@idea1/cli 1.11.0 → 1.11.1

package/dist/workflow/engine/handlers/approve-pr.js

@@ -1,22 +1,23 @@
 import { logger } from '../../../lib/logger.js';
 import * as git from '../../../services/git.js';
 import * as github from '../../../services/github.js';
+import * as platform from '../../../services/platform.js';
 import { WorkflowBranchState } from '../../data/workflow-context.js';
 import { WorkflowStates } from '../../data/workflow-states.js';
-import { cleanUpMergedBranch, mergeAsApprover, mergeConfirmationOption } from '../approval-flow.js';
-import { confirmApproverIdentity } from '../release-engine.js';
-import { isWorkMerged, requireContext, requireLiveContext } from '../workflow-engine.js';
+import { cleanUpMergedBranch, mergeAsApprover, mergeConfirmationOption, requireSignedInAssignee } from '../approval-flow.js';
+import { RECORDED_BY_PLATFORM, isWorkMerged, requireContext, requireLiveContext } from '../workflow-engine.js';
 /**
- * Entering "Approved and Merged": merge the PR. The merge IS the approval - it is performed by
- * the PR's assignee, and GitHub records it as `merged_by` with a timestamp and merge commit
- * (change-management-policy.md, "Approval and release gates", stage 1). The merge waits for the required CI/CD checks
- * and there is no override at this stage: a red or unfinished suite stops it. A repository with no
- * CI/CD configured has no suite to wait for, so its PR merges straight away.
+ * Entering "Approved and Merged": the PR's assignee approves it, which merges it
+ * (change-management-policy.md, "Approval and release gates", stage 1). The approval waits for the
+ * required CI/CD checks and there is no override at this stage: a red or unfinished suite stops it.
+ * A repository with no CI/CD configured has no suite to wait for, so its PR is approved straight
+ * away.
  *
- * The branch is merged as it stands, so the checks waited for are the checks of what merges.
- * Afterwards the branch and any worktree are cleaned up; the platform records the branch as merged
- * when GitHub reports its deletion. A context whose branch is already merged has all the pull
- * request work done, so re-entering this state leaves it as it is.
+ * Once the checks pass the item is moved into this state on the platform, which records the
+ * signed-in user's approval on the PR, merges it as the Idea1 GitHub App and records the state, all
+ * in that one transition. The branch is merged as it stands, so the checks waited for are the checks
+ * of what merges. Afterwards the branch and any worktree are cleaned up. A context whose branch is
+ * already merged has all the pull request work done, so re-entering this state leaves it as it is.
  */
 export const approvePrHandler = {
     state: WorkflowStates.ApprovedAndMerged,
@@ -43,14 +44,20 @@ export const approvePrHandler = {
             context.branchState = WorkflowBranchState.Merged;
             return;
         }
-        await confirmApproverIdentity(context.branchName);
-        await mergeAsApprover({
+        await requireSignedInAssignee(context.branchName, context.baseBranch);
+        const expectedStatus = transition.currentState ?? '';
+        const recorded = await mergeAsApprover({
             branchName: context.branchName,
             baseBranch: context.baseBranch,
             prNumber: prInfo.number,
-            confirmed: transition.options[mergeConfirmationOption.longName] === 'true'
+            confirmed: transition.options[mergeConfirmationOption.longName] === 'true',
+            approveOnPlatform: async () => (await platform.transitionWorkflow(transition.projectItemUrl, expectedStatus, WorkflowStates.ApprovedAndMerged)).workflowContext
         });
-        context.branchState = WorkflowBranchState.Merged;
+        if (recorded.branchState !== WorkflowBranchState.Merged) {
+            throw new Error(`idea1.ai moved ${transition.projectItemUrl} to "${recorded.workflowStatus}" without merging PR #${prInfo.number}.`);
+        }
+        Object.assign(context, recorded);
+        return RECORDED_BY_PLATFORM;
     },
     async complete(transition) {
         const context = requireContext(transition);
@@ -62,7 +69,7 @@ export const approvePrHandler = {
         logger.newline();
         logger.success('Workflow complete!');
         logger.newline();
-        logger.hint(`PR merged into ${context.baseBranch} - the merge is the recorded approval`);
+        logger.hint(`PR merged into ${context.baseBranch}, with your approval recorded on it`);
         logger.hint(`Project item: ${transition.projectItemUrl}`);
     }
 };

package/dist/workflow/engine/handlers/approve-pr.js.map

@@ -1 +1 @@
-{"version":3,"file":"approve-pr.js","sourceRoot":"","sources":["../../../../src/workflow/engine/handlers/approve-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAA6B,MAAM,uBAAuB,CAAC;AAEpH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,KAAK,EAAE,cAAc,CAAC,iBAAiB;IACvC,OAAO,EAAE,CAAC,uBAAuB,CAAC;IAElC,KAAK,CAAC,OAAO,CAAC,UAAU;QACtB,qEAAqE;QACrE,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC1C,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;QAEpC,oFAAoF;QACpF,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,yCAAyC,CAAC,CAAC;YAC1E,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,eAAe,CAAC;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,MAAM;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAU;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,mBAAmB,CAAC;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,UAAU,uCAAuC,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF,CAAC"}
+{"version":3,"file":"approve-pr.js","sourceRoot":"","sources":["../../../../src/workflow/engine/handlers/approve-pr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,GAAG,MAAM,0BAA0B,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,6BAA6B,CAAC;AACtD,OAAO,KAAK,QAAQ,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC7H,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAA6B,MAAM,uBAAuB,CAAC;AAE1I;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,KAAK,EAAE,cAAc,CAAC,iBAAiB;IACvC,OAAO,EAAE,CAAC,uBAAuB,CAAC;IAElC,KAAK,CAAC,OAAO,CAAC,UAAU;QACtB,qEAAqE;QACrE,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC1C,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;QAEpC,oFAAoF;QACpF,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,yCAAyC,CAAC,CAAC;YAC1E,OAAO,CAAC,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,MAAM;YAC1E,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,CAAC,MAAM,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe;SACnI,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,WAAW,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,cAAc,QAAQ,QAAQ,CAAC,cAAc,yBAAyB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvI,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAU;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,mBAAmB,CAAC;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,UAAU,qCAAqC,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF,CAAC"}

package/dist/workflow/engine/release-engine.d.ts

@@ -1,25 +1,36 @@
 import type { CommandOption, VersionedPackage } from '../../types/index.js';
+import * as github from '../../services/github.js';
 /**
  * The release engine: the gated PR sequence, a PR whose body is the approval chain of the changes it carries, assigned
  * to its approver, merged only once the required CI/CD checks have passed. `idea1 release` runs the
- * whole sequence here for both kinds of release into main: a planned release from the base branch,
- * whose changes were each approved on their own PR, and a hotfix release from the hotfix branch,
- * whose directly pushed commits are reviewed and approved in the release PR itself. That includes
- * the one sanctioned admin override (change-management-policy.md, "The automated gate"), recorded
- * on the PR before any merge happens. `idea1 ready-for-approval` opens a stage-1 change PR with the
- * same kind of body for a branch that has no project item (see approval-flow.ts).
+ * whole sequence here for the three kinds of release into main: a planned release from the base
+ * branch, whose changes were each approved on their own PR, a hotfix release from the hotfix branch,
+ * whose directly pushed commits are reviewed and approved in the release PR itself, and a content
+ * release from the content release branch (`release.contentRelease`), which carries no version bumps
+ * and changes only content. Once the checks pass, the Idea1 platform merges the release as the Idea1
+ * GitHub App, after recording the releaser's approval on the PR; the one sanctioned admin override
+ * (change-management-policy.md, "The automated gate") is the only merge made here, recorded on the
+ * PR before it happens. `idea1 ready-for-approval` opens a stage-1 change PR with the same kind of
+ * body for a branch that has no project item (see approval-flow.ts).
+ *
+ * Who may release is the repository's release roles: the members of the GitHub team
+ * `release.releaserTeam` release the base and hotfix branches, and the members of
+ * `release.contentRelease.releaserTeam` approve changes into the content release branch and release
+ * it. The CLI refuses anyone else before anything is committed or merged; the platform checks again.
  *
  * A release's version bumps land on the release branch before its PR is opened, so the PR's head,
  * and the one CI/CD run the release is gated on, already carry them. The packages that changed since
- * the last release are detected here, and this engine makes the bump itself: it edits each package's
- * `package.json` and the lockfiles above it in the local checkout, commits the edit as one
- * `chore: bump ...` commit, and pushes it. The repository only declares which folders are candidates
- * (`release.versionedPackages` in `.idea1/settings.json`); no script or workflow is involved.
+ * the last release are detected here, and this engine computes the bump from the local checkout: the
+ * new `version` of each package's `package.json` and of the lockfiles above it. The platform commits
+ * it onto the release branch as one `chore: bump ...` commit as the Idea1 GitHub App, accepting
+ * only those version edits, since a releaser need not be able to push to the release branch. The
+ * repository only declares which folders are candidates (`release.versionedPackages` in
+ * `.idea1/settings.json`); no script or workflow is involved.
  *
  * The platform's `ReleaseEngine` (backend-core/applicationlayer/workflow) runs the same release
  * sequence from the web app and writes the same PR and the same bump commit, by making the same edits
- * to the same files and committing them through the GitHub API instead of a local checkout, so a
- * release cut on either side reads the same. Both refuse a release the same way: when the releaser
+ * to the same files through the GitHub API, so a release cut on either side reads the same. Both
+ * refuse a release the same way: when the releaser
  * lacks the access a release needs (here the person running the command, there the GitHub App),
  * and when an open PR from the release branch into its target does not follow the release workflow;
  * and both refuse a planned release that carries a direct push, which only the CLI can release, once
@@ -27,6 +38,13 @@ import type { CommandOption, VersionedPackage } from '../../types/index.js';
  * `direct-allowed` in `.idea1/settings.json` accepts changes made directly on its release branch
  * instead: neither engine refuses such a release, and its PR lists the direct commits for its
  * assignee to review. Keep the two in step.
+ *
+ * A release PR lists every change it contains, including those that land on its branch after it is
+ * opened: the approval chain is a delimited section of the body, and before anything merges the PR
+ * the section is re-rendered from the branch as it stands, leaving the rest of the body as it is.
+ * Both engines render the same section for the same branch, and the platform also re-renders it on
+ * every push to the branch. A merge whose re-render fails goes ahead only when the branch has not
+ * moved since the section was rendered.
  */
 /** Which command opened the PR; shapes the PR body and the override record. */
 export interface GatedPrKind {
@@ -49,13 +67,15 @@ export interface GatedPrKind {
 }
 export declare const RELEASE_KIND: GatedPrKind;
 export declare const HOTFIX_RELEASE_KIND: GatedPrKind;
+export declare const CONTENT_RELEASE_KIND: GatedPrKind;
 export declare const CHANGE_KIND: GatedPrKind;
 export type PrMode = 'create' | 'merge';
 /**
  * The `--pr-mode` option of `idea1 release`. `create` is the default: the PR is opened and the
  * approver merges it in GitHub once the required checks are green - that merge is the approval of
- * record, exactly as in `merge` mode, where the CLI turns on GitHub's auto-merge on the approver's
- * behalf (or, where GitHub can't auto-merge, waits for the checks and merges here).
+ * record. In `merge` mode the CLI waits for the checks and has the Idea1 platform merge the PR as
+ * the approver's recorded approval, exactly as `idea1 release --approve` does. A content release is
+ * always merged the second way.
  */
 export declare const PR_MODE_OPTION: CommandOption;
 /** The first line of the comment that records an admin override; the evidence script keys on it. */
@@ -112,9 +132,11 @@ export interface CommitVersionBumpsOptions {
     bumps: Record<string, VersionBumpType>;
 }
 /**
- * Bump the versions of the pending packages in one commit on the release branch and push it, so
- * the release PR opens against a branch that already carries them. The commit is `chore: bump
- * <package> <version>, ...` and is made as whoever runs the command.
+ * Bump the versions of the pending packages in one commit on the release branch, so the release PR
+ * opens against a branch that already carries them. The bump is computed from the checkout, which is
+ * level with origin, and the Idea1 platform commits it onto the branch as the Idea1 GitHub App -
+ * `chore: bump <package> <version>, ...`, naming the releaser - only while the branch is still at the
+ * checkout's tip. The checkout is then fast-forwarded to the bump.
  */
 export declare function commitVersionBumps(options: CommitVersionBumpsOptions): Promise<void>;
 interface BranchCommit {
@@ -137,15 +159,19 @@ export interface ApprovalChain {
     directPushRecord: DirectPushRecord | null;
 }
 /**
- * The PR body, written as the approval record for everything the PR carries.
- *
- * SOC2 change management asks who approved a change and when. Each change on the source branch
- * was already approved by its assignee, who merged its PR into that branch. Listing those merges
- * here makes this PR self-contained evidence: the whole chain is readable from the one PR an
- * auditor lands on. Commits are attributed to PRs through GitHub's own association, so squash and
- * rebase merges are covered, and a commit with no PR is shown rather than silently dropped.
+ * The body of a new gated PR, written as the approval record for everything the PR carries: its
+ * opening line, then the approval chain section. A direct push it carries with no recorded reason
+ * is refused unless a repository admin records why; that record is returned for posting on the PR.
  */
 export declare function buildApprovalChain(sourceBranch: string, targetBranch: string, kind: GatedPrKind): Promise<ApprovalChain>;
+/**
+ * Re-render the approval chain section of an open gated PR from the source branch as it stands on
+ * origin now, and write it to the PR when it differs; the rest of the body stays as it is. Returns
+ * whether the body changed. The direct pushes already recorded on the PR stay accounted for; one
+ * that landed with no recorded reason is resolved as when the PR was opened - a repository admin
+ * records why, on the PR - or refused.
+ */
+export declare function refreshApprovalChain(pr: github.OpenPr, sourceBranch: string, targetBranch: string, kind: GatedPrKind): Promise<boolean>;
 export interface CreateGatedPrOptions {
     sourceBranch: string;
     targetBranch: string;
@@ -159,40 +185,40 @@ export interface CreateGatedPrOptions {
  */
 export declare function createGatedPr(options: CreateGatedPrOptions): Promise<string>;
 /**
- * The PR's assignee is its approver of record, and GitHub records whoever merges as `merged_by`.
- * The two must be the same person for the record to name the right approver: no assignee means
- * no approver, and a different merger is an exception the evidence report calls out - so it
- * takes an explicit, eyes-open confirmation.
+ * The signed-in Idea1 user's linked GitHub login: the identity the platform records an approval
+ * under, checks against a PR's assignees and checks a release role for.
  */
-export declare function confirmApproverIdentity(branchName: string): Promise<void>;
+export declare function signedInGitHubLogin(): Promise<string>;
 /**
- * Merge the PR once the required checks pass. Checks that fail, never start or never finish stop
- * the merge; a repository with no CI/CD configured has nothing to wait for and merges straight
- * away. The one sanctioned admin override remains: it needs an explicit confirmation, a stated
- * reason, and the exception must be recorded as a comment on the PR *before* the merge - if the
- * comment cannot be posted, nothing is merged.
+ * Refuse `login` a release role they lack: only the members of `team`, a GitHub team of the
+ * repository's organization named by `setting` in `.idea1/settings.json`, may `action`. A repository
+ * that names no team for the role leaves it to anyone the release workflow admits. The platform
+ * checks the same role again before it merges or commits anything.
  */
-export declare function mergeWithCheckGate(branchName: string, kind: GatedPrKind): Promise<void>;
-/** What `enableAutoMergeOrPoll` left the PR as. */
-export type AutoMergeOutcome = 'auto-merge-enabled' | 'merged';
+export declare function requireReleaseRole(team: string | null, setting: string, login: string, action: string): Promise<void>;
 /**
- * Merge the PR the way that records the person running this as `merged_by`, without them having to
- * wait: GitHub's auto-merge, which merges once the required checks pass. Where GitHub can't
- * auto-merge (the PR is already mergeable, or the repository doesn't allow auto-merge), it falls
- * back to waiting for the checks here and merging (`mergeWithCheckGate`, with its admin-override
- * path). Any other refusal throws.
+ * Refuse a release by anyone outside the release role for its kind: `release.releaserTeam` for a
+ * planned or hotfix release, `release.contentRelease.releaserTeam` for a content release. Returns
+ * the releaser's linked GitHub login.
  */
-export declare function enableAutoMergeOrPoll(branchName: string, kind: GatedPrKind): Promise<AutoMergeOutcome>;
+export declare function requireReleaser(kind: GatedPrKind, sourceBranch: string): Promise<string>;
+/**
+ * Merge the release PR once the required checks pass: the Idea1 platform records the releaser's
+ * approval on the PR and merges it as the Idea1 GitHub App, after the PR's change list is brought up
+ * to date with what landed on the branch while the checks ran. Checks that fail, never start or
+ * never finish stop the merge; a repository with no CI/CD configured has nothing to wait for. The one
+ * sanctioned admin override remains, merged here as the admin: it needs an explicit confirmation, a
+ * stated reason, and the exception must be recorded as a comment on the PR *before* the merge - if
+ * the comment cannot be posted, nothing is merged.
+ */
+export declare function mergeWithCheckGate(branchName: string, targetBranch: string, kind: GatedPrKind): Promise<void>;
 export interface RunPrModeOptions {
     mode: PrMode;
     sourceBranch: string;
     targetBranch: string;
     prUrl: string;
     kind: GatedPrKind;
-    /**
-     * Open the Actions page after a merge made here - the merge to main triggers the production
-     * deploy. An auto-merge GitHub performs later opens nothing.
-     */
+    /** Open the Actions page once the release has merged - the merge to main triggers the production deploy. */
     openActionsAfterMerge: boolean;
     /** The approver already said to merge (`--yes`), so the merge is not confirmed again. */
     confirmed: boolean;
@@ -200,9 +226,9 @@ export interface RunPrModeOptions {
 /**
  * Finish the sequence in the chosen mode. Either way the merge is the approval of record: in
  * `create` mode the approver performs it in GitHub once the checks are green; in `merge` mode the
- * CLI turns on GitHub's auto-merge as the approver, so GitHub merges once the checks pass and
- * records the approver as the merger - or, where GitHub can't auto-merge, waits for the checks and
- * merges here.
+ * CLI waits for the checks and the Idea1 platform merges it as the approver's recorded approval. A
+ * content release is merged only the second way, since its releaser cannot merge into the release
+ * target in GitHub, so `create` mode leaves it for `idea1 release --approve`.
  */
 export declare function runPrMode(options: RunPrModeOptions): Promise<void>;
 /**
@@ -213,12 +239,14 @@ export declare function runPrMode(options: RunPrModeOptions): Promise<void>;
  */
 export declare function ensureReleasable(sourceBranch: string, targetBranch: string): Promise<void>;
 /**
- * `idea1 release --approve`: approve and merge the open release PR from the source branch into the
- * target, as its approver. Only a PR that follows the release workflow is approved, and only by one
- * of its assignees, its approvers of record, exactly as the Idea1 web app approves it. With every
- * check passed it merges now; with checks still running it turns on auto-merge (or waits and merges
- * where GitHub can't auto-merge); with a failed check it goes to the gate's admin-override path,
- * which refuses unless the override is confirmed, reasoned and recorded.
+ * `idea1 release --approve`: approve the open release PR from the source branch into the target, as
+ * its approver, and have the Idea1 platform merge it. Only a PR that follows the release workflow is
+ * approved, and only by one of its assignees, its approvers of record, who holds the release role for
+ * its kind of release - the platform checks both again. The CLI waits for the required checks, and
+ * the platform records the approval on the PR and merges it as the Idea1 GitHub App; with a failed
+ * check it goes to the gate's admin-override path, which refuses unless the override is confirmed,
+ * reasoned and recorded. Before any of that, the PR's change list is brought up to date with what
+ * landed on the branch since it was opened.
  */
 export declare function approveRelease(sourceBranch: string, targetBranch: string, kind: GatedPrKind): Promise<void>;
 export {};

package/dist/workflow/engine/release-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-engine.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/release-engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAQ5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,YAAY,EAAE,WAM1B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,WAMjC,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,WAMzB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,aAU5B,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,uBAAuB,iEAAiE,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,iEAAiE,CAAC;AAE3G;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,+DAA+D,CAAC;AAE5G;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,8DAA8D,CAAC;AAQ1G;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9E;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAgC,CAAC;AAK1F,4FAA4F;AAC5F,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,cAAc,EAAE,MAAM,CAAC;CACxB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwB/B;AA0HD,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB1F;AAED,UAAU,YAAY;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAmDD,uHAAuH;AACvH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AA4GD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAsJxB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlF;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B/E;AAsBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC7F;AAED,mDAAmD;AACnD,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,QAAQ,CAAC;AAS/D;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAe5G;AA+BD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BxE;AAiED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDjH"}
+{"version":3,"file":"release-engine.d.ts","sourceRoot":"","sources":["../../../src/workflow/engine/release-engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAM5E,OAAO,KAAK,MAAM,MAAM,0BAA0B,CAAC;AAGnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,YAAY,EAAE,WAM1B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,WAMjC,CAAC;AACF,eAAO,MAAM,oBAAoB,EAAE,WAMlC,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,WAMzB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,aAU5B,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,uBAAuB,iEAAiE,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,iEAAiE,CAAC;AAE3G;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,+DAA+D,CAAC;AAE5G;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,8DAA8D,CAAC;AAoB1G;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9E;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAgC,CAAC;AAE1F,4FAA4F;AAC5F,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,cAAc,EAAE,MAAM,CAAC;CACxB;AAiBD;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwB/B;AAqHD,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB1F;AAED,UAAU,YAAY;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAmDD,uHAAuH;AACvH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAoVD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAqBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAe7I;AAwCD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlF;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAO3D;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3H;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9F;AAsBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCnH;AA+BD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,4GAA4G;IAC5G,qBAAqB,EAAE,OAAO,CAAC;IAC/B,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxE;AAkDD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhG;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCjH"}