@bevel-software/platform-shared 0.20.0 → 0.22.0

package/dist/workspace/platform-files.js

@@ -1,4 +1,4 @@
-import { DEFAULT_KB_LAYOUT, FIXED_PLATFORM_FILE_NAMES, agentsFileOf, currentKbLayout, reservedRootDirNames, } from './kb-layout.js';
+import { DEFAULT_KB_LAYOUT, FIXED_PLATFORM_FILE_NAMES, agentsFileOf, reservedRootDirNames, } from './kb-layout.js';
 /**
  * The files the platform reads as configuration, not content. `access.md`
  * governs the folder it sits in and `.bevelignore` layers like `.gitignore`,
@@ -6,14 +6,15 @@ import { DEFAULT_KB_LAYOUT, FIXED_PLATFORM_FILE_NAMES, agentsFileOf, currentKbLa
  * the repository root only, so a nested file of either name is ordinary
  * content. Moving one changes what the platform enforces, so moves refuse them.
  *
- * A FUNCTION, not a constant, and that is the whole of the configurable-guide
- * change on this side: the guide's name is a deployment setting, so the fourth
- * platform file is `HEXIS.md` on one deployment and `AGENTS.md` on the next —
- * and on the first, a root `AGENTS.md` is the CUSTOMER'S own conventions file,
- * which has to move and delete like any page. Every gate asks this rather than
- * reading a list captured at module load.
+ * A FUNCTION OF THE LAYOUT, not a constant, and that is the whole of the
+ * configurable-guide change on this side: the guide's name is a deployment
+ * setting, so the fourth platform file is `HEXIS.md` on one deployment and
+ * `AGENTS.md` on the next — and on the first, a root `AGENTS.md` is the
+ * CUSTOMER'S own conventions file, which has to move and delete like any page.
+ * Every gate asks this with the layout it serves rather than reading a list
+ * captured at module load.
  */
-export function platformFileNames(layout = currentKbLayout()) {
+export function platformFileNames(layout) {
     return [...FIXED_PLATFORM_FILE_NAMES, agentsFileOf(layout)];
 }
 /**
@@ -25,8 +26,8 @@ export function platformFileNames(layout = currentKbLayout()) {
 export const PLATFORM_FILE_NAMES = Object.freeze(platformFileNames(DEFAULT_KB_LAYOUT));
 /** The platform files that are read wherever they sit, not only at the root. */
 const PLATFORM_FILES_AT_ANY_DEPTH = new Set(['access.md', '.bevelignore']);
-/** The names in effect, as a set — rebuilt per call, because the guide's is configurable. */
-const platformFiles = () => new Set(platformFileNames());
+/** The names under `layout`, as a set — rebuilt per call, because the guide's is configurable. */
+const platformFiles = (layout) => new Set(platformFileNames(layout));
 const normalize = (path) => path.replace(/^\.?\/+/, '').replace(/\/+$/, '');
 const baseName = (path) => {
     const trimmed = normalize(path);
@@ -47,10 +48,10 @@ const hasTraversal = (path) => normalize(path).split('/').some((segment) => segm
  * Exact spelling, as the platform reads it: `Access.md` is content. A caller
  * on a case-insensitive disk passes the path's on-disk spelling.
  */
-export function isPlatformFile(repoRelativePath) {
+export function isPlatformFile(repoRelativePath, layout) {
     const norm = normalize(repoRelativePath);
     const name = baseName(norm);
-    if (!platformFiles().has(name))
+    if (!platformFiles(layout).has(name))
         return false;
     return PLATFORM_FILES_AT_ANY_DEPTH.has(name) || norm === name;
 }
@@ -76,11 +77,11 @@ export function platformFileCreationRefusal(pathOrName) {
  * one takes a whole section of the knowledge base with it. Exact spelling; a
  * caller on a case-insensitive disk passes the path's on-disk spelling.
  */
-export function isPlatformFolder(repoRelativeDir) {
+export function isPlatformFolder(repoRelativeDir, layout) {
     const norm = normalize(repoRelativeDir);
     if (norm === '')
         return true;
-    return !norm.includes('/') && reservedRootDirNames().has(norm);
+    return !norm.includes('/') && reservedRootDirNames(layout).has(norm);
 }
 /** The sentence a delete or move of a platform folder is refused with. */
 export function platformFolderRefusal(repoRelativeDir) {
@@ -97,15 +98,15 @@ export function platformFolderRefusal(repoRelativeDir) {
  * of the root's rather than standing in for it, which is why moving the
  * ROOT's copy into a folder is a move out and not a restore.
  */
-export function isRootPlatformFile(repoRelativePath) {
-    return platformFiles().has(normalize(repoRelativePath));
+export function isRootPlatformFile(repoRelativePath, layout) {
+    return platformFiles(layout).has(normalize(repoRelativePath));
 }
-export function platformRestoreDestination(repoRelativeDestination) {
+export function platformRestoreDestination(repoRelativeDestination, layout) {
     const norm = normalize(repoRelativeDestination);
     if (hasTraversal(norm))
         return null;
     const name = baseName(norm);
-    if (!platformFiles().has(name))
+    if (!platformFiles(layout).has(name))
         return null;
     if (name === 'access.md') {
         const slash = norm.lastIndexOf('/');
@@ -133,15 +134,15 @@ export function platformRestoreDestination(repoRelativeDestination) {
  *  - the destination is a required location for that same name, so the file
  *    lands under the name the platform reads rather than beside it.
  */
-export function isPlatformRestoreShape(repoRelativeSource, repoRelativeDestination) {
+export function isPlatformRestoreShape(repoRelativeSource, repoRelativeDestination, layout) {
     if (hasTraversal(repoRelativeSource))
         return false;
     const name = baseName(repoRelativeSource);
-    if (!platformFiles().has(name))
+    if (!platformFiles(layout).has(name))
         return false;
-    if (isRootPlatformFile(repoRelativeSource))
+    if (isRootPlatformFile(repoRelativeSource, layout))
         return false;
-    const target = platformRestoreDestination(repoRelativeDestination);
+    const target = platformRestoreDestination(repoRelativeDestination, layout);
     return target !== null && target.name === name;
 }
 //# sourceMappingURL=platform-files.js.map

package/dist/workspace/platform-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-files.js","sourceRoot":"","sources":["../../src/workspace/platform-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,EACZ,eAAe,EACf,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAmB,eAAe,EAAE;IACpE,OAAO,CAAC,GAAG,yBAAyB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,iBAAiB,CAAC,CACrC,CAAC;AAEF,gFAAgF;AAChF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3E,6FAA6F;AAC7F,MAAM,aAAa,GAAG,GAAwB,EAAE,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAE9E,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5F,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE,CAC7C,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,gBAAwB;IACrD,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,8CAA8C,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,iEAAiE,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,eAAuB;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,eAAuB;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,OAAO,IAAI,KAAK,EAAE;QAChB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,GAAG,IAAI,wDAAwD,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAAwB;IACzD,OAAO,aAAa,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAqBD,MAAM,UAAU,0BAA0B,CACxC,uBAA+B;IAE/B,MAAM,IAAI,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAChD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,kBAA0B,EAC1B,uBAA+B;IAE/B,IAAI,YAAY,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,kBAAkB,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,0BAA0B,CAAC,uBAAuB,CAAC,CAAC;IACnE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;AACjD,CAAC"}
+{"version":3,"file":"platform-files.js","sourceRoot":"","sources":["../../src/workspace/platform-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,EACZ,oBAAoB,GAErB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,OAAO,CAAC,GAAG,yBAAyB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CACjE,iBAAiB,CAAC,iBAAiB,CAAC,CACrC,CAAC;AAEF,gFAAgF;AAChF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3E,kGAAkG;AAClG,MAAM,aAAa,GAAG,CAAC,MAAgB,EAAuB,EAAE,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5F,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE,CAC7C,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,gBAAwB,EAAE,MAAgB;IACvE,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,8CAA8C,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,iEAAiE,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,eAAuB,EAAE,MAAgB;IACxE,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,eAAuB;IAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,OAAO,IAAI,KAAK,EAAE;QAChB,CAAC,CAAC,0EAA0E;QAC5E,CAAC,CAAC,GAAG,IAAI,wDAAwD,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAAwB,EAAE,MAAgB;IAC3E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAChE,CAAC;AAqBD,MAAM,UAAU,0BAA0B,CACxC,uBAA+B,EAC/B,MAAgB;IAEhB,MAAM,IAAI,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAChD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,kBAA0B,EAC1B,uBAA+B,EAC/B,MAAgB;IAEhB,IAAI,YAAY,CAAC,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC1C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,MAAM,GAAG,0BAA0B,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;AACjD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bevel-software/platform-shared",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Shared types and pure domain utilities of the Bevel core platform (auth, workspace, git/workflow contracts, branch registry).",
   "type": "module",
   "main": "./dist/index.js",

package/src/git/pr.types.ts

@@ -277,16 +277,67 @@ export interface PullRequestDetail extends PullRequestSummary {
    */
   mergeBaseSha: string | null;
   /**
-   * True iff the target holds commits the proposal does not contain — the
-   * request needs updating. False for anything not open.
+   * True iff the target holds commits the proposal does not contain. False
+   * for anything not open.
+   *
+   * This is the honest git fact and nothing more — it says the two branches
+   * have diverged, NOT that anything about this request has gone stale. On a
+   * knowledge base where every shared save commits to the default branch,
+   * it is true again minutes after any update. What the dialog acts on is
+   * `needsUpdate`.
    */
   behind: boolean;
+  /**
+   * True iff the request is `behind` AND at least one of the files it
+   * changes was also changed on the target since the fork point — the only
+   * case where the proposal's diff describes text that has moved under it,
+   * and so the only case worth merging the target in for.
+   *
+   * A target that moved in files this request does not contain leaves the
+   * request's diff exactly as true as it was: every "before" side is read at
+   * the fork point, and the apply merges against the latest target whether an
+   * update ran or not. So a request that is `behind` but not `needsUpdate`
+   * opens straight to its files.
+   *
+   * Rename-safe in the conservative direction: the target's change list is
+   * computed without rename detection, so a file the target renamed appears
+   * under both names and a request holding either name counts as affected.
+   * False whenever `behind` is false, and true (with `behind`) when the two
+   * branches share no history at all — there is no fork point to intersect
+   * against, so nothing may be assumed unaffected.
+   */
+  needsUpdate: boolean;
   /**
    * True iff the viewer may Update the request (merge its target into it):
    * the request is open AND the viewer is its author or may apply it. A UX
    * hint — the update route re-checks the same predicate server-side.
    */
   viewerCanUpdate: boolean;
+  /**
+   * True iff the viewer is this request's author — the person who opened it,
+   * hash-matched against the stored `authorId` so the client never has to
+   * hash an email (and no raw email is exposed to do it with). A request a
+   * person's agent opened belongs to that person. Drives wording that speaks
+   * to the author directly ("You can delete it below.") rather than naming
+   * them in the third person. False when no viewer was passed, and for a
+   * request opened outside this backend (no `authorId`).
+   */
+  viewerIsAuthor: boolean;
+  /**
+   * True iff the viewer may delete this request (close it AND retire its
+   * branch): the request is not applied AND the viewer is either its author
+   * or an admin (`viewerCanBypassMerge` is the proxy — the same
+   * `canWriteAtRef('roles.yaml')` predicate the DELETE route enforces).
+   * Deliberately NOT `viewerCanCancel`: that one also grants the changed
+   * files' owners, who may decline a request but must not destroy someone
+   * else's text and branch.
+   *
+   * Note this is true on a CLOSED request too, mirroring the server: a
+   * request withdrawn in another tab still has a leftover branch for the
+   * delete to retire. Only an applied one is nobody's to delete. A UX hint —
+   * `DELETE /api/workflow/change-requests/:number` re-checks server-side.
+   */
+  viewerCanDelete: boolean;
 }
 
 /**

package/src/git/protected.ts

@@ -3,20 +3,29 @@
  * their user-visible display names. Single source of truth for BOTH sides of
  * the app, so backend enforcement and frontend affordances can never drift.
  *
- * CONFIGURED, NOT IMPORTED. This module used to read `process.env` at import
- * time and throw when it found nothing — which made the branch model something
- * a deployment had to know before any code could load. On the frontend that
- * meant baking it into the bundle at build time (Vite `define`), so the same
- * artifact could not serve two deployments and changing a branch name meant a
- * rebuild. Both sides now CALL {@link configureBranchModel} during boot:
- * the backend from its environment, the browser from `GET /api/config`.
+ * TWO SHAPES, ONE RULE SET.
  *
- * The exported bindings stay bindings — `DEFAULT_BRANCH` is still imported and
- * read exactly as before at every call site. ES module live bindings mean a
- * reader inside a function body sees whatever configuration has been applied by
- * the time it runs. What does NOT work is capturing one at module scope
- * (`const X = DEFAULT_BRANCH` in a file's top level), which snapshots the value
- * at import — before configuration. Use a function there instead.
+ * A VALUE ({@link BranchModelValue}), resolved by {@link resolveBranchModel}
+ * from the shape `/api/config` serves and the setup screen collects. The pure
+ * helpers below (`isProtectedBranch`, `protectedBranchDisplayName`) take the
+ * value they judge against, so a caller holding two deployments' models — a
+ * server hosting several knowledge bases in one process — asks about each by
+ * name. The backend uses ONLY this shape: every service is handed its
+ * knowledge base's model at construction and never reads a process-wide one.
+ *
+ * The BROWSER'S live bindings (`DEFAULT_BRANCH`, `PROTECTED_BRANCHES`, …),
+ * applied once by {@link configureBranchModel} from `GET /api/config` before
+ * React renders. A page shows one deployment, so one process-wide value is
+ * the right shape there, and the bindings let a component read the model
+ * without threading it through props. They are for the browser: the backend
+ * package forbids importing them (an ESLint rule names each one), and a
+ * server that configured them would be setting a value for every knowledge
+ * base it serves at once.
+ *
+ * Reading a live binding works inside a function body, which sees whatever
+ * configuration has been applied by the time it runs. What does NOT work is
+ * capturing one at module scope (`const X = DEFAULT_BRANCH` in a file's top
+ * level), which snapshots the value at import — before configuration.
  */
 
 declare const process: { env: Record<string, string | undefined> };
@@ -39,26 +48,66 @@ function deriveDisplayName(slug: string): string {
   return spaced.charAt(0).toUpperCase() + spaced.slice(1);
 }
 
+/** The shape both sides configure from, and the shape `/api/config` serves. */
+export interface BranchModel {
+  defaultBranch: string;
+  /** Slugs; a comma/space-separated string is accepted for env convenience. */
+  protectedBranches: string[] | string;
+}
+
+/**
+ * A branch model as a VALUE: the resolved, validated form of {@link BranchModel}
+ * that everything judging a branch is handed.
+ *
+ * `defaultBranch` is the branch a logged-in user lands on when they don't
+ * explicitly pick one, and the default destination for shared drafts. It is
+ * the empty string on the one model that is not configured yet
+ * ({@link UNCONFIGURED_BRANCH_MODEL}): a fresh deployment has no branch model
+ * until its setup screen is answered, and everything behind that gate reads
+ * the model only once it is.
+ */
+export interface BranchModelValue {
+  readonly defaultBranch: string;
+  readonly protectedBranches: ReadonlySet<string>;
+  /** Slug → human-readable name, for every protected branch. */
+  readonly displayNames: Readonly<Record<string, string>>;
+}
+
+/**
+ * The model a deployment has before setup has answered for one: no default
+ * branch, nothing protected. {@link isBranchModelConfigured} is false for
+ * exactly this value.
+ */
+export const UNCONFIGURED_BRANCH_MODEL: BranchModelValue = Object.freeze({
+  defaultBranch: '',
+  protectedBranches: new Set<string>(),
+  displayNames: Object.freeze({}),
+});
+
+/**
+ * Whether a model has been configured — the frontend gates render on this, and
+ * the backend's setup gate keeps the app shut until it holds.
+ */
+export function isBranchModelConfigured(model: BranchModelValue): boolean {
+  return model.defaultBranch !== '';
+}
+
 /**
  * The branch a logged-in user lands on when they don't explicitly pick one, and
- * the default destination for shared drafts.
+ * the default destination for shared drafts. BROWSER-SIDE live binding — see
+ * this file's header; the backend reads its `BranchModelValue` instead.
  *
  * Empty until {@link configureBranchModel} runs. Read it inside a function, not
- * at module scope — see this file's header.
+ * at module scope.
  */
 export let DEFAULT_BRANCH: string = '';
 
+/** Browser-side live binding — see this file's header. */
 export let PROTECTED_BRANCH_DISPLAY_NAMES: Readonly<Record<string, string>> = Object.freeze({});
 
+/** Browser-side live binding — see this file's header. */
 export let PROTECTED_BRANCHES: ReadonlySet<string> = new Set<string>();
 
-/** The shape both sides configure from, and the shape `/api/config` serves. */
-export interface BranchModel {
-  defaultBranch: string;
-  /** Slugs; a comma/space-separated string is accepted for env convenience. */
-  protectedBranches: string[] | string;
-}
-
 /**
  * Apply the branch model. Called once during boot on each side, and validated
  * here rather than at either call site so the two cannot disagree about what
@@ -96,22 +145,46 @@ export function validateBranchModel(model: BranchModel): string | null {
   return null;
 }
 
-export function configureBranchModel(model: BranchModel): void {
+/**
+ * Resolve a model into the value everything judges against. Throws on an
+ * invalid pair — the same rule {@link validateBranchModel} states — so a
+ * value, once held, is known to be a usable one.
+ */
+export function resolveBranchModel(model: BranchModel): BranchModelValue {
   const problem = validateBranchModel(model);
   if (problem) throw new Error(problem);
-  const defaultBranch = model.defaultBranch.trim();
   const list = branchListOf(model);
+  return Object.freeze({
+    defaultBranch: model.defaultBranch.trim(),
+    protectedBranches: new Set(list),
+    displayNames: Object.freeze(Object.fromEntries(list.map((slug) => [slug, deriveDisplayName(slug)]))),
+  });
+}
 
-  DEFAULT_BRANCH = defaultBranch;
-  PROTECTED_BRANCH_DISPLAY_NAMES = Object.freeze(
-    Object.fromEntries(list.map((slug) => [slug, deriveDisplayName(slug)])),
-  );
-  PROTECTED_BRANCHES = new Set(list);
+/**
+ * Apply the model to the BROWSER'S live bindings. Called once during boot,
+ * from `GET /api/config`, before anything reads them. Validated by
+ * {@link resolveBranchModel}, so the bindings and a value resolved from the
+ * same model can never disagree.
+ */
+export function configureBranchModel(model: BranchModel): void {
+  const value = resolveBranchModel(model);
+  DEFAULT_BRANCH = value.defaultBranch;
+  PROTECTED_BRANCH_DISPLAY_NAMES = value.displayNames;
+  PROTECTED_BRANCHES = value.protectedBranches;
 }
 
-/** Whether {@link configureBranchModel} has run — the frontend gates render on this. */
-export function isBranchModelConfigured(): boolean {
-  return DEFAULT_BRANCH !== '';
+/**
+ * The browser's model as a value — for the code paths that take a
+ * {@link BranchModelValue} and run in the browser, where the one model in
+ * effect is the configured one.
+ */
+export function currentBranchModel(): BranchModelValue {
+  return {
+    defaultBranch: DEFAULT_BRANCH,
+    protectedBranches: PROTECTED_BRANCHES,
+    displayNames: PROTECTED_BRANCH_DISPLAY_NAMES,
+  };
 }
 
 /**
@@ -125,11 +198,9 @@ export function branchModelFromEnv(): BranchModel {
   };
 }
 
-export function isProtectedBranch(name: string | null | undefined): boolean {
-  return !!name && Object.prototype.hasOwnProperty.call(
-    PROTECTED_BRANCH_DISPLAY_NAMES,
-    name,
-  );
+/** Whether `name` is one of `model`'s protected branches. */
+export function isProtectedBranch(model: BranchModelValue, name: string | null | undefined): boolean {
+  return !!name && model.protectedBranches.has(name);
 }
 
 /**
@@ -145,8 +216,11 @@ export function isProtectedBranch(name: string | null | undefined): boolean {
  * whether to fall back to the raw string or hide the affordance.
  */
 export function protectedBranchDisplayName(
+  model: BranchModelValue,
   name: string | null | undefined,
 ): string | null {
   if (!name) return null;
-  return PROTECTED_BRANCH_DISPLAY_NAMES[name] ?? null;
+  return Object.prototype.hasOwnProperty.call(model.displayNames, name)
+    ? model.displayNames[name]!
+    : null;
 }

package/src/git/types.ts

@@ -152,7 +152,20 @@ export interface IGitService {
    * the distinction: an "already up to date" pull that broadcast anyway would
    * drop every catalog cache and reload every attached browser for nothing.
    */
-  pull(workspaceId: string): Promise<{ treeChanged: boolean }>;
+  pull(
+    workspaceId: string,
+    opts?: {
+      /**
+       * Replay the local commits with `--rebase-merges`, so a merge commit
+       * the clone holds but origin has not seen survives the replay AS a
+       * merge instead of being flattened into cherry-picks of its second
+       * parent's commits. Only the change-request update asks for it: it is
+       * the one caller whose unpushed commit is deliberately a merge, and
+       * whose whole point is that the merge reaches the remote intact.
+       */
+      preserveMerges?: boolean;
+    },
+  ): Promise<{ treeChanged: boolean }>;
   /**
    * The remote sync's pull, observed as ONE serialized operation: where HEAD
    * was, the pull, where HEAD is, and which repo-relative paths changed
@@ -275,6 +288,21 @@ export interface IGitService {
     at: { baseSha: string; headSha: string },
   ): Promise<{ mergeBaseSha: string | null; behind: boolean }>;
 
+  /**
+   * Every repo-relative path whose content differs between two commits, as a
+   * plain two-dot diff with rename detection OFF — so a rename reports both
+   * the path it left and the path it arrived at. Two callers want exactly
+   * that conservative answer: the approvals carry-forward (a path that
+   * appears loses its approval) and "did the target change a file this
+   * request also changes" (a request editing a file the target renamed has
+   * to count as affected).
+   */
+  pathsChangedBetween(
+    workspaceId: string,
+    fromSha: string,
+    toSha: string,
+  ): Promise<string[]>;
+
   /**
    * A file's content at a change request's fork point — a commit that must
    * be on `baseBranch`'s history. `null` when the path did not exist there.

package/src/workflow/interface.ts

@@ -30,6 +30,7 @@ import type {
   ChangeRequest,
   ChangeRequestComment,
   ChangeRequestDetail,
+  ChangeRequestUpdateResult,
   ChangeRequestState,
   ChangedFile,
   FileApproval,
@@ -424,6 +425,23 @@ export interface IWorkflowService {
     opts?: { fresh?: boolean },
   ): Promise<ChangeRequest[]>;
   getChangeRequest(number: number): Promise<ChangeRequest | null>;
+  /**
+   * The NEWEST change request from `sourceBranch` by `authorEmail` that is no
+   * longer open, or null when every one of theirs on that branch is still
+   * open (or there never was one).
+   *
+   * Why it is asked this narrowly: a request that has been declined, or that
+   * its author withdrew, leaves no other trace — `listChangeRequestsAuthoredBy`
+   * lists open requests only, and nothing records WHO closed a request. Asking
+   * for the last non-open one on a deterministic branch is enough to tell
+   * "your last request was not accepted" from "you never asked", without a new
+   * column. A MERGED request counts as non-open too: the caller distinguishes
+   * the two by whether the access it asked for has landed.
+   */
+  latestClosedChangeRequest(
+    authorEmail: string,
+    sourceBranch: string,
+  ): Promise<{ number: number; state: ChangeRequestState } | null>;
   getChangeRequestDetail(
     number: number,
     /**
@@ -457,8 +475,16 @@ export interface IWorkflowService {
    * someone who may apply it (`viewerCanUpdate`) may run it (403 otherwise).
    * A conflicting merge is aborted, leaving the branch exactly as it was, and
    * surfaces as `ChangeRequestConflictsError` (409).
+   *
+   * Answers the refreshed detail plus `updatedPaths`: which files the merge
+   * changed on the branch, so a caller showing the pre-update files can
+   * replace exactly those.
    */
-  updateFromTarget(workspaceId: string, user: AuthUser, number: number): Promise<ChangeRequestDetail>;
+  updateFromTarget(
+    workspaceId: string,
+    user: AuthUser,
+    number: number,
+  ): Promise<ChangeRequestUpdateResult>;
 
   // Comments
   listComments(number: number): Promise<ChangeRequestComment[]>;

package/src/workflow/types.ts

@@ -124,6 +124,22 @@ export type AcquireLockResult =
  */
 export type ChangeRequest = PullRequestSummary;
 export type ChangeRequestDetail = PullRequestDetail;
+/**
+ * What an Update hands back: the refreshed detail, plus the repo-relative
+ * paths the merge actually changed on the request's branch.
+ *
+ * The dialog runs its update behind the files it is already showing, so when
+ * the update lands it has to replace file content it has read. `updatedPaths`
+ * is which — git's own two-dot diff between the branch head before the merge
+ * and after it, the same list the approvals carry-forward is decided on. A
+ * client that forgot everything instead would re-read every file in the
+ * request to replace the one or two the merge touched, and blank the pane the
+ * reader is mid-sentence in.
+ *
+ * Empty when the merge changed nothing on the branch — including the case
+ * where there was nothing to merge.
+ */
+export type ChangeRequestUpdateResult = ChangeRequestDetail & { updatedPaths: string[] };
 export type ChangeRequestState = PullRequestState;
 export type ChangedFile = PullRequestFile;