@telora/daemon 0.20.54 → 0.20.57

package/dist/resolver-reach.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Resolver reach is BOUNDED up front, and its out-of-worktree actions are ON
+ * THE RECORD. The negative branch of the resolver-dispatch seam
+ * (resolver-dispatch.ts).
+ *
+ * The resolver only closes anything if it holds reach the sandboxed worktree
+ * agent lacks (spawn-sandbox.ts documents that asymmetry: a git worktree bounds
+ * the branch but NOT the OS -- credentials to other machines, sibling repos, the
+ * operator's home are all reachable). That same reach, granted without a
+ * declared bound, is unattended credentialed action on hosts with nothing
+ * reviewing what it did: a resolver's host actions produce no diff and pass no
+ * review gate, unlike code changes. Today's paste-into-Claude-Code workaround at
+ * least happens with a human watching; removing the human removes that too.
+ *
+ * Two invariants, both provable without a live host:
+ *
+ *  1. REACH IS DECLARED IN ADVANCE, PER BLOCKAGE CLASS, and FAIL-CLOSED. A
+ *     resolver acts only within a bound declared before it runs ("this class may
+ *     restart a container on host H"); an action outside that bound is REFUSED,
+ *     not permitted-and-logged. An unrecognized or undeclared blockage class
+ *     yields NO reach -- never a default to broad reach. This follows the
+ *     spawn-sandbox.ts shape: explicit, fail-closed, declared rather than
+ *     ambient. Reach is a property of the declared grant, never inferred from
+ *     what an attempt happened to touch (a reach granted by outcome is not a
+ *     bound).
+ *
+ *  2. EVERY OUT-OF-WORKTREE ACTION IS RECORDED, durably and credential-free, on
+ *     the success, failure, AND throwing paths -- a failed unattended action is
+ *     exactly the one that must not vanish. The record identifies the blockage,
+ *     the action attempted, and its outcome. The sink is injectable (tests
+ *     capture records without a live host); the default writes a structured line
+ *     to the canonical daemon log, which is durable and human-reviewable.
+ *
+ * This module is NOT a second resolver and does not re-open the dispatch design.
+ * It supplies the reach `bound` that feeds `BlockageResolver.reach` and wraps a
+ * single host action so it is authorized against the bound and recorded --
+ * composing with dispatchBlockage, not rewriting it.
+ *
+ * @module resolver-reach
+ */
+/**
+ * A blockage class -- the unit at which reach is declared in advance. Stable,
+ * coarse identifiers (e.g. 'dirty_worktree', 'restart_container'), NOT
+ * per-incident strings: the grant is authored against the class, so the class
+ * must be knowable before any specific blockage occurs.
+ */
+export type BlockageClass = string;
+/**
+ * One host action a resolver may attempt OUTSIDE the worktree. `kind` and
+ * `target` are what the bound is checked against; `summary` is the
+ * human-readable line that lands in the record.
+ */
+export interface ResolverAction {
+    /** The blockage class this action serves (checked against its grant). */
+    blockageClass: BlockageClass;
+    /** Stable action-kind id (e.g. 'restart_container'), matched against the grant. */
+    kind: string;
+    /** The host/resource the action touches (e.g. 'host-H'), matched against the grant. */
+    target: string;
+    /** Human-readable description of what will be attempted. Author-controlled; never carry credentials here. */
+    summary: string;
+}
+/**
+ * A DECLARED grant: exactly what a blockage class is permitted to do, authored
+ * in advance. An action is authorized only if BOTH its kind and its target are
+ * listed. An empty `allowedActionKinds` or `allowedTargets` therefore grants no
+ * reach at all -- the fail-closed floor.
+ */
+export interface ReachGrant {
+    blockageClass: BlockageClass;
+    /** Action kinds this class may attempt. Empty => no reach. */
+    allowedActionKinds: readonly string[];
+    /** Targets (hosts/resources) this class may touch. Empty => no reach. */
+    allowedTargets: readonly string[];
+}
+/** The declared grants, keyed by blockage class. Injectable so tests supply their own. */
+export type ReachRegistry = ReadonlyMap<BlockageClass, ReachGrant>;
+/** The resolved reach bound for one blockage class. */
+export interface ReachBound {
+    blockageClass: BlockageClass;
+    /** True only when a grant is declared for this class with non-empty allowed kinds AND targets. */
+    reach: boolean;
+    /** The declared grant when reach is real; null when the class is undeclared or empty. */
+    grant: ReachGrant | null;
+}
+/** The decision of authorizing one action against a bound. */
+export type ReachDecision = {
+    authorized: true;
+} | {
+    authorized: false;
+    reason: string;
+};
+/**
+ * Resolve a blockage class to its declared reach bound. FAIL-CLOSED: an
+ * unrecognized/undeclared class -- or a declared grant that permits no kind or
+ * no target -- yields `reach: false` and `grant: null`. There is no path that
+ * defaults an unknown class to broad reach.
+ */
+export declare function resolveReachBound(blockageClass: BlockageClass, registry: ReachRegistry): ReachBound;
+/**
+ * Authorize a single action against a resolved bound. REFUSES (does not
+ * permit-and-log) when the bound has no reach, the action serves a different
+ * class than the bound, or the action's kind/target is outside the declared
+ * grant. A refusal means the action must NOT run.
+ */
+export declare function authorizeAction(bound: ReachBound, action: ResolverAction): ReachDecision;
+/** The terminal outcome of one recorded resolver action. */
+export type ResolverActionOutcome = 'success' | 'failure' | 'refused';
+/**
+ * A durable record of one out-of-worktree resolver action. Carries NO
+ * credential material by construction: only the blockage class, the action's
+ * kind/target/summary, the outcome, and a REDACTED free-text detail.
+ */
+export interface ResolverActionRecord {
+    blockageClass: BlockageClass;
+    action: {
+        kind: string;
+        target: string;
+        summary: string;
+    };
+    outcome: ResolverActionOutcome;
+    /** Redacted free-text detail (failure reason / refusal reason). Never raw secrets. */
+    detail?: string;
+    /** ISO timestamp the record was written. */
+    recordedAt: string;
+}
+/**
+ * The injectable record sink. Called on EVERY path -- success, failure,
+ * refusal, and throw. Tests supply a capturing sink; the default writes to the
+ * canonical daemon log. May be async; the runner awaits it.
+ */
+export type ResolverActionRecorder = (record: ResolverActionRecord) => void | Promise<void>;
+/**
+ * The default production recorder: a structured line in the canonical daemon
+ * log (~/.telora/daemon.log) -- durable, rotated, and human-reviewable after
+ * the fact, which is precisely what a diff-less host action otherwise lacks.
+ * The record's `detail` is already redacted before it arrives here, so this
+ * sink cannot leak credentials.
+ */
+export declare const logResolverAction: ResolverActionRecorder;
+/**
+ * Redact credential-shaped material from free-text before it enters a record.
+ * A record a human reviews must never itself become a credential leak, so this
+ * scrubs bearer/authorization values, `key=value` pairs whose key names a
+ * secret, and long opaque token blobs. Conservative and lossy on purpose --
+ * over-redaction is safe; under-redaction is the failure.
+ */
+export declare function redactResolverDetail(text: string): string;
+/** What a bounded action's `execute` reports back. */
+export interface ResolverExecuteResult {
+    /** True when the host action succeeded. */
+    ok: boolean;
+    /** Free-text detail (never pre-redacted -- the runner redacts it). */
+    detail?: string;
+}
+/** The terminal outcome of {@link runReachBoundedAction}. */
+export type ReachBoundedOutcome = {
+    outcome: 'success';
+} | {
+    outcome: 'failure';
+    detail?: string;
+} | {
+    outcome: 'refused';
+    reason: string;
+};
+/** Collaborators for {@link runReachBoundedAction}; all injectable for tests. */
+export interface ReachBoundedDeps {
+    /** The declared grants. Reach is resolved from here BEFORE the action runs. */
+    registry: ReachRegistry;
+    /** The record sink, called on every path. Defaults to {@link logResolverAction}. */
+    record?: ResolverActionRecorder;
+    /** Detail redactor. Defaults to {@link redactResolverDetail}. */
+    redact?: (text: string) => string;
+    /** Clock for `recordedAt`. Defaults to ISO-now. */
+    clock?: () => string;
+}
+/**
+ * Run one out-of-worktree resolver action within its declared bound, recording
+ * every path.
+ *
+ * Guarantees, all provable without a live host:
+ *  - The action is AUTHORIZED against the pre-declared bound FIRST. An action
+ *    outside the bound (or under an undeclared class) is REFUSED -- `execute` is
+ *    never called -- and the refusal is recorded.
+ *  - On execution, `success` or `failure` is recorded from the result.
+ *  - If `execute` THROWS, a `failure` record is written (via catch) BEFORE the
+ *    error propagates -- the failed unattended action never vanishes.
+ *  - The recorded `detail` is always redacted, so no credential material enters
+ *    the record regardless of the sink.
+ */
+export declare function runReachBoundedAction(deps: ReachBoundedDeps, action: ResolverAction, execute: () => Promise<ResolverExecuteResult>): Promise<ReachBoundedOutcome>;
+//# sourceMappingURL=resolver-reach.d.ts.map

package/dist/resolver-reach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-reach.d.ts","sourceRoot":"","sources":["../src/resolver-reach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,aAAa,EAAE,aAAa,CAAC;IAC7B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,8DAA8D;IAC9D,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,0FAA0F;AAC1F,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAEnE,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,kGAAkG;IAClG,KAAK,EAAE,OAAO,CAAC;IACf,yFAAyF;IACzF,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GACrB;IAAE,UAAU,EAAE,IAAI,CAAA;CAAE,GACpB;IAAE,UAAU,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAOnG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,aAAa,CAiBxF;AAED,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,sBAU/B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,EAAE,aAAa,CAAC;IACxB,oFAAoF;IACpF,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAwC9B"}

package/dist/resolver-reach.js

@@ -0,0 +1,168 @@
+/**
+ * Resolver reach is BOUNDED up front, and its out-of-worktree actions are ON
+ * THE RECORD. The negative branch of the resolver-dispatch seam
+ * (resolver-dispatch.ts).
+ *
+ * The resolver only closes anything if it holds reach the sandboxed worktree
+ * agent lacks (spawn-sandbox.ts documents that asymmetry: a git worktree bounds
+ * the branch but NOT the OS -- credentials to other machines, sibling repos, the
+ * operator's home are all reachable). That same reach, granted without a
+ * declared bound, is unattended credentialed action on hosts with nothing
+ * reviewing what it did: a resolver's host actions produce no diff and pass no
+ * review gate, unlike code changes. Today's paste-into-Claude-Code workaround at
+ * least happens with a human watching; removing the human removes that too.
+ *
+ * Two invariants, both provable without a live host:
+ *
+ *  1. REACH IS DECLARED IN ADVANCE, PER BLOCKAGE CLASS, and FAIL-CLOSED. A
+ *     resolver acts only within a bound declared before it runs ("this class may
+ *     restart a container on host H"); an action outside that bound is REFUSED,
+ *     not permitted-and-logged. An unrecognized or undeclared blockage class
+ *     yields NO reach -- never a default to broad reach. This follows the
+ *     spawn-sandbox.ts shape: explicit, fail-closed, declared rather than
+ *     ambient. Reach is a property of the declared grant, never inferred from
+ *     what an attempt happened to touch (a reach granted by outcome is not a
+ *     bound).
+ *
+ *  2. EVERY OUT-OF-WORKTREE ACTION IS RECORDED, durably and credential-free, on
+ *     the success, failure, AND throwing paths -- a failed unattended action is
+ *     exactly the one that must not vanish. The record identifies the blockage,
+ *     the action attempted, and its outcome. The sink is injectable (tests
+ *     capture records without a live host); the default writes a structured line
+ *     to the canonical daemon log, which is durable and human-reviewable.
+ *
+ * This module is NOT a second resolver and does not re-open the dispatch design.
+ * It supplies the reach `bound` that feeds `BlockageResolver.reach` and wraps a
+ * single host action so it is authorized against the bound and recorded --
+ * composing with dispatchBlockage, not rewriting it.
+ *
+ * @module resolver-reach
+ */
+import { createLogger } from './log.js';
+const log = createLogger({ module: 'resolver-reach' });
+/**
+ * Resolve a blockage class to its declared reach bound. FAIL-CLOSED: an
+ * unrecognized/undeclared class -- or a declared grant that permits no kind or
+ * no target -- yields `reach: false` and `grant: null`. There is no path that
+ * defaults an unknown class to broad reach.
+ */
+export function resolveReachBound(blockageClass, registry) {
+    const grant = registry.get(blockageClass) ?? null;
+    const reach = grant !== null &&
+        grant.allowedActionKinds.length > 0 &&
+        grant.allowedTargets.length > 0;
+    return { blockageClass, reach, grant: reach ? grant : null };
+}
+/**
+ * Authorize a single action against a resolved bound. REFUSES (does not
+ * permit-and-log) when the bound has no reach, the action serves a different
+ * class than the bound, or the action's kind/target is outside the declared
+ * grant. A refusal means the action must NOT run.
+ */
+export function authorizeAction(bound, action) {
+    if (!bound.reach || bound.grant === null) {
+        return { authorized: false, reason: `no declared reach for blockage class "${action.blockageClass}"` };
+    }
+    if (action.blockageClass !== bound.blockageClass) {
+        return {
+            authorized: false,
+            reason: `action serves class "${action.blockageClass}" but bound is for "${bound.blockageClass}"`,
+        };
+    }
+    if (!bound.grant.allowedActionKinds.includes(action.kind)) {
+        return { authorized: false, reason: `action kind "${action.kind}" is outside the declared bound for "${bound.blockageClass}"` };
+    }
+    if (!bound.grant.allowedTargets.includes(action.target)) {
+        return { authorized: false, reason: `target "${action.target}" is outside the declared bound for "${bound.blockageClass}"` };
+    }
+    return { authorized: true };
+}
+/**
+ * The default production recorder: a structured line in the canonical daemon
+ * log (~/.telora/daemon.log) -- durable, rotated, and human-reviewable after
+ * the fact, which is precisely what a diff-less host action otherwise lacks.
+ * The record's `detail` is already redacted before it arrives here, so this
+ * sink cannot leak credentials.
+ */
+export const logResolverAction = (record) => {
+    log.info('resolver action recorded', {
+        blockageClass: record.blockageClass,
+        actionKind: record.action.kind,
+        target: record.action.target,
+        summary: record.action.summary,
+        outcome: record.outcome,
+        ...(record.detail !== undefined ? { detail: record.detail } : {}),
+        recordedAt: record.recordedAt,
+    });
+};
+/**
+ * Redact credential-shaped material from free-text before it enters a record.
+ * A record a human reviews must never itself become a credential leak, so this
+ * scrubs bearer/authorization values, `key=value` pairs whose key names a
+ * secret, and long opaque token blobs. Conservative and lossy on purpose --
+ * over-redaction is safe; under-redaction is the failure.
+ */
+export function redactResolverDetail(text) {
+    return text
+        // Authorization: Bearer <token> / bearer <token>
+        .replace(/\b(bearer)\s+[A-Za-z0-9._\-+/=]+/gi, '$1 [REDACTED]')
+        // key=value / key: value where the key names a secret
+        .replace(/\b(authorization|api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret)\b(\s*[:=]\s*)("?)[^\s"']+\3/gi, '$1$2[REDACTED]')
+        // Long opaque token blobs (>=24 chars of token alphabet) not otherwise caught.
+        .replace(/\b[A-Za-z0-9._\-+/=]{24,}\b/g, '[REDACTED]');
+}
+/**
+ * Run one out-of-worktree resolver action within its declared bound, recording
+ * every path.
+ *
+ * Guarantees, all provable without a live host:
+ *  - The action is AUTHORIZED against the pre-declared bound FIRST. An action
+ *    outside the bound (or under an undeclared class) is REFUSED -- `execute` is
+ *    never called -- and the refusal is recorded.
+ *  - On execution, `success` or `failure` is recorded from the result.
+ *  - If `execute` THROWS, a `failure` record is written (via catch) BEFORE the
+ *    error propagates -- the failed unattended action never vanishes.
+ *  - The recorded `detail` is always redacted, so no credential material enters
+ *    the record regardless of the sink.
+ */
+export async function runReachBoundedAction(deps, action, execute) {
+    const record = deps.record ?? logResolverAction;
+    const redact = deps.redact ?? redactResolverDetail;
+    const clock = deps.clock ?? (() => new Date().toISOString());
+    const write = async (outcome, detail) => {
+        const entry = {
+            blockageClass: action.blockageClass,
+            action: { kind: action.kind, target: action.target, summary: action.summary },
+            outcome,
+            recordedAt: clock(),
+        };
+        if (detail !== undefined)
+            entry.detail = redact(detail);
+        await record(entry);
+    };
+    const bound = resolveReachBound(action.blockageClass, deps.registry);
+    const decision = authorizeAction(bound, action);
+    if (!decision.authorized) {
+        // Refused: the action is NOT executed. Record the refusal for the audit trail.
+        await write('refused', decision.reason);
+        return { outcome: 'refused', reason: decision.reason };
+    }
+    try {
+        const result = await execute();
+        if (result.ok) {
+            await write('success', result.detail);
+            return { outcome: 'success' };
+        }
+        await write('failure', result.detail);
+        return result.detail !== undefined
+            ? { outcome: 'failure', detail: redact(result.detail) }
+            : { outcome: 'failure' };
+    }
+    catch (err) {
+        // A throwing action is exactly the one whose record must not vanish.
+        const message = err instanceof Error ? err.message : String(err);
+        await write('failure', message);
+        throw err;
+    }
+}
+//# sourceMappingURL=resolver-reach.js.map

package/dist/resolver-reach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-reach.js","sourceRoot":"","sources":["../src/resolver-reach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAyDvD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAA4B,EAAE,QAAuB;IACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IAClD,MAAM,KAAK,GACT,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,MAAsB;IACvE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,wBAAwB,MAAM,CAAC,aAAa,uBAAuB,KAAK,CAAC,aAAa,GAAG;SAClG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,MAAM,CAAC,IAAI,wCAAwC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC,MAAM,wCAAwC,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC;IAC/H,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B,CAAC,MAAM,EAAE,EAAE;IAClE,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI;QACT,iDAAiD;SAChD,OAAO,CAAC,oCAAoC,EAAE,eAAe,CAAC;QAC/D,sDAAsD;SACrD,OAAO,CACN,2IAA2I,EAC3I,gBAAgB,CACjB;QACD,+EAA+E;SAC9E,OAAO,CAAC,8BAA8B,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AA4BD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAsB,EACtB,MAAsB,EACtB,OAA6C;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAG,KAAK,EAAE,OAA8B,EAAE,MAAe,EAAiB,EAAE;QACrF,MAAM,KAAK,GAAyB;YAClC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAC7E,OAAO;YACP,UAAU,EAAE,KAAK,EAAE;SACpB,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,+EAA+E;QAC/E,MAAM,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/resolvers/git-diff-against-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-diff-against-base.d.ts","sourceRoot":"","sources":["../../src/resolvers/git-diff-against-base.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,oGAAoG;AACpG,wBAAgB,kCAAkC,IAAI,IAAI,CAqCzD"}
+{"version":3,"file":"git-diff-against-base.d.ts","sourceRoot":"","sources":["../../src/resolvers/git-diff-against-base.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,oGAAoG;AACpG,wBAAgB,kCAAkC,IAAI,IAAI,CA2CzD"}

package/dist/resolvers/git-diff-against-base.js

@@ -1,5 +1,5 @@
 import { registerSourceResolver } from '../assembly-engine.js';
-import { getGitDiff, getDiffStatSummary, MAX_DIFF_BYTES } from './shared/git-diff.js';
+import { getGitDiff, getDeliveryDiff, getDiffStatSummary, MAX_DIFF_BYTES } from './shared/git-diff.js';
 import { createLogger } from '../log.js';
 const log = createLogger({ module: 'assembly-engine' });
 /**
@@ -19,7 +19,13 @@ export function registerGitDiffAgainstBaseResolver() {
         // (reviewed_through_sha) so a resumed reviewer sees only watermark..tip;
         // every other caller diffs against the integration branch.
         const baseBranch = context.diffBaseOverride ?? context.config.integrationBranch;
-        const diff = getGitDiff(context.worktreePath, baseBranch);
+        // For the watermark-override case the range is always ahead by construction,
+        // so a plain base...HEAD diff is correct. For the default integration base,
+        // use the delivery-diff resolver so a focus branch that has ALREADY merged
+        // (level with integration) still yields its work rather than an empty diff.
+        const diff = context.diffBaseOverride
+            ? getGitDiff(context.worktreePath, baseBranch)
+            : getDeliveryDiff(context.worktreePath, baseBranch);
         if (!diff.trim())
             return '';
         if (diff.length > MAX_DIFF_BYTES) {

package/dist/resolvers/git-diff-against-base.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-diff-against-base.js","sourceRoot":"","sources":["../../src/resolvers/git-diff-against-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAGxD;;;;;GAKG;AACH,oGAAoG;AACpG,MAAM,UAAU,kCAAkC;IAChD,sBAAsB,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAwB,EAAmB,EAAE;QAClG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAChF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE1D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE5B,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YAChD,OAAO;gBACL,wBAAwB,UAAU,GAAG;gBACrC,EAAE;gBACF,8BAA8B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,KAAK;gBACvH,EAAE;gBACF,kBAAkB;gBAClB,EAAE;gBACF,KAAK;gBACL,IAAI,CAAC,IAAI,EAAE;gBACX,KAAK;gBACL,EAAE;gBACF,SAAS;gBACT,SAAS;gBACT,KAAK;aACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAED,OAAO,wBAAwB,UAAU,oBAAoB,IAAI,UAAU,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"git-diff-against-base.js","sourceRoot":"","sources":["../../src/resolvers/git-diff-against-base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAGxD;;;;;GAKG;AACH,oGAAoG;AACpG,MAAM,UAAU,kCAAkC;IAChD,sBAAsB,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAwB,EAAmB,EAAE;QAClG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAChF,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB;YACnC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAEtD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE5B,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YAChD,OAAO;gBACL,wBAAwB,UAAU,GAAG;gBACrC,EAAE;gBACF,8BAA8B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,KAAK;gBACvH,EAAE;gBACF,kBAAkB;gBAClB,EAAE;gBACF,KAAK;gBACL,IAAI,CAAC,IAAI,EAAE;gBACX,KAAK;gBACL,EAAE;gBACF,SAAS;gBACT,SAAS;gBACT,KAAK;aACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;QAED,OAAO,wBAAwB,UAAU,oBAAoB,IAAI,UAAU,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/resolvers/index.d.ts

@@ -28,7 +28,7 @@
  * (FocusEngine.init) can list them in the startup log.
  */
 export declare function initResolvers(): string[];
-export { MAX_DIFF_BYTES, getGitDiff, getDiffStatSummary, getChangedFiles, getCommitsAhead } from './shared/git-diff.js';
+export { MAX_DIFF_BYTES, getGitDiff, getDiffStatSummary, getChangedFiles, getCommitsAhead, getGitDiffRange, getDiffStatRange, getChangedFilesRange, findDeliveryMergeCommit, resolveDeliveryDiffRange, getDeliveryDiff, } from './shared/git-diff.js';
 export { CRT_DUMP_BUDGET_CHARS, renderRealityTreeDump, FOCUS_REALITY_TREE_EMPTY_STATE, } from './shared/reality-tree.js';
 export type { RealityTreeRow, RealityTreeListResponse, RealityNodeRow, RealityEdgeRow, NodeListResponse, EdgeListResponse, } from './shared/reality-tree.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/resolvers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyFH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAgBxC;AAGD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyFH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAgBxC;AAGD,OAAO,EACL,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC"}

package/dist/resolvers/index.js

@@ -125,6 +125,6 @@ export function initResolvers() {
     return keys;
 }
 // ── Shared public surface (re-exports for external consumers) ─────────
-export { MAX_DIFF_BYTES, getGitDiff, getDiffStatSummary, getChangedFiles, getCommitsAhead } from './shared/git-diff.js';
+export { MAX_DIFF_BYTES, getGitDiff, getDiffStatSummary, getChangedFiles, getCommitsAhead, getGitDiffRange, getDiffStatRange, getChangedFilesRange, findDeliveryMergeCommit, resolveDeliveryDiffRange, getDeliveryDiff, } from './shared/git-diff.js';
 export { CRT_DUMP_BUDGET_CHARS, renderRealityTreeDump, FOCUS_REALITY_TREE_EMPTY_STATE, } from './shared/reality-tree.js';
 //# sourceMappingURL=index.js.map

package/dist/resolvers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,0CAA0C,EAAE,MAAM,mCAAmC,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,uCAAuC,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oCAAoC,EAAE,MAAM,6BAA6B,CAAC;AAEnF,yEAAyE;AAEzE,yEAAyE;AACzE,MAAM,kBAAkB,GAA8B;IACpD,0CAA0C;IAC1C,mCAAmC;IACnC,8BAA8B;IAC9B,4BAA4B;IAC5B,qCAAqC;IACrC,gCAAgC;IAChC,0BAA0B;IAC1B,yBAAyB;IACzB,kCAAkC;IAClC,uCAAuC;IACvC,8BAA8B;IAC9B,iCAAiC;IACjC,+BAA+B;IAC/B,+BAA+B;IAC/B,8BAA8B;IAC9B,uCAAuC;IACvC,wCAAwC;IACxC,8BAA8B;IAC9B,kCAAkC;IAClC,6BAA6B;IAC7B,6BAA6B;IAC7B,2BAA2B;IAC3B,2BAA2B;IAC3B,mCAAmC;IACnC,gCAAgC;IAChC,6BAA6B;IAC7B,gCAAgC;IAChC,mCAAmC;IACnC,gCAAgC;IAChC,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;IACrC,gCAAgC;IAChC,iCAAiC;IACjC,mCAAmC;IACnC,0BAA0B;IAC1B,0BAA0B;IAC1B,oCAAoC;CACrC,CAAC;AAEF,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,2EAA2E;YAC3E,mEAAmE;YACnE,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACxH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,0CAA0C,EAAE,MAAM,mCAAmC,CAAC;AAC/F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,uCAAuC,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oCAAoC,EAAE,MAAM,6BAA6B,CAAC;AAEnF,yEAAyE;AAEzE,yEAAyE;AACzE,MAAM,kBAAkB,GAA8B;IACpD,0CAA0C;IAC1C,mCAAmC;IACnC,8BAA8B;IAC9B,4BAA4B;IAC5B,qCAAqC;IACrC,gCAAgC;IAChC,0BAA0B;IAC1B,yBAAyB;IACzB,kCAAkC;IAClC,uCAAuC;IACvC,8BAA8B;IAC9B,iCAAiC;IACjC,+BAA+B;IAC/B,+BAA+B;IAC/B,8BAA8B;IAC9B,uCAAuC;IACvC,wCAAwC;IACxC,8BAA8B;IAC9B,kCAAkC;IAClC,6BAA6B;IAC7B,6BAA6B;IAC7B,2BAA2B;IAC3B,2BAA2B;IAC3B,mCAAmC;IACnC,gCAAgC;IAChC,6BAA6B;IAC7B,gCAAgC;IAChC,mCAAmC;IACnC,gCAAgC;IAChC,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;IACrC,gCAAgC;IAChC,iCAAiC;IACjC,mCAAmC;IACnC,0BAA0B;IAC1B,0BAA0B;IAC1B,oCAAoC;CACrC,CAAC;AAEF,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,2EAA2E;YAC3E,mEAAmE;YACnE,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,OAAO,EACL,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC"}

package/dist/resolvers/shared/git-diff.d.ts

@@ -2,6 +2,16 @@
  * Git diff helpers shared across resolvers.
  */
 export declare const MAX_DIFF_BYTES: number;
+/**
+ * Run `git diff <range>` in a worktree. Returns the raw diff output, or empty
+ * string on failure. `range` is any ref expression git diff accepts, e.g.
+ * `integration...HEAD` or `<merge>^1...<merge>`.
+ */
+export declare function getGitDiffRange(worktreePath: string, range: string): string;
+/** `git diff --stat <range>` (for the truncation header). Empty on failure. */
+export declare function getDiffStatRange(worktreePath: string, range: string): string;
+/** `git diff --name-only <range>` (name-only). Empty array on failure. */
+export declare function getChangedFilesRange(worktreePath: string, range: string): string[];
 /**
  * Run git diff in a worktree against the base branch.
  * Returns the raw diff output, or empty string on failure.
@@ -24,4 +34,41 @@ export declare function getChangedFiles(worktreePath: string, baseBranch: string
  * worktree. Returns 0 on failure so callers treat "unknown" as "no commits".
  */
 export declare function getCommitsAhead(worktreePath: string, baseBranch: string): number;
+/**
+ * Find the merge commit on `baseBranch` that merged the current focus branch
+ * (the worktree's HEAD) into it.
+ *
+ * `git diff base...HEAD` answers "what is left to merge"; it empties the moment
+ * the focus branch merges into the base. But when the base advanced past the
+ * fork point, the merge is a real merge commit whose non-first parent IS the
+ * focus tip -- so `git diff <merge>^1 <merge>` still recovers exactly the
+ * delivery's contribution. This locates that merge commit deterministically
+ * from what is in the repo (no session ids, no reflog): scan the base branch's
+ * merge commits for one whose second (or later) parent equals HEAD.
+ *
+ * Returns null when no such merge exists -- an unmerged branch, or a merge that
+ * FAST-FORWARDED (no merge commit, so the fork point leaves no in-tree marker).
+ * The caller then yields an empty diff, which the instrument-fault path handles.
+ */
+export declare function findDeliveryMergeCommit(worktreePath: string, baseBranch: string): string | null;
+/**
+ * Resolve the git range that contains a delivery's work, robust to the focus
+ * branch having already merged into its base:
+ *
+ *   - branch AHEAD of base            -> `base...HEAD` (historic behaviour,
+ *                                        byte-identical to the old getGitDiff)
+ *   - branch LEVEL/BEHIND after merge -> `<merge>^1...<merge>` (recovered from
+ *                                        the merge commit that brought it in)
+ *   - no attributable commits         -> null (caller yields empty; the
+ *                                        instrument-fault path handles it)
+ */
+export declare function resolveDeliveryDiffRange(worktreePath: string, baseBranch: string): string | null;
+/**
+ * The delivery's diff, resolved from the range that actually contains its work
+ * (see resolveDeliveryDiffRange). For a branch still ahead of base this is
+ * byte-identical to `getGitDiff(worktreePath, baseBranch)`; for a merged branch
+ * it recovers the delivery's contribution from the merge commit; for a delivery
+ * with no attributable commits it returns ''.
+ */
+export declare function getDeliveryDiff(worktreePath: string, baseBranch: string): string;
 //# sourceMappingURL=git-diff.d.ts.map

package/dist/resolvers/shared/git-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAU3E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CASnF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAWhF"}
+{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../../src/resolvers/shared/git-diff.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAU3E;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS5E;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAWhF;AAKD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGhF"}