, null, 2) + "\n", "utf-8");
+}
+export async function buildReleaseDeployPlan(opts) {
+    const projectDir = resolve(opts.projectDir ?? process.cwd());
+    const changed = await collectChangedFiles(projectDir, opts.files);
+    const surfaces = buildSurfacePlans(changed.files);
+    const webPublicFiles = unique(surfaces.filter((surface) => surface.kind === "web").flatMap((surface) => surface.files));
+    const cloudFiles = unique(surfaces.filter((surface) => surface.kind === "cloud").flatMap((surface) => surface.files));
+    const status = planStatus(changed.files, surfaces);
+    const guidance = deployGuidance(status, surfaces);
+    return {
+        mode: "release_deploy_plan",
+        status,
+        source: changed.source,
+        changedFiles: changed.files,
+        webPublicFiles,
+        cloudFiles,
+        nonDeployFiles: changed.files.filter((file) => !webPublicFiles.includes(file) && !cloudFiles.includes(file)),
+        surfaces,
+        commands: guidance.commands,
+        verification: guidance.verification,
+        verificationCommands: guidance.verificationCommands,
+        boundaries: BOUNDARIES,
+        warnings: changed.warnings,
+        nextCommands: guidance.nextCommands,
+        mutationBoundary: "Read-only release deploy plan; no build, test, Vercel deploy, URL verification, runtime sync, dashboard state, or policy truth is changed.",
+    };
+}
+function writeDeployPlan(plan) {
+    process.stderr.write("Release deploy plan\n");
+    process.stderr.write(`Mode: ${plan.mode}\n`);
+    process.stderr.write(`Status: ${plan.status}\n`);
+    process.stderr.write(`Source: ${plan.source}\n`);
+    process.stderr.write(`Mutation boundary: ${plan.mutationBoundary}\n`);
+    process.stderr.write("\nChanged files:\n");
+    if (plan.changedFiles.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const file of plan.changedFiles)
+            process.stderr.write(`  - ${file}\n`);
+    }
+    process.stderr.write("\nWeb/public surface files:\n");
+    if (plan.webPublicFiles.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const file of plan.webPublicFiles)
+            process.stderr.write(`  - ${file}\n`);
+    }
+    process.stderr.write("\nSurfaces:\n");
+    if (plan.surfaces.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const surface of plan.surfaces) {
+            process.stderr.write(`  - ${surface.id}: ${surface.requirement}\n`);
+            process.stderr.write(`    label: ${surface.label}\n`);
+            process.stderr.write(`    required_when: ${surface.requiredWhen}\n`);
+            process.stderr.write(`    cwd: ${surface.cwd}\n`);
+            process.stderr.write("    local commands:\n");
+            for (const command of surface.localCommands)
+                process.stderr.write(`      - ${command}\n`);
+            process.stderr.write(`    deployment_url_variable: ${surface.deploymentUrlVariable}\n`);
+            process.stderr.write(`    deploy: ${surface.deployCommand}\n`);
+            process.stderr.write(`    readiness: ${surface.readinessCommand}\n`);
+            process.stderr.write("    verification commands:\n");
+            if (surface.verificationCommands.length === 0) {
+                process.stderr.write("      - none\n");
+            }
+            else {
+                for (const command of surface.verificationCommands)
+                    process.stderr.write(`      - ${command}\n`);
+            }
+            process.stderr.write("    verification:\n");
+            for (const item of surface.verification)
+                process.stderr.write(`      - ${item}\n`);
+        }
+    }
+    process.stderr.write("\nNon-deploy files:\n");
+    if (plan.nonDeployFiles.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const file of plan.nonDeployFiles)
+            process.stderr.write(`  - ${file}\n`);
+    }
+    process.stderr.write("\nBoundaries:\n");
+    for (const boundary of plan.boundaries)
+        process.stderr.write(`  - ${boundary}\n`);
+    if (plan.warnings.length > 0) {
+        process.stderr.write("\nWarnings:\n");
+        for (const warning of plan.warnings)
+            process.stderr.write(`  - ${warning}\n`);
+    }
+    process.stderr.write("\nCommands:\n");
+    if (plan.commands.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const command of plan.commands)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write("\nVerification:\n");
+    for (const item of plan.verification)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nVerification commands:\n");
+    if (plan.verificationCommands.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const command of plan.verificationCommands)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of plan.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function usage() {
+    return "Usage: dna release <deploy-plan|evidence> [files...] [--json]\n";
+}
+function writeReleaseEvidence(evidence) {
+    process.stderr.write("Release evidence\n");
+    process.stderr.write(`Schema: ${evidence.schema_version}\n`);
+    process.stderr.write(`Status: ${evidence.status}\n`);
+    process.stderr.write(`Mutation boundary: ${evidence.mutationBoundary}\n`);
+    process.stderr.write(`Deployment required: ${String(evidence.deployment.required)}\n`);
+    process.stderr.write(`Deployment URL: ${evidence.deployment.url ?? "not recorded"}\n`);
+    process.stderr.write(`Route verification complete: ${String(evidence.deployment.route_verification_complete)}\n`);
+    process.stderr.write(`Cloud verification required: ${String(evidence.cloud.required)}\n`);
+    process.stderr.write(`Cloud verification complete: ${String(evidence.cloud.check_verification_complete)}\n`);
+    process.stderr.write("\nChecked routes:\n");
+    if (evidence.deployment.checked_routes.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const route of evidence.deployment.checked_routes)
+            process.stderr.write(`  - ${route}\n`);
+    }
+    process.stderr.write("\nMissing routes:\n");
+    if (evidence.deployment.missing_routes.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const route of evidence.deployment.missing_routes)
+            process.stderr.write(`  - ${route}\n`);
+    }
+    process.stderr.write("\nChecked cloud checks:\n");
+    if (evidence.cloud.checked_checks.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const check of evidence.cloud.checked_checks)
+            process.stderr.write(`  - ${check}\n`);
+    }
+    process.stderr.write("\nMissing cloud checks:\n");
+    if (evidence.cloud.missing_checks.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const check of evidence.cloud.missing_checks)
+            process.stderr.write(`  - ${check}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of evidence.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nBoundaries:\n");
+    for (const boundary of evidence.boundaries)
+        process.stderr.write(`  - ${boundary}\n`);
+}
+export async function runRelease(opts) {
+    const subcommand = opts.subcommand || "deploy-plan";
+    if (subcommand !== "deploy-plan" && subcommand !== "evidence") {
+        process.stderr.write(usage());
+        return 2;
+    }
+    const plan = await buildReleaseDeployPlan(opts);
+    if (subcommand === "evidence") {
+        const projectDir = resolve(opts.projectDir ?? process.cwd());
+        const evidencePath = opts.output
+            ? resolvePath(projectDir, opts.output)
+            : opts.dryRun ? undefined : defaultEvidencePath(projectDir);
+        const evidence = buildReleaseEvidenceArtifact(plan, opts, evidencePath);
+        if (evidencePath && !opts.dryRun)
+            await writeJson(evidencePath, evidence);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(evidence, null, 2) + "\n");
+        }
+        else {
+            writeReleaseEvidence(evidence);
+        }
+        return 0;
+    }
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+        return 0;
+    }
+    writeDeployPlan(plan);
+    return 0;
+}