Distillation

Date: Sep 8, 2026

• 🟡 (17:24) src/schemas/project_config.ts:181-198 defines releaseUnitFields: optional github: GitHubGlobalConfigSchema, targets: z.array(TargetConfigSchema), preReleaseCommand, postReleaseCommand, releaseBranchPrefix, changelog, changelogPolicy: z.enum(['auto', 'simple', 'none']), requireNames, statusProvider, artifactProvider, versioning, and noMerge: z.boolean(). noMerge means do not merge the release branch after publishing and defaults to true for compiled GitHub Actions with a dist/ folder.
• 🟡 (17:24) src/schemas/project_config.ts:208-217 defines WorkspaceSchema as z.object({ ...releaseUnitFields, github: GitHubGlobalConfigSchema.partial().refine(github => github.projectPath === undefined, { message: 'Workspace github.projectPath is not supported.' }).optional() }); Workspace is z.infer<typeof WorkspaceSchema>. Workspace fields inherit top-level values when omitted, while workspace github is partial to permit overriding owner and/or repo.
• 🟡 (17:24) src/schemas/project_config.ts:219-246 safety validation: isSafeWorkspaceGlobSegment(segment) rejects empty strings, ., .., __proto__, and segments beginning -, then delegates to isSafeWorkspaceGlobPattern(segment). isSafeWorkspaceGlobPattern(segment) applies the same rejections and permits magic segments detected by hasMagic(segment, { magicalBraces: true }) only if matching /^[A-Za-z0-9_.?*[\]!^-]+$/; non-magic segments must match /^[A-Za-z0-9_.-]+$/.
• 🟡 (17:24) src/schemas/project_config.ts:249-320 implements brace validation: expandBraceAlternatives(pattern) recursively finds balanced {...} groups, uses splitBraceAlternatives() to split only top-level commas, returns undefined for unbalanced/malformed braces or groups without more than one choice, and expands each alternative with its prefix/suffix. isSafeWorkspaceGlob(name) requires nonempty defined alternatives and requires every /-separated segment of every expanded alternative to pass isSafeWorkspaceGlobSegment.
• 🟡 (17:24) src/schemas/project_config.ts:322-334 WorkspaceNameSchema rejects __proto__ because assigning it to a regular object mutates its prototype rather than retaining an own workspace entry; rejects . and ..; and applies isSafeWorkspaceGlob, with validation messages Workspace name "__proto__" is not supported., Workspace names cannot be "." or ".."., and Workspace paths must use safe ASCII segments..
• 🟡 (17:24) src/schemas/project_config.ts:339-355 CraftProjectConfigSchema combines releaseUnitFields, optional minVersion constrained by /^\d+\.\d+\.\d+.*$/, and optional workspaces: z.record(WorkspaceNameSchema, WorkspaceSchema). Documentation specifies that named independently versioned release units require selection through --workspace <name> or CRAFT_WORKSPACE; selected workspace fields override top-level fields; absent workspaces retains the prior single implicit top-level release unit behavior.