@cleocode/cleo 2026.10.27 → 2026.11.1-canary.3

package/dist/cli/{provenance-2SFRY42O.js → provenance-J7OB5YAT.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -26,7 +26,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/provenance.ts
 var backfillCommand = defineCommand({
@@ -126,4 +126,4 @@ var provenanceCommand = defineCommand({
 export {
   provenanceCommand
 };
-//# sourceMappingURL=provenance-2SFRY42O.js.map
+//# sourceMappingURL=provenance-J7OB5YAT.js.map

package/dist/cli/{provider-G6MBFVHR.js → provider-T37WWONR.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-YY66LFZF.js";
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -28,7 +28,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/provider.ts
 var listCommand = defineCommand({
@@ -210,4 +210,4 @@ var providerCommand = defineCommand({
 export {
   providerCommand
 };
-//# sourceMappingURL=provider-G6MBFVHR.js.map
+//# sourceMappingURL=provider-T37WWONR.js.map

package/dist/cli/{reason-2AYZ6SGZ.js → reason-D6W5GCAS.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -28,7 +28,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/reason.ts
 var impactCommand = defineCommand({
@@ -135,4 +135,4 @@ var reasonCommand = defineCommand({
 export {
   reasonCommand
 };
-//# sourceMappingURL=reason-2AYZ6SGZ.js.map
+//# sourceMappingURL=reason-D6W5GCAS.js.map

package/dist/cli/{reconcile-7CBD7AHH.js → reconcile-FK2AVHTK.js}

@@ -16,7 +16,7 @@
 import {
   dispatchRaw,
   handleRawError
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -29,7 +29,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/reconcile.ts
 import { release } from "@cleocode/core";
@@ -125,4 +125,4 @@ var reconcileCommand = defineCommand({
 export {
   reconcileCommand
 };
-//# sourceMappingURL=reconcile-7CBD7AHH.js.map
+//# sourceMappingURL=reconcile-FK2AVHTK.js.map

package/dist/cli/{relates-FP43JAOK.js → relates-4UYF5ZTG.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-47JYZAMS.js";
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -29,7 +29,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/relates.ts
 import { readFile } from "node:fs/promises";
@@ -257,4 +257,4 @@ var relatesCommand = defineCommand({
 export {
   relatesCommand
 };
-//# sourceMappingURL=relates-FP43JAOK.js.map
+//# sourceMappingURL=relates-4UYF5ZTG.js.map

package/dist/cli/{release-NW7XHRVB.js → release-NHPX6QOO.js}

@@ -19,7 +19,7 @@ import {
 import "./chunk-VIZSF3NL.js";
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -33,7 +33,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/release.ts
 import { release as release2 } from "@cleocode/core";
@@ -510,6 +510,126 @@ var reconcileCommand = defineCommand({
     process.exit(1);
   }
 });
+var cutCommand = defineCommand({
+  meta: {
+    name: "cut",
+    description: "Release from the newest default-branch commit with green CI: report it (commit, notes, packages, task status) and print the confirm command; with --yes, tag it, and release.yml writes the notes from changesets and publishes (no plan PR, no bump PR). (T14102, D11212)"
+  },
+  args: {
+    version: {
+      type: "positional",
+      description: "Release version (accepts v2026.10.28 or 2026.10.28)",
+      required: true
+    },
+    sha: {
+      type: "string",
+      description: "Pin the commit instead of the newest green one; it must itself be green"
+    },
+    lead: {
+      type: "string",
+      description: "Markdown file that leads the notes (Update now + Highlights); stored in the tag"
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Report the commit, notes, packages and tasks without creating the tag"
+    },
+    yes: {
+      type: "boolean",
+      description: "Create the tag (D11212): asks you to type the version on the terminal (/dev/tty), or uses a standing release authorization (T14141) or the release.agentCut setting (cleo config set release.agentCut canary --scope global, T14170). Without it the cut only reports and prints the confirm command"
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "mutate",
+      "release",
+      "cut",
+      {
+        version: args.version,
+        ...typeof args.sha === "string" ? { sha: args.sha } : {},
+        ...typeof args.lead === "string" ? { lead: args.lead } : {},
+        dryRun: args["dry-run"] === true,
+        yes: args.yes === true
+      },
+      { command: "release" }
+    );
+  }
+});
+var writeChangelogCommand = defineCommand({
+  meta: {
+    name: "write-changelog",
+    description: "Write the CHANGELOG.md section for a version from the changesets added since the previous release tag (used by release.yml for `release cut`). (T14102)"
+  },
+  args: {
+    version: {
+      type: "positional",
+      description: "Release version (accepts v2026.10.28 or 2026.10.28)",
+      required: true
+    },
+    ref: {
+      type: "string",
+      description: "Commit the release was cut from (default: tag v<version>, else HEAD)"
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "mutate",
+      "release",
+      "write-changelog",
+      { version: args.version, ...typeof args.ref === "string" ? { ref: args.ref } : {} },
+      { command: "release" }
+    );
+  }
+});
+var verifyTagCommand = defineCommand({
+  meta: {
+    name: "verify-tag",
+    description: "Check that the release tag points at a first-parent commit of origin/main whose required checks are green on its push run (used by release.yml before publishing). (T14102)"
+  },
+  args: {
+    version: {
+      type: "positional",
+      description: "Release version (accepts v2026.10.28 or 2026.10.28)",
+      required: true
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "release",
+      "verify-tag",
+      { version: args.version },
+      { command: "release" }
+    );
+  }
+});
+var authorizeCommand = defineCommand({
+  meta: {
+    name: "authorize",
+    description: "Grant or --revoke (owner only: TTY + owner-auth password), or --list, a standing release authorization that lets an agent run `cleo release cut --yes` for a scope (canary|prerelease|stable|version) until it expires (at most 30d). Grants and revocations are signed with the enrolled owner key and the revocation count is sealed in .cleo/owner-settings.json; commit that file. Limit: an agent running as your OS user that also rolls back the committed owner-settings.json is not detectable locally (the same trust boundary as the override cap). (T14141)"
+  },
+  args: {
+    scope: { type: "string", description: "canary, prerelease, stable, or one exact version" },
+    expires: { type: "string", description: "Lifetime: 30m, 24h, 7d (at most 30d)" },
+    reason: {
+      type: "string",
+      description: "Why the owner grants it (recorded as an owner decision)"
+    },
+    uses: { type: "string", description: "Optional cap on cuts it allows (default: no limit)" },
+    revoke: { type: "string", description: "Revoke the grant with this id" },
+    list: { type: "boolean", description: "List grants and their state" }
+  },
+  async run({ args }) {
+    const { runReleaseAuthorize } = await import("./release-authorize-IV4MF6OV.js");
+    await runReleaseAuthorize({
+      ...typeof args.scope === "string" ? { scope: args.scope } : {},
+      ...typeof args.expires === "string" ? { expires: args.expires } : {},
+      ...typeof args.reason === "string" ? { reason: args.reason } : {},
+      ...typeof args.uses === "string" ? { uses: args.uses } : {},
+      ...typeof args.revoke === "string" ? { revoke: args.revoke } : {},
+      list: args.list === true
+    });
+  }
+});
 var releaseCommand = defineCommand({
   meta: {
     name: "release",
@@ -518,6 +638,11 @@ var releaseCommand = defineCommand({
   subCommands: {
     // Canonical SPEC-T9345 4-verb pipeline — list these first so `--help`
     // surfaces them as the documented default.
+    // T14102 — one-command release; plan/open stay one release as fallback (T14114).
+    cut: cutCommand,
+    "write-changelog": writeChangelogCommand,
+    "verify-tag": verifyTagCommand,
+    authorize: authorizeCommand,
     plan: planCommand,
     open: openCommand,
     reconcile: reconcileCommand,
@@ -543,4 +668,4 @@ var releaseCommand = defineCommand({
 export {
   releaseCommand
 };
-//# sourceMappingURL=release-NW7XHRVB.js.map
+//# sourceMappingURL=release-NHPX6QOO.js.map

package/dist/cli/{release-OWPFPUQG.js → release-XT2L6BZ6.js}

@@ -21,13 +21,21 @@ import {
 } from "./chunk-XD25OCUE.js";
 
 // packages/cleo/src/dispatch/domains/release.ts
-import { getLogger, getProjectRoot, resolveWorktreeRouting } from "@cleocode/core/internal";
 import {
+  getLogger,
+  getProjectRoot,
+  resolveInvokingCheckout,
+  resolveWorktreeRouting
+} from "@cleocode/core/internal";
+import {
+  releaseChangelog,
+  releaseCut,
   releaseGateCheck,
   releaseIvtrAutoSuggest,
   releaseOpen,
   releasePlan,
   releaseReconcileV2,
+  releaseVerifyTag,
   validateChangelog
 } from "@cleocode/runtime/gateway";
 var log = getLogger("domain:release");
@@ -108,6 +116,28 @@ var ReleaseHandler = class {
         // non-zero exit code — exactly the behaviour CI workflows depend on
         // (the legacy `grep -qF "## [VERSION]" || exit 1` had the same
         // contract).
+        // release.verify-tag — T14102: release.yml refuses to publish a tag
+        // that is not a green first-parent commit of the default branch.
+        case "verify-tag": {
+          const version = typeof params?.version === "string" ? params.version : void 0;
+          if (!version)
+            return errorResult(
+              "query",
+              "release",
+              operation,
+              "E_INVALID_INPUT",
+              // @sync-invariant none:input-shape a missing version is refused before anything is read
+              "version is required",
+              startTime
+            );
+          return wrapResult(
+            await releaseVerifyTag({ version, projectRoot: resolveInvokingCheckout() }),
+            "query",
+            "release",
+            operation,
+            startTime
+          );
+        }
         case "validate-changelog": {
           const version = typeof params?.version === "string" ? params.version : void 0;
           if (!version)
@@ -325,6 +355,52 @@ var ReleaseHandler = class {
           });
           return wrapResult(result, "mutate", "release", operation, startTime);
         }
+        // release.cut — T14102: tag the newest green default-branch commit
+        // (release.yml then publishes); --dry-run reports without tagging.
+        case "cut": {
+          const version = typeof params?.version === "string" ? params.version : void 0;
+          if (!version)
+            return errorResult(
+              "mutate",
+              "release",
+              operation,
+              "E_INVALID_INPUT",
+              // @sync-invariant none:input-shape a missing version is refused before any tag or file write
+              "version is required",
+              startTime
+            );
+          const typed = {
+            version,
+            projectRoot: getProjectRoot(),
+            gitRoot: resolveInvokingCheckout(),
+            ...typeof params?.sha === "string" ? { sha: params.sha } : {},
+            ...typeof params?.lead === "string" ? { leadFile: params.lead } : {},
+            dryRun: params?.dryRun === true,
+            yes: params?.yes === true
+          };
+          return wrapResult(await releaseCut(typed), "mutate", "release", operation, startTime);
+        }
+        // release.write-changelog — T14102: write the CHANGELOG section from
+        // the changesets since the previous tag (run by release.yml).
+        case "write-changelog": {
+          const version = typeof params?.version === "string" ? params.version : void 0;
+          if (!version)
+            return errorResult(
+              "mutate",
+              "release",
+              operation,
+              "E_INVALID_INPUT",
+              // @sync-invariant none:input-shape a missing version is refused before any tag or file write
+              "version is required",
+              startTime
+            );
+          const result = await releaseChangelog({
+            version,
+            projectRoot: resolveInvokingCheckout(),
+            ...typeof params?.ref === "string" ? { ref: params.ref } : {}
+          });
+          return wrapResult(result, "mutate", "release", operation, startTime);
+        }
         default:
           return unsupportedOp("mutate", "release", operation, startTime);
       }
@@ -339,12 +415,12 @@ var ReleaseHandler = class {
   /** Return declared operations for introspection and registry validation. */
   getSupportedOperations() {
     return {
-      query: ["gate", "ivtr-suggest", "validate-changelog"],
-      mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open"]
+      query: ["gate", "ivtr-suggest", "validate-changelog", "verify-tag"],
+      mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open", "cut", "write-changelog"]
     };
   }
 };
 export {
   ReleaseHandler
 };
-//# sourceMappingURL=release-OWPFPUQG.js.map
+//# sourceMappingURL=release-XT2L6BZ6.js.map

package/dist/cli/release-authorize-IV4MF6OV.js

@@ -0,0 +1,84 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  ownerCaller
+} from "./chunk-6C5X2J6S.js";
+import "./chunk-THHPBHFL.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-ESI6Q4OS.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/lib/release-authorize.ts
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
+async function runReleaseAuthorize(args) {
+  const meta = { command: "release-authorize", operation: "release.authorize" };
+  const fail = (code, message, exit = ExitCode.GENERAL_ERROR) => {
+    cliError(message, exit, { name: code }, { operation: meta.operation });
+    process.exit(exit);
+  };
+  const [core, { getProjectRoot }] = await Promise.all([
+    import("@cleocode/core/internal"),
+    import("@cleocode/core/project-scope")
+  ]);
+  const root = getProjectRoot();
+  if (args.list) {
+    cliOutput({ grants: await core.listReleaseAuthorizations(root) }, meta);
+    return;
+  }
+  if (args.revoke) {
+    const { caller: caller2 } = await ownerCaller("release authorization revoke");
+    const result2 = await core.revokeReleaseAuthorization(root, { ...caller2, id: args.revoke });
+    if (!result2.ok) return fail(result2.code, result2.message);
+    cliOutput(
+      {
+        revoked: result2.grant.id,
+        scope: result2.grant.scope,
+        next: "Commit .cleo/owner-settings.json: it seals the revocation count."
+      },
+      meta
+    );
+    return;
+  }
+  if (!args.scope || !args.expires || !args.reason) {
+    return fail(
+      "E_VALIDATION",
+      "Grant with --scope <canary|prerelease|stable|version> --expires <30m|24h|30d> --reason <why> [--uses <n>], or use --list / --revoke <id>",
+      ExitCode.VALIDATION_ERROR
+    );
+  }
+  const { caller } = await ownerCaller("release authorization");
+  const result = await core.grantReleaseAuthorization(root, {
+    ...caller,
+    scope: args.scope,
+    expires: args.expires,
+    reason: args.reason,
+    ...args.uses !== void 0 ? { uses: Number(args.uses) } : {}
+  });
+  if (!result.ok) {
+    return fail(
+      result.code,
+      result.message,
+      result.code === "E_VALIDATION" ? ExitCode.VALIDATION_ERROR : ExitCode.GENERAL_ERROR
+    );
+  }
+  cliOutput({ grant: result.grant }, meta);
+}
+export {
+  runReleaseAuthorize
+};
+//# sourceMappingURL=release-authorize-IV4MF6OV.js.map

package/dist/cli/{reorder-M457CQRR.js → reorder-3WRIRG5F.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -27,7 +27,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/reorder.ts
 var BOTTOM_POSITION = 999999;
@@ -84,4 +84,4 @@ var reorderCommand = defineCommand({
 export {
   reorderCommand
 };
-//# sourceMappingURL=reorder-M457CQRR.js.map
+//# sourceMappingURL=reorder-3WRIRG5F.js.map

package/dist/cli/{reparent-53T6IUUS.js → reparent-OBDMBMHO.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/reparent.ts
 var reparentCommand = defineCommand({
@@ -56,4 +56,4 @@ var reparentCommand = defineCommand({
 export {
   reparentCommand
 };
-//# sourceMappingURL=reparent-53T6IUUS.js.map
+//# sourceMappingURL=reparent-OBDMBMHO.js.map

package/dist/cli/{req-ORMMU5PV.js → req-IC66XI36.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -28,7 +28,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/req.ts
 var addCommand = defineCommand({
@@ -169,4 +169,4 @@ var reqCommand = defineCommand({
 export {
   reqCommand
 };
-//# sourceMappingURL=req-ORMMU5PV.js.map
+//# sourceMappingURL=req-IC66XI36.js.map

package/dist/cli/{research-LFGCGIEP.js → research-637G66T4.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -28,7 +28,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/research.ts
 function generateResearchId() {
@@ -336,4 +336,4 @@ var researchCommand = defineCommand({
 export {
   researchCommand
 };
-//# sourceMappingURL=research-LFGCGIEP.js.map
+//# sourceMappingURL=research-637G66T4.js.map

package/dist/cli/{restore-ZYRIZQUJ.js → restore-VJ6UVTFO.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchRaw
-} from "./chunk-OIS3BDSL.js";
+} from "./chunk-K6I66OSL.js";
 import {
   CLEO_DIR_NAME,
   RESTORE_CONFLICTS_MD,
@@ -34,7 +34,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-JRDAITPC.js";
+import "./chunk-V3ZUZYBZ.js";
 
 // packages/cleo/src/cli/commands/restore.ts
 import fs from "node:fs";
@@ -479,4 +479,4 @@ export {
   parseConflictReport2 as parseConflictReport,
   restoreCommand
 };
-//# sourceMappingURL=restore-ZYRIZQUJ.js.map
+//# sourceMappingURL=restore-VJ6UVTFO.js.map