ctxr-cli 0.24.0 → 0.26.0

package/dist/core/approval/identity.js

@@ -0,0 +1,105 @@
+import { createPublicKey, verify } from 'node:crypto';
+const ALGORITHMS = {
+    RS256: { hash: 'sha256' },
+    ES256: { hash: 'sha256', dsaEncoding: 'ieee-p1363' },
+};
+/** Seconds of clock skew allowed on `exp` and `nbf`. */
+const SKEW_SECONDS = 30;
+/** An unknown key id re-fetches the key set at most this often, so a stream of forged ids cannot turn into a stream of fetches. */
+const REFETCH_INTERVAL_MS = 10_000;
+function decodeSegment(segment) {
+    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+}
+export function createIdentityVerifier(identity, opts = {}) {
+    const fetchImpl = opts.fetch ?? ((url) => fetch(url));
+    const now = opts.now ?? (() => new Date());
+    let keys = new Map();
+    let lastFetch = 0;
+    async function refreshKeys() {
+        lastFetch = Date.now();
+        const response = await fetchImpl(identity.jwks_url);
+        if (!response.ok)
+            throw new Error(`key set fetch answered ${response.status}`);
+        const body = (await response.json());
+        const next = new Map();
+        for (const jwk of body.keys ?? []) {
+            if (typeof jwk.kid !== 'string')
+                continue;
+            try {
+                next.set(jwk.kid, createPublicKey({ key: jwk, format: 'jwk' }));
+            }
+            catch {
+                // A key this runtime cannot read verifies nothing.
+            }
+        }
+        keys = next;
+    }
+    async function keyFor(kid) {
+        const known = keys.get(kid);
+        if (known !== undefined)
+            return known;
+        if (Date.now() - lastFetch < REFETCH_INTERVAL_MS && keys.size > 0)
+            return null;
+        await refreshKeys();
+        return keys.get(kid) ?? null;
+    }
+    return {
+        async verify(headerValue) {
+            const token = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+            if (token === undefined || token === '')
+                return { ok: false, reason: 'no identity assertion' };
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                return { ok: false, reason: 'malformed assertion' };
+            const [headerPart, payloadPart, signaturePart] = parts;
+            let header;
+            let claims;
+            try {
+                header = decodeSegment(headerPart);
+                claims = decodeSegment(payloadPart);
+            }
+            catch {
+                return { ok: false, reason: 'malformed assertion' };
+            }
+            const algorithm = typeof header.alg === 'string' ? ALGORITHMS[header.alg] : undefined;
+            if (algorithm === undefined)
+                return { ok: false, reason: 'unsupported signing algorithm' };
+            if (typeof header.kid !== 'string')
+                return { ok: false, reason: 'assertion names no key' };
+            let key;
+            try {
+                key = await keyFor(header.kid);
+            }
+            catch (err) {
+                return { ok: false, reason: `key set unavailable: ${err instanceof Error ? err.message : String(err)}` };
+            }
+            if (key === null)
+                return { ok: false, reason: 'assertion signed by an unknown key' };
+            const signed = Buffer.from(`${headerPart}.${payloadPart}`, 'utf8');
+            const signature = Buffer.from(signaturePart, 'base64url');
+            let valid = false;
+            try {
+                valid = verify(algorithm.hash, signed, algorithm.dsaEncoding ? { key, dsaEncoding: algorithm.dsaEncoding } : key, signature);
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid)
+                return { ok: false, reason: 'signature does not verify' };
+            if (claims.iss !== identity.issuer)
+                return { ok: false, reason: 'wrong issuer' };
+            const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+            if (!audiences.includes(identity.audience))
+                return { ok: false, reason: 'wrong audience' };
+            const nowSeconds = now().getTime() / 1000;
+            if (typeof claims.exp !== 'number' || claims.exp + SKEW_SECONDS < nowSeconds)
+                return { ok: false, reason: 'expired' };
+            if (typeof claims.nbf === 'number' && claims.nbf - SKEW_SECONDS > nowSeconds)
+                return { ok: false, reason: 'not yet valid' };
+            if (typeof claims.email !== 'string' || !/^[^@\s]+@[^@\s]+$/.test(claims.email))
+                return { ok: false, reason: 'no email claim' };
+            return { ok: true, email: claims.email };
+        },
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/core/approval/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/core/approval/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAuBtE,MAAM,UAAU,GAA2E;IACzF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;CACrD,CAAC;AAEF,wDAAwD;AACxD,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,mIAAmI;AACnI,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA0C,EAC1C,IAAI,GAA4C,EAAE;IAElD,MAAM,SAAS,GAAc,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,UAAU,WAAW;QACxB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;QAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC1C,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,mBAAmB,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/E,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,WAAW;YACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YACxE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAC5E,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;YAEnF,IAAI,MAAwC,CAAC;YAC7C,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,aAAa,CAAC,UAAU,CAAkB,CAAC;gBACpD,MAAM,GAAG,aAAa,CAAC,WAAW,CAA4B,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YAC3F,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YAE3F,IAAI,GAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC3G,CAAC;YACD,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;YAErF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/H,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;YAEtE,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC3F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC1C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,YAAY,GAAG,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACtH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,YAAY,GAAG,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YAC5H,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAChI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/approval/landing-record.d.ts

@@ -0,0 +1,17 @@
+/**
+ * write-lifecycle spec: where `ctxr land` records a landing for the approval
+ * page to read once the worktree is gone. A derived cache path, beside the
+ * graph document's, written atomically and never staged.
+ */
+export declare const LANDINGS_RELATIVE_PATH = ".contexture/cache/landings";
+export interface LandingRecord {
+    worktree: string;
+    branch: string;
+    pull_request: number;
+    merged_commit: string | null;
+    landed_at: string;
+}
+export declare function writeLandingRecord(storeRoot: string, record: LandingRecord): Promise<void>;
+/** The record for `worktree`, or null — including for a name that is not a plain directory name. */
+export declare function readLandingRecord(storeRoot: string, worktree: string): Promise<LandingRecord | null>;
+//# sourceMappingURL=landing-record.d.ts.map

package/dist/core/approval/landing-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"landing-record.d.ts","sourceRoot":"","sources":["../../../src/core/approval/landing-record.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhG;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQ1G"}

package/dist/core/approval/landing-record.js

@@ -0,0 +1,30 @@
+import { mkdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { writeFileAtomic } from '../fs/atomic.js';
+/**
+ * write-lifecycle spec: where `ctxr land` records a landing for the approval
+ * page to read once the worktree is gone. A derived cache path, beside the
+ * graph document's, written atomically and never staged.
+ */
+export const LANDINGS_RELATIVE_PATH = '.contexture/cache/landings';
+function recordPath(storeRoot, worktree) {
+    return path.join(storeRoot, LANDINGS_RELATIVE_PATH, `${worktree}.json`);
+}
+export async function writeLandingRecord(storeRoot, record) {
+    await mkdir(path.join(storeRoot, LANDINGS_RELATIVE_PATH), { recursive: true });
+    await writeFileAtomic(recordPath(storeRoot, record.worktree), `${JSON.stringify(record, null, 2)}\n`);
+}
+/** The record for `worktree`, or null — including for a name that is not a plain directory name. */
+export async function readLandingRecord(storeRoot, worktree) {
+    if (worktree === '' || worktree.includes('/') || worktree.includes('\\') || worktree.startsWith('.'))
+        return null;
+    try {
+        return JSON.parse(await readFile(recordPath(storeRoot, worktree), 'utf8'));
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=landing-record.js.map

package/dist/core/approval/landing-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"landing-record.js","sourceRoot":"","sources":["../../../src/core/approval/landing-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAUnE,SAAS,UAAU,CAAC,SAAiB,EAAE,QAAgB;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAqB;IAC/E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxG,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAgB;IACzE,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/approval/resolver.d.ts

@@ -0,0 +1,15 @@
+export declare function resolverPrompt(pullNumber: number, base: string, defaultBranch: string): string;
+/**
+ * design.md D6: the one place `ctxr land` spawns the store's configured
+ * conflict resolver — an argument vector, never a shell string, run in the
+ * checkout to resolve, with the prompt as its last argument. Its output goes to
+ * `output` (the command's stderr), so stdout keeps the one envelope.
+ */
+export declare function runResolver(input: {
+    argv: readonly string[];
+    prompt: string;
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    output: NodeJS.WritableStream;
+}): Promise<number>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/core/approval/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/core/approval/resolver.ts"],"names":[],"mappings":"AAmBA,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAK9F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB"}

package/dist/core/approval/resolver.js

@@ -0,0 +1,41 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { packagedTemplate } from '../templates.js';
+/**
+ * write-lifecycle spec: the resolver gets "the conflict playbook the shipped
+ * lifecycle skill carries" — read out of that skill's own template, so the
+ * playbook has one source and the resolver can never follow an older copy.
+ */
+function lifecyclePlaybook(defaultBranch) {
+    const skill = readFileSync(fileURLToPath(new URL('../../../templates/skills/ctxr-session-lifecycle.md', import.meta.url)), 'utf8');
+    const start = skill.indexOf('## Conflict playbook');
+    if (start === -1)
+        throw new Error('the lifecycle skill template carries no "## Conflict playbook" section');
+    const next = skill.indexOf('\n## ', start + 1);
+    const section = skill.slice(skill.indexOf('\n', start) + 1, next === -1 ? undefined : next).trim();
+    return section.replaceAll('__DEFAULT_BRANCH__', defaultBranch);
+}
+export function resolverPrompt(pullNumber, base, defaultBranch) {
+    return packagedTemplate('land', 'resolver')
+        .replaceAll('__PR__', () => String(pullNumber))
+        .replaceAll('__BASE__', () => base)
+        .replace('__PLAYBOOK__', () => lifecyclePlaybook(defaultBranch));
+}
+/**
+ * design.md D6: the one place `ctxr land` spawns the store's configured
+ * conflict resolver — an argument vector, never a shell string, run in the
+ * checkout to resolve, with the prompt as its last argument. Its output goes to
+ * `output` (the command's stderr), so stdout keeps the one envelope.
+ */
+export function runResolver(input) {
+    const [command, ...args] = input.argv;
+    return new Promise((resolve) => {
+        const child = spawn(command, [...args, input.prompt], { cwd: input.cwd, env: input.env, stdio: ['ignore', 'pipe', 'pipe'] });
+        child.stdout.on('data', (chunk) => input.output.write(chunk));
+        child.stderr.on('data', (chunk) => input.output.write(chunk));
+        child.on('error', () => resolve(127));
+        child.on('close', (code) => resolve(code ?? 1));
+    });
+}
+//# sourceMappingURL=resolver.js.map

package/dist/core/approval/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/core/approval/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,qDAAqD,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5G,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACnG,OAAO,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,IAAY,EAAE,aAAqB;IACpF,OAAO,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC;SACxC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SAC9C,UAAU,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAM3B;IACC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAwB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnJ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/approval/sessions.d.ts

@@ -0,0 +1,36 @@
+import type { StoreConfig } from '../../config/schema.js';
+import type { GitRunner } from '../git/exec.js';
+import { type ForgeClient, type PullRequest } from '../forge/github.js';
+import { type ReviewState } from './decision.js';
+export interface SessionWorktree {
+    /** The worktree's directory name — the key the review and approval routes use. */
+    name: string;
+    path: string;
+    branch: string;
+}
+export interface SessionPull extends SessionWorktree {
+    pull: PullRequest;
+    review: ReviewState;
+}
+/** The session worktrees git knows, recognized as `ctxr session list` recognizes them. */
+export declare function sessionWorktrees(git: GitRunner, repoCwd: string, config: StoreConfig): Promise<SessionWorktree[]>;
+/** `origin/<default>` when the repository has that ref, else the local default branch — the review route's own rule. */
+export declare function baseRef(git: GitRunner, cwd: string, defaultBranch: string): Promise<string>;
+/**
+ * write-lifecycle spec (design.md D5): whether `currentHead` carries over the
+ * approval of `approvedHead` — each head's commits since it left `base`, compared
+ * by patch identity, commit for commit. Anything that cannot be computed (an
+ * approved head no longer in this repository) is "no".
+ */
+export declare function carriesOver(git: GitRunner, cwd: string, base: string, approvedHead: string, currentHead: string): Promise<boolean>;
+/** Every forge call here, turned into the usage error the spec asks for when the forge cannot be read. */
+export declare function forgeRead<T>(call: () => Promise<T>): Promise<T>;
+/** One pull request's decision state, with an approval of an earlier head upgraded when the current head carries it over. */
+export declare function reviewStateOf(git: GitRunner, cwd: string, base: string, forge: ForgeClient, recordingLogin: string, pull: PullRequest): Promise<ReviewState>;
+/**
+ * change-approval spec: every session worktree whose branch has an open pull
+ * request, with its decision state. A worktree with no open pull request is
+ * left out.
+ */
+export declare function sessionPulls(git: GitRunner, repoCwd: string, config: StoreConfig, forge: ForgeClient, recordingLogin: string, openPulls?: () => Promise<PullRequest[]>): Promise<SessionPull[]>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/core/approval/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/core/approval/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE3F,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,0FAA0F;AAC1F,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAQvH;AAED,wHAAwH;AACxH,wBAAsB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjG;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUxI;AAED,0GAA0G;AAC1G,wBAAsB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOrE;AAED,6HAA6H;AAC7H,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,WAAW,EAClB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,WAAW,CAAC,CAOtB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,GACvC,OAAO,CAAC,WAAW,EAAE,CAAC,CAcxB"}

package/dist/core/approval/sessions.js

@@ -0,0 +1,76 @@
+import path from 'node:path';
+import { ForgeUnreachableError } from '../errors.js';
+import { patchIds } from '../git/exec.js';
+import { listWorktrees } from '../git/worktree.js';
+import { ForgeRequestError } from '../forge/github.js';
+import { isSessionBranch, isSessionWorktreePath } from '../session.js';
+import { resolveReviewState } from './decision.js';
+/** The session worktrees git knows, recognized as `ctxr session list` recognizes them. */
+export async function sessionWorktrees(git, repoCwd, config) {
+    const worktrees = await listWorktrees(git, repoCwd);
+    return worktrees
+        .filter((w) => w.branch !== null && (isSessionBranch(config, w.branch) || isSessionWorktreePath(config, w.path)))
+        .map((w) => ({ name: path.basename(w.path), path: w.path, branch: w.branch }));
+}
+/** `origin/<default>` when the repository has that ref, else the local default branch — the review route's own rule. */
+export async function baseRef(git, cwd, defaultBranch) {
+    const remote = await git.run(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${defaultBranch}`], { cwd, allowFailure: true });
+    return remote.exitCode === 0 ? `origin/${defaultBranch}` : defaultBranch;
+}
+/**
+ * write-lifecycle spec (design.md D5): whether `currentHead` carries over the
+ * approval of `approvedHead` — each head's commits since it left `base`, compared
+ * by patch identity, commit for commit. Anything that cannot be computed (an
+ * approved head no longer in this repository) is "no".
+ */
+export async function carriesOver(git, cwd, base, approvedHead, currentHead) {
+    try {
+        const forkOf = async (head) => (await git.run(['merge-base', head, base], { cwd })).stdout.trim();
+        const before = await patchIds(cwd, `${await forkOf(approvedHead)}..${approvedHead}`);
+        const after = await patchIds(cwd, `${await forkOf(currentHead)}..${currentHead}`);
+        return before.length > 0 && before.length === after.length && before.every((id, i) => id === after[i]);
+    }
+    catch {
+        return false;
+    }
+}
+/** Every forge call here, turned into the usage error the spec asks for when the forge cannot be read. */
+export async function forgeRead(call) {
+    try {
+        return await call();
+    }
+    catch (err) {
+        if (err instanceof ForgeRequestError)
+            throw new ForgeUnreachableError(err.message);
+        throw err;
+    }
+}
+/** One pull request's decision state, with an approval of an earlier head upgraded when the current head carries it over. */
+export async function reviewStateOf(git, cwd, base, forge, recordingLogin, pull) {
+    const [reviews, comments] = await Promise.all([forge.reviews(pull.number), forge.comments(pull.number)]);
+    const state = resolveReviewState({ reviews, comments, recordingLogin, head: pull.headSha });
+    if (state.approvalNeedsCarryCheck && state.decision !== null && (await carriesOver(git, cwd, base, state.decision.head, pull.headSha))) {
+        return { ...state, state: 'approved', approvalNeedsCarryCheck: false };
+    }
+    return state;
+}
+/**
+ * change-approval spec: every session worktree whose branch has an open pull
+ * request, with its decision state. A worktree with no open pull request is
+ * left out.
+ */
+export async function sessionPulls(git, repoCwd, config, forge, recordingLogin, openPulls) {
+    const worktrees = await sessionWorktrees(git, repoCwd, config);
+    const open = await forgeRead(openPulls ?? (() => forge.openPulls()));
+    const base = await baseRef(git, repoCwd, config.git.default_branch);
+    // Each pull request's reviews and comments are independent reads, so they go out together.
+    const found = await Promise.all(worktrees.map(async (worktree) => {
+        const pull = open.find((p) => p.headRef === worktree.branch);
+        if (pull === undefined)
+            return null;
+        const review = await forgeRead(() => reviewStateOf(git, worktree.path, base, forge, recordingLogin, pull));
+        return { ...worktree, pull, review };
+    }));
+    return found.filter((p) => p !== null);
+}
+//# sourceMappingURL=sessions.js.map

package/dist/core/approval/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/core/approval/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAsC,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,eAAe,CAAC;AAcrE,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,OAAe,EAAE,MAAmB;IACzF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS;SACb,MAAM,CACL,CAAC,CAAC,EAAsC,EAAE,CACxC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CACpG;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAc,EAAE,GAAW,EAAE,aAAqB;IAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,uBAAuB,aAAa,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACxI,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,aAAa,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAc,EAAE,GAAW,EAAE,IAAY,EAAE,YAAoB,EAAE,WAAmB;IACpH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE,CACrD,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,IAAsB;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,6HAA6H;AAC7H,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc,EACd,GAAW,EACX,IAAY,EACZ,KAAkB,EAClB,cAAsB,EACtB,IAAiB;IAEjB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvI,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAc,EACd,OAAe,EACf,MAAmB,EACnB,KAAkB,EAClB,cAAsB,EACtB,SAAwC;IAExC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpE,2FAA2F;IAC3F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAA+B,EAAE;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC"}

package/dist/core/browse/approve.d.ts

@@ -0,0 +1,48 @@
+import type { IncomingMessage } from 'node:http';
+import type { ChangeApprovalConfig } from '../../config/schema.js';
+import type { IdentityVerifier } from '../approval/identity.js';
+import type { ForgeClient } from '../forge/github.js';
+import type { GitRunner } from '../git/exec.js';
+import type { Store } from '../store.js';
+import type { LinkResolver } from './link-resolver.js';
+import { type RenderedBody } from './render.js';
+/**
+ * change-approval spec: the approval index, one session's approval page, and
+ * the one route on this server that admits `POST`. Every path under the prefix
+ * is answered here, and only after the identity assertion verifies — nothing
+ * about the store or the forge is read before that.
+ */
+export declare const APPROVE_ROUTE_PREFIX = "/approve/";
+export interface ApprovalServer {
+    approval: ChangeApprovalConfig;
+    /** The origin of `serve.base_url`, which a decision's `Origin` header must equal (design.md D9). */
+    origin: string;
+    forge: ForgeClient;
+    verifier: IdentityVerifier;
+    git: GitRunner;
+    now(): Date;
+}
+/** What a route needs from the browsing surface once the requester is known: the shell, and note links. */
+export interface PageKit {
+    page(title: string, body: RenderedBody): Promise<string>;
+    linkFor(notePath: string): string | null;
+    resolveLink: LinkResolver;
+}
+export interface Reply {
+    status: number;
+    contentType: string;
+    body: string;
+    headers?: Record<string, string>;
+}
+export declare function isApprovePath(pathname: string): boolean;
+export declare function isDecisionRoute(pathname: string): boolean;
+/**
+ * Answers every request under the approval prefix. `server` is null when the
+ * store declares no change approval, and then every such path is `404` —
+ * unless `unavailable` says the block is declared but its surface could not be
+ * built after startup (serve-follows-config-changes D4), and then every such
+ * path is `503`, naming why. `makeKit` builds the browsing surface's shell only
+ * after the requester is known.
+ */
+export declare function handleApprove(store: Store, server: ApprovalServer | null, req: IncomingMessage, method: string, pathname: string, makeKit: () => Promise<PageKit>, unavailable?: string | null): Promise<Reply>;
+//# sourceMappingURL=approve.d.ts.map

package/dist/core/browse/approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../src/core/browse/approve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAInE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAO5E;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAOhD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,IAAI,IAAI,CAAC;CACb;AAED,2GAA2G;AAC3G,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzC,WAAW,EAAE,YAAY,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAQD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AA0QD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC/B,WAAW,GAAE,MAAM,GAAG,IAAW,GAChC,OAAO,CAAC,KAAK,CAAC,CAkBhB"}