Release v1.5.0

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,33 @@
+---
+name: Bug report
+about: Report a problem with @diamondslab/diamonds
+title: "[Bug] "
+labels: bug
+---
+
+## Describe the bug
+
+A clear and concise description of what the bug is.
+
+## Reproduction
+
+Steps to reproduce (a minimal repo or config is ideal):
+
+1. …
+2. …
+
+## Expected behavior
+
+What you expected to happen.
+
+## Environment
+
+- `@diamondslab/diamonds` version:
+- `hardhat` version:
+- `ethers` version:
+- Node.js version:
+- OS:
+
+## Additional context
+
+Logs, stack traces (use `--verbose` where available), or screenshots.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,22 @@
+---
+name: Feature request
+about: Suggest an idea or enhancement for @diamondslab/diamonds
+title: "[Feature] "
+labels: enhancement
+---
+
+## Problem / motivation
+
+What problem would this solve? What's the use case?
+
+## Proposed solution
+
+A clear and concise description of what you want to happen (API shape, task, option…).
+
+## Alternatives considered
+
+Any alternative approaches or workarounds you've considered.
+
+## Additional context
+
+Links, references (e.g. ERC-2535), or examples.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Description
+
+What does this PR change, and why?
+
+## Related issues
+
+Closes #…
+
+## Checklist
+
+- [ ] Commits follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] `yarn build` passes
+- [ ] `yarn test` passes
+- [ ] `yarn format` applied (also enforced by the pre-commit hook)
+- [ ] `CHANGELOG.md` updated under `[Unreleased]` (for user-facing changes)
+- [ ] Docs/README updated if behavior or the public API changed
+
+## Notes for reviewers
+
+Anything reviewers should focus on, or follow-ups.

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main, 'release/**']
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [18, 20, 22]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Enable Corepack (Yarn 4)
+        run: corepack enable
+
+      # Standalone yarn.lock is committed (refreshed in the 1.5.0 line), so the
+      # install is reproducible.
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build
+        run: yarn build
+
+      # NOTE: no lint gate yet — `yarn lint` (eslint flat config) currently reports
+      # ~3.3k formatting-class findings pending a dedicated formatting pass
+      # (tracked in the productization project). Re-add a Lint step once clean.
+
+      - name: Test
+        run: yarn test

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+name: Release
+
+# Tag-only: publishing is irreversible, so this never runs on PRs or branch pushes.
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+  id-token: write # OIDC: npm Trusted Publishing auth + provenance attestation
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          # registry-url is REQUIRED — without it, setup-node writes no .npmrc
+          # registry line and `npm publish` will not negotiate OIDC.
+          registry-url: https://registry.npmjs.org
+
+      # npm OIDC Trusted Publishing requires npm >= 11.5.1 (Node 20 ships npm 10).
+      # Upgrade BEFORE corepack so a corepack `npm` shim can't shadow it.
+      - name: Upgrade npm (Trusted Publishing needs npm >= 11.5.1)
+        run: |
+          npm install -g npm@latest
+          npm --version
+
+      # `corepack enable` (no args) also shims `npm` and would shadow the upgrade.
+      - name: Enable Corepack (Yarn)
+        run: corepack enable yarn
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Build
+        run: yarn build
+
+      # OIDC Trusted Publishing (configured on npmjs.com for DiamondsLab/diamonds):
+      # no NPM_TOKEN — auth comes from the OIDC id-token; provenance is generated.
+      - name: Publish (npm OIDC Trusted Publishing)
+        run: |
+          echo "npm: $(npm --version)"
+          echo "OIDC id-token URL present: ${ACTIONS_ID_TOKEN_REQUEST_URL:+YES}"
+          echo "registry: $(npm config get registry)"
+          npm publish --provenance --access public

.gitignore

@@ -64,8 +64,9 @@ typings/
 flat
 .ignore
 
-# local notes
-notes
+# local notes (runbook is tracked; everything else stays local)
+notes/*
+!notes/RELEASE_RUNBOOK.md
 
 .tmp-test-integration
 jest.config.js
@@ -77,4 +78,9 @@ artifacts/
 test/.tmp-defender-advanced/
 typechain-types/
 dist/
-.yarn/
+.yarn/
+# heavy test/working dirs (M1-E1; existing tracked fixtures under test-deployments remain tracked)
+test-deployments/
+test-integration-deployments/
+test-output/
+temp/

.husky/pre-push

@@ -41,12 +41,9 @@ if ! yarn semgrep:scan > /dev/null 2>&1; then
     success=false
 fi
 
-# Run Solidity static analysis with Slither
-echo "🐍 Running Solidity static analysis with Slither..."
-if ! yarn slither:scan > /dev/null 2>&1; then
-    echo "❌ Slither analysis found issues. Please fix before pushing."
-    success=false
-fi
+# Slither (Solidity static analysis) decommissioned as a gate — see
+# project/pre-push-security-gates: diamonds is a TS tool, its contracts are test
+# fixtures, and slither errors in-container. The `slither:*` scripts remain for manual use.
 
 # Run secret detection
 echo "🔑 Running secret detection..."

CHANGELOG.md

@@ -5,6 +5,69 @@ All notable changes to `@diamondslab/diamonds` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.5.0] - 2026-07-04
+
+### Added
+
+- `exports` back-compat subpaths: `./dist/*` (types + default) and `./package.json`,
+  unblocking deep imports such as `dist/repositories/FileDeploymentRepository`
+  (previously rejected by exports encapsulation).
+- `CHANGELOG.md` now ships in the published tarball (`files` whitelist).
+- `engines` field (`node >=18`, `yarn >=4`).
+
+### Changed
+
+- `package.json` metadata: standard `author` + `contributors` (replaces non-standard
+  `authors` array), object-form `repository` with correct DiamondsLab casing.
+- Single ignore strategy: `.npmignore` removed; anchored `files` whitelist — `npm pack`
+  and `yarn pack` now produce identical tarballs (88 files; previously 171 vs 175).
+- Source maps and declaration maps are no longer emitted or shipped (they referenced
+  a `src/` directory that was never published, so they were broken in consumers).
+
+### Removed
+
+- Legacy `.travis.yml` and `tslint.json`.
+- Unused runtime dependencies `axios` and `lodash` (clears the npm audit gate;
+  no import sites existed).
+
+### Fixed
+
+- Package-level `yarn build` / `yarn test` were broken by a stale `yarn.lock`
+  (`@diamondslab/hardhat-diamonds` pinned to an old range); lockfile refreshed.
+
+## [1.4.1] - 2026-07-01
+
+### Fixed
+
+- **Standalone imports:** the package is importable outside this monorepo again.
+  `zod` moved from devDependencies to dependencies (the published `.d.ts` files expose
+  zod-derived types that consumers could not resolve), and
+  `@openzeppelin/defender-sdk` is now lazy-loaded on the deprecated OZDefender path
+  (`defenderClients` + `OZDefenderDeploymentStrategy`), so importing the package root
+  no longer requires it. The optional `.env` load is guarded.
+
+## [1.4.0] - 2026-06-30
+
+### Changed
+
+- **Selector resolution:** extracted a pure selector-resolution core
+  (`src/resolution`) behind the deployment strategies, covered by a new unit
+  (oracle) + integration test suite.
+
+### Fixed
+
+- `deployInclude` is now **additive** — listed selectors are added on top of the
+  facet's own selectors instead of replacing them.
+- `deployExclude` on an upgrade now emits the Remove cut with `address(0)` as
+  required by EIP-2535 (it previously used the facet address, producing an
+  invalid cut).
+
+### Removed
+
+- Dead `higherPrioritySplit` branch in the selector-resolution path.
+
 ## [1.3.3] - 2026-06-27
 
 ### Fixed
@@ -40,4 +103,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   root (the `/strategies` and `/utils` subpaths are not exported), and
   `OZDefenderDeploymentStrategy` is marked legacy.
 
+[Unreleased]: https://github.com/DiamondsLab/diamonds/compare/v1.5.0...HEAD
+[1.5.0]: https://github.com/DiamondsLab/diamonds/compare/v1.4.1...v1.5.0
+[1.4.1]: https://github.com/DiamondsLab/diamonds/compare/v1.4.0...v1.4.1
+[1.4.0]: https://github.com/DiamondsLab/diamonds/compare/v1.3.3...v1.4.0
 [1.3.3]: https://github.com/DiamondsLab/diamonds/compare/v1.3.2...v1.3.3