ctxr-cli 0.23.0 → 0.25.0

package/README.md

@@ -220,13 +220,15 @@ Each item is validated and applied independently, so one bad path refuses that i
 
 **5. Submit.** `ctxr-submit`: re-scan git state (never replay a plan from an earlier snapshot), run the capture pass, stage surgically with `git add <paths>` — never `-A`, and derived cache paths never stage — then `ctxr doctor` over the whole store, not `--staged`: a session's job is to leave the *store* healthy, not merely to pass one commit's gate. Then commit, rename the generated branch to something meaningful before it reaches the forge, `git push -u origin <branch>`, and `gh pr create`. If `gh` has no reachable GitHub remote, the push still succeeds on its own and you get manual pull-request instructions instead of a retry loop.
 
-**6. Land.** `ctxr-land`, after review: name the pull request explicitly rather than inferring it from whichever checkout you're standing in, read its state and mergeability with `gh pr view`, then wait for an explicit go — plan consent is not fire consent. `gh pr merge --squash`, then re-read state to confirm the forge reports `MERGED`; a transport error can arrive after a merge already succeeded, so the exit code alone is never enough. Finally fast-forward the canonical clone (`git fetch origin && git merge --ff-only`) and reclaim the worktree (`git worktree remove`, `git branch -d`) — nothing sweeps up afterward, so a worktree left here is left indefinitely.
+**6. Land.** `ctxr-land`, after review: name the pull request explicitly rather than inferring it from whichever checkout you're standing in, read its state with `gh pr view` (and its decision with `ctxr review list`, when the store [approves changes from a page](#approving-changes-from-a-page)), then wait for an explicit go — plan consent is not fire consent — unless a decider already approved it on the page. Then `ctxr land <pr>` (with `--confirm` when the consent is your go): it catches the branch up with the default branch, merges, re-reads the forge to confirm the merge rather than trusting an exit code, fast-forwards the canonical clone, and removes the worktree and its branch — nothing sweeps up afterward, so a worktree left here is left indefinitely.
 
 `ctxr-session-lifecycle` covers what surrounds both halves: when to re-scan, the conflict playbook, and sequencing several pull requests.
 
-### Why steps 5 and 6 aren't CLI commands
+### Why step 5 isn't a CLI command, and step 6 is
 
-They're ordinary `git` and `gh`. The CLI owns only what git cannot do — creating the worktree, applying validated note writes, running the health gates — and the sequencing, the confirmation gates, and the judgment live in the skills, where you can read and change them. That's why `ctxr session` has exactly three subcommands: `start`, `capture`, and `list`.
+Submitting is ordinary `git` and `gh`. The CLI owns only what git cannot do — creating the worktree, applying validated note writes, running the health gates — and the sequencing, the confirmation gates, and the judgment live in the skills, where you can read and change them. That's why `ctxr session` has exactly three subcommands: `start`, `capture`, and `list`.
+
+Landing was the same until a person could approve a change from a page. Then the thing that acts on an approval has no agent in it, and its one job — merge only a head someone approved — is a check that has to be enforced, not an instruction an agent follows. So `ctxr land` is code: it never resolves content, and the decision of *when* to land stays in `ctxr-land` and on the approval page.
 
 Two mechanical backstops hold the line underneath all of it: the **pre-commit** hook runs `doctor --staged`, and the **pre-push** hook refuses a push to the default branch (`CONTEXTURE_ALLOW_DEFAULT_BRANCH_PUSH=1` is the emergency override, for emergencies). Both are version-controlled git hooks, so they hold whichever harness, or human, does the writing.
 
@@ -309,10 +311,15 @@ The store's own `.contexture/guidance/mission.md` uses the same write path, but
 ctxr publish gather --note <path>          # or --under <prefix>, or --entity <name>
                                            # -> "Page filing: <derived path>/<page-name>"
 ctxr publish new <derived path>/comparison # scaffolds the page folder and its sibling README
+ctxr publish stamp .contexture/publish/<derived path>/comparison   # records the hash of the note the README leads with
 ctxr publish check .contexture/publish/<derived path>/comparison/index.html
+
+ctxr publish new --disposable agent-week   # -> .contexture/publish/disposable/<today>-agent-week
 ```
 
-`gather` resolves a subject to its note set — never a hand-picked list, which is how an unintended note slips onto a page unnoticed — and derives where the page belongs from where the subject's own notes live, at whatever depth the store carries them to. So the published-pages navigation reads like the store rather than like one long list, and a subject's second page collects beside its first under one folder naming the subject; `gather` reports the page that move would displace, and moves nothing. `check` runs the structural gates: no external references, viewport meta, a print rule, provenance, the sibling README, script syntax, and that the page is not filed flat at the publish root. Both `new` and `check` end by naming the address `ctxr serve` answers for the page — the preview route while the page is still in a session worktree, together with the published-pages address it takes once that work lands, so the page gets looked at while changing it is still cheap. What a page may *contain*, given who will read it, is a judgment `ctxr-publish` walks you through and no check can make.
+A page has one of two lifespans, read from where it is filed. A **permanent** page is the rendered form of one note that keeps changing: its README leads with a wikilink to that note (a folder's hub note, for a page drawn from a folder), `ctxr publish stamp` records the note's hash beside the link, and `check` fails the page — and `ctxr lint` lists it — once the note changes, until somebody reviews the page, removes the marker and stamps again. A **disposable** page is built to understand something once; it lives under `disposable/<YYYY-MM-DD>-<name>`, dated by the command, is never revised after it lands, and `ctxr lint` lists it as a removal candidate after 30 days — removal is the operator's call, made through a reviewed pull request.
+
+`gather` resolves a subject to its note set — never a hand-picked list, which is how an unintended note slips onto a page unnoticed — and derives where the page belongs from where the subject's own notes live, at whatever depth the store carries them to. So the published-pages navigation reads like the store rather than like one long list, and a subject's second page collects beside its first under one folder naming the subject; `gather` reports the page that move would displace, and moves nothing. `check` runs the structural gates: no external references, viewport meta, a print rule, provenance, the sibling README, script syntax, that the page is not filed flat at the publish root, and — by lifespan — a disposable page's dated shape or a permanent page's represented note and its recorded hash. Both `new` and `check` end by naming the address `ctxr serve` answers for the page — the preview route while the page is still in a session worktree, together with the published-pages address it takes once that work lands, so the page gets looked at while changing it is still cheap. What a page may *contain*, given who will read it, is a judgment `ctxr-publish` walks you through and no check can make.
 
 → `ctxr-publish`, plus the vendored `frontend-design` and `eli5` skills for the craft contexture supplies none of.
 
@@ -322,12 +329,63 @@ ctxr publish check .contexture/publish/<derived path>/comparison/index.html
 ctxr serve
 ```
 
-Renders notes, catalog sections, the graph document, and published pages as cross-linked HTML. It binds loopback (`127.0.0.1`) by default. `--host` widens that, but note what it does not change: `serve` applies **no per-requester filtering at any bind address**. Widening it exposes the whole store to whatever can reach that address, so only do it behind a front end you've arranged yourself.
+Renders notes, catalog sections, the graph document, and published pages as cross-linked HTML. It binds loopback (`127.0.0.1`) by default. `--host` widens that, but note what it does not change: `serve` applies **no per-requester filtering at any bind address**. Widening it exposes the whole store to whatever can reach that address, so only do it behind a front end you've arranged yourself. The one exception is the approval page below, which verifies who is asking before it shows or records anything.
 
 A published page's navigation label follows its own declared `<title>`, falling back to its folder name when it declares none. A folder group is labelled with the declared name of the taxonomy layer whose path it matches — so a store's own words for its top-level folders reach the sidebar — and with the bare directory name otherwise; either way a group sits where its directory name sorts, not where its label does. The header's light/dark/system links choose a display theme, and the ☰ control shows and hides the navigation — both persist across pages via cookies, and neither requires client-side script. A published page itself is still served byte-verbatim, so neither the theme nor the navigation reaches into it; `ctxr publish new`'s scaffold instead follows the viewer's own system preference on its own.
 
 The **Preview** area, directly below the published pages, holds the pages your open session worktrees are carrying. A page is previewable from the moment its files exist on disk — before any commit, before any push, before a PR is opened or merged — because `serve` reads the worktree rather than asking git or a forge anything. Pages group by the worktree holding them at `/preview/<worktree>/<page>/index.html`, and a preview is byte-identical to what `/publish/<page>/index.html` will serve once the page lands, so what you read is what ships. Both routes address files rather than directories, so a page's address always names its index file — which is the address `ctxr publish new` and `ctxr publish check` report, so you never have to work out which of the two applies. For a whole change set, `ctxr publish urls --staged` (or `--since <ref>`) reports every page added, modified, moved or removed with both addresses, which is what `ctxr-submit` puts in a pull request's **Pages** section; set `serve.previews: none` in `contexture.yaml` if previews never resolve for your reviewers. A session worktree carrying no page appears nowhere, and nothing else inside one — notes, catalog, graph, config — becomes reachable.
 
+## Approving changes from a page
+
+People who own a store's content often have no forge account. With change approval declared, `ctxr serve` gives them a page instead: `/approve/` lists every session with an open pull request, and each one's page shows the author's account of the change (its title, description and commit messages, labelled as the author's), the knowledge changes computed from the commits, the preview of every changed page, and every changed line. Two buttons — **Approve** and **Request changes** — record the decision on the pull request, as a review by the store's own forge identity naming the person who decided and the commit they saw. Nobody needs a GitHub account to leave an entry in the audit trail.
+
+```yaml
+serve:
+  base_url: https://ctx.example.com
+change_approval:
+  identity:                       # the signed assertion your access proxy forwards
+    header: Cf-Access-Jwt-Assertion
+    issuer: https://<team>.cloudflareaccess.com
+    audience: <application aud tag>
+    jwks_url: https://<team>.cloudflareaccess.com/cdn-cgi/access/certs
+  deciders: ["@example.com"]      # exact emails or @domain entries
+  recording_login: ctx-approvals  # the forge identity decisions are recorded as
+  resolver: ["claude", "-p"]      # optional: who resolves a conflict
+```
+
+Identity comes from the proxy in front of `serve` (Cloudflare Access, Google IAP, oauth2-proxy): every `/approve/` request must carry its signed assertion, verified against the key set, issuer, audience and expiry, or it gets `401`. A request that reaches the port around the proxy carries none.
+
+Then the system does the rest. Run `ctxr land --pending` on a schedule, with a forge token for the recording identity that can push and merge: it lands every pull request whose current head carries an approval — rebasing it onto the default branch when it is behind, merging, syncing the canonical clone, and removing the worktree. A clean rebase keeps the approval only when every commit's patch is unchanged, and the carry-over is recorded on the pull request. A rebase that conflicts goes to the configured resolver; its result is checked (clean, rebased, `ctxr doctor` passes), pushed, and handed back to the page for a new decision, because nobody has read an agent's merge of two sides. With no resolver, the change is marked blocked. Requested changes and blocked landings reach the next agent session through `ctxr review list`.
+
+Outside the store, set up the recording identity (below) and, where your plan allows it, a branch protection rule requiring one approving review.
+
+### Recording identity
+
+Decisions and landings are recorded on the pull request by one forge identity, the `recording_login`. It must not be the identity your agents open pull requests with: the forge refuses an approval from a pull request's own author. There are two ways to provide it.
+
+**A GitHub App (recommended).** No account to look after, no seat, and no token to rotate: the App's private key does not expire, and contexture mints a one-hour installation token from it whenever it needs one.
+
+1. Create the App at <https://github.com/settings/apps/new> (or the organization's equivalent). Leave the webhook inactive and the callback URL empty, and request no user authorization. Under **Repository permissions** set **Contents**, **Issues** and **Pull requests** to *Read and write*; **Metadata** is read-only by default. Nothing else. [`templates/approve/github-app-manifest.json`](templates/approve/github-app-manifest.json) holds the same settings for GitHub's manifest flow.
+2. Generate a private key on the App's page, and keep the `.pem` outside every repository, readable only by the user that runs `serve` (`chmod 600`).
+3. Install the App on the store's repository, selecting only that repository.
+4. Set `recording_login` to the App's slug followed by `[bot]`, e.g. `ctx-a-approvals[bot]`.
+5. Give `ctxr serve` and the scheduled `ctxr land --pending` these, and nothing else needs a forge credential:
+
+```sh
+CONTEXTURE_GITHUB_APP_ID=<the App ID>             # or its client ID
+CONTEXTURE_GITHUB_APP_PRIVATE_KEY_FILE=/run/secrets/ctx-approvals.pem   # or CONTEXTURE_GITHUB_APP_PRIVATE_KEY=<the PEM text>
+```
+
+contexture finds the installation from the store's github.com `origin` (or from `CONTEXTURE_GITHUB_REPOSITORY=owner/repo` when `origin` is not a github.com URL), and `ctxr land` fetches and pushes as the App too, handing git the token for that one command only. Every envelope reports `credential: github-app` and never the credential itself.
+
+**One App per key holder.** Whoever holds the key can act on every repository the App is installed on, so share an App only across stores *you* run. To serve several of your stores under different owners, make the App installable on any account and install it on each owner with only that store's repository selected. A store someone else runs uses their own App.
+
+**Where the key may live.** Only in the environments of `ctxr serve` and the land runner — never anywhere an agent runs commands, such as a harness gateway. An agent that can read the key can act on every store the App is installed on. If a key leaks, delete it on the App's page; that revokes it at once.
+
+**A token for an account.** Without the App variables, `serve`, `land` and `review list` use `gh`'s own credential (`GH_TOKEN` or its credential file), so a dedicated machine account with a fine-grained token (Contents, Issues and Pull requests read and write on the store's repository) also works. It needs a rotation whenever the token expires.
+
+GitHub Free cannot protect a private repository on a personal account, so such a store has no required-review rule; `ctxr land`'s consent check is what gates the merge either way. Where branch protection is available, require one approving review and leave **"Require approval of the most recent reviewable push"** off: the runner pushes a rebase and then approves the carry-over as the same identity.
+
 ## Keeping a store current
 
 ```sh
@@ -385,6 +443,8 @@ To pin a value against a future default change, declare it. Nothing rewrites wha
 | `rollup gather \| write \| stale` | Entity synthesis: enumerate, write, find what's out of date |
 | `publish gather \| new \| check` | Resolve a subject, scaffold a page, run the structural gates |
 | `session start \| capture \| list` | Session worktrees, and applying an approved capture proposal |
+| `land <pr> [--confirm] \| --pending` | Land a session pull request that carries consent: catch up, merge, confirm, sync, reclaim |
+| `review list` | Each open session pull request's decision from the approval page |
 | `adapters generate` | Regenerate harness outputs (`ctxr update` does this too) |
 | `serve` | Read the store in a browser |
 | `update` | Bring contexture-owned files up to the installed version |

package/dist/commands/graph-diff.d.ts

@@ -0,0 +1,33 @@
+import { type ServedAtRoute } from '../core/browse/page-url.js';
+import type { CommandOutcome, CommandRequires } from '../core/command.js';
+import { type GraphDelta } from '../core/graph/diff.js';
+import type { Store } from '../core/store.js';
+export declare const requires: CommandRequires;
+/** review-the-knowledge-diff (D9): an enum rather than a boolean, so a further form has room and `--json` stays the envelope switch. */
+export declare const GRAPH_DIFF_FORMATS: readonly ['text', 'markdown'];
+export type GraphDiffFormat = (typeof GRAPH_DIFF_FORMATS)[number];
+export interface GraphDiffFlags {
+    since: string | undefined;
+    until: string | undefined;
+    format: string | undefined;
+}
+export interface GraphDiffData extends GraphDelta {
+    base_url_declared: boolean;
+    /** The review view of this session worktree, carrying the head id; null outside a worktree or with previews off. */
+    review: ServedAtRoute | null;
+}
+/**
+ * The flag checks, ahead of any store or git read, so a malformed invocation
+ * is refused with the usage code however the store is doing. Returns the
+ * format to render.
+ */
+export declare function checkFlags(flags: GraphDiffFlags, jsonMode: boolean): GraphDiffFormat;
+/**
+ * context-retrieval spec (review-the-knowledge-diff): the graph delta between
+ * the merge base of `--since` and the head, read from git's object store. It
+ * reports and gates nothing — no findings, and exit 0 whenever both sides
+ * could be read (D10). `--format markdown` makes the human output the
+ * knowledge-changes block and nothing else, so it can be pasted unchanged.
+ */
+export declare function execute(store: Store, flags: GraphDiffFlags, jsonMode?: boolean): Promise<CommandOutcome<GraphDiffData>>;
+//# sourceMappingURL=graph-diff.d.ts.map

package/dist/commands/graph-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-diff.d.ts","sourceRoot":"","sources":["../../src/commands/graph-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAM1E,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,wIAAwI;AACxI,eAAO,MAAM,kBAAkB,YAAI,MAAM,EAAE,UAAU,CAAU,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oHAAoH;IACpH,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,GAAG,eAAe,CAMpF;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAqB3H"}

package/dist/commands/graph-diff.js

@@ -0,0 +1,52 @@
+import { reviewServedAt } from '../core/browse/page-url.js';
+import { GraphDiffFormatError, GraphDiffSinceRequiredError } from '../core/errors.js';
+import { ExitCode } from '../core/exit-codes.js';
+import { createExecFileGitRunner } from '../core/git/exec.js';
+import { renderKnowledgeChangesBlock, reviewLines } from '../core/graph/diff-block.js';
+import { renderDiffDocument } from '../core/graph/diff-document.js';
+import { computeGraphDelta, resolveRange } from '../core/graph/diff.js';
+export const requires = { store: 'required' };
+/** review-the-knowledge-diff (D9): an enum rather than a boolean, so a further form has room and `--json` stays the envelope switch. */
+export const GRAPH_DIFF_FORMATS = ['text', 'markdown'];
+/**
+ * The flag checks, ahead of any store or git read, so a malformed invocation
+ * is refused with the usage code however the store is doing. Returns the
+ * format to render.
+ */
+export function checkFlags(flags, jsonMode) {
+    if (flags.since === undefined)
+        throw new GraphDiffSinceRequiredError();
+    const format = flags.format ?? 'text';
+    if (!GRAPH_DIFF_FORMATS.includes(format))
+        throw new GraphDiffFormatError(format, GRAPH_DIFF_FORMATS, false);
+    if (format === 'markdown' && jsonMode)
+        throw new GraphDiffFormatError(format, GRAPH_DIFF_FORMATS, true);
+    return format;
+}
+/**
+ * context-retrieval spec (review-the-knowledge-diff): the graph delta between
+ * the merge base of `--since` and the head, read from git's object store. It
+ * reports and gates nothing — no findings, and exit 0 whenever both sides
+ * could be read (D10). `--format markdown` makes the human output the
+ * knowledge-changes block and nothing else, so it can be pasted unchanged.
+ */
+export async function execute(store, flags, jsonMode = false) {
+    const format = checkFlags(flags, jsonMode);
+    const git = createExecFileGitRunner();
+    const range = await resolveRange(git, store.root, flags.since, flags.until);
+    const delta = await computeGraphDelta(git, store.root, range, store.config);
+    const review = reviewServedAt(store, delta.head);
+    const baseUrlDeclared = store.config.serve?.base_url !== undefined;
+    const humanSummary = format === 'markdown'
+        ? renderKnowledgeChangesBlock(delta, review).replace(/\n$/, '')
+        : [renderDiffDocument(delta).replace(/\n$/, ''), ...reviewLines(review)].join('\n');
+    return {
+        exitCode: ExitCode.Ok,
+        data: { ...delta, base_url_declared: baseUrlDeclared, review },
+        findings: [],
+        humanSummary,
+        storeRoot: store.root,
+        schemaVersion: store.config.schema_version,
+    };
+}
+//# sourceMappingURL=graph-diff.js.map

package/dist/commands/graph-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-diff.js","sourceRoot":"","sources":["../../src/commands/graph-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,4BAA4B,CAAC;AAEhF,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,uBAAuB,CAAC;AAGzF,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAE/D,wIAAwI;AACxI,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAU,CAAC;AAehE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAqB,EAAE,QAAiB;IACjE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC;IACtC,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACnI,IAAI,MAAM,KAAK,UAAU,IAAI,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxG,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAY,EAAE,KAAqB,EAAE,QAAQ,GAAG,KAAK;IACjF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC;IAEnE,MAAM,YAAY,GAChB,MAAM,KAAK,UAAU;QACnB,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAExF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE;QAC9D,QAAQ,EAAE,EAAE;QACZ,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/commands/land.d.ts

@@ -0,0 +1,50 @@
+import type { CommandOutcome, CommandRequires } from '../core/command.js';
+import type { RunEnv } from '../core/env.js';
+import { type CredentialKind } from '../core/forge/credentials.js';
+import { type ForgeClient } from '../core/forge/github.js';
+import { type Store } from '../core/store.js';
+export declare const requires: CommandRequires;
+export interface LandFlags {
+    pr: number | undefined;
+    pending: boolean;
+    confirm: boolean;
+}
+export type LandOutcome = 'merged' | 'no-consent' | 'needs-reapproval' | 'blocked' | 'merge-refused' | 'lease-refused';
+export type CatchUp = 'not-needed' | 'clean' | 'carried-over' | 'patches-changed' | 'conflict' | 'conflict-resolved';
+export interface LandResult {
+    pull_request: number;
+    worktree: string | null;
+    outcome: LandOutcome;
+    /** Where the consent came from: a decision recorded from the approval page, or `--confirm`. */
+    consent: 'recorded' | 'confirm' | null;
+    /** The decision state, when consent was looked for and not found. */
+    state: string | null;
+    reason: string | null;
+    catch_up: CatchUp | null;
+    merged_commit: string | null;
+    canonical_sync: {
+        synced: boolean;
+        reason: string | null;
+    } | null;
+    reclaim: {
+        removed: boolean;
+        reason: string | null;
+    } | null;
+    /** Records posted on the pull request, and records this credential could not post (not the recording login). */
+    records_posted: string[];
+    records_reported_only: string[];
+}
+export interface LandData {
+    /** Which kind of forge credential the command used; never the credential. */
+    credential: CredentialKind;
+    results: LandResult[];
+}
+/**
+ * write-lifecycle spec ("Landing merges only a head that carries consent"):
+ * one pull request, or with `--pending` every session pull request whose
+ * current head carries an approval. design.md D1: this is code because the
+ * runner acting on a page approval has no agent in it, and the consent check is
+ * the one thing that must be enforced rather than instructed.
+ */
+export declare function execute(env: RunEnv, store: Store, flags: LandFlags, forge?: ForgeClient): Promise<CommandOutcome<LandData>>;
+//# sourceMappingURL=land.d.ts.map

package/dist/commands/land.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"land.d.ts","sourceRoot":"","sources":["../../src/commands/land.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,EAAiC,KAAK,cAAc,EAAyB,MAAM,8BAA8B,CAAC;AACzH,OAAO,EAA0C,KAAK,WAAW,EAAsC,MAAM,yBAAyB,CAAC;AAGvI,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAKzD,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,kBAAkB,GAAG,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AACvH,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,cAAc,GAAG,iBAAiB,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAErH,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,WAAW,CAAC;IACrB,+FAA+F;IAC/F,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC;IACvC,qEAAqE;IACrE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAClE,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,gHAAgH;IAChH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,6EAA6E;IAC7E,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAuWD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAkDjI"}