nawabari 0.6.0 → 0.7.0

package/dist/cli.js

@@ -3,6 +3,7 @@ import { runDoctor } from "./domain/doctor.js";
 import { DomainError, EXIT_CODES, failure } from "./domain/errors.js";
 import { MAX_SESSION_LIST_LIMIT, } from "./domain/session.js";
 import { EVIDENCE_MAX_DIFF_BYTES, EVIDENCE_MAX_DIFF_HUNKS, EVIDENCE_MAX_DIFF_PATHS } from "./repository-evidence.js";
+import { isResourceClaimMode } from "./resource-claims.js";
 import { createLocalSessionBackend } from "./domain/session-backend.js";
 import { defaultCliIO, renderFailure, renderSuccess } from "./presentation.js";
 import { MACHINE_CONTRACT_ID, MACHINE_CONTRACT_SCHEMA_VERSION, machineContract } from "./contract.js";
@@ -116,16 +117,76 @@ const HELP_COMMANDS = [
                 value: "<read|write|exclusive-write>",
                 required: true,
             }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-integer>",
+            }),
+            option("--force", "Explicitly permit unconditional complete replacement; mutually exclusive with --if-generation"),
             option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
             option("--repository", "Expected repository identity", { value: "<id>" }),
         ],
         notes: [
-            "The desired claim set fully replaces the session's current claims in one updateClaims() transaction; " +
-                "on any invalid or conflicting claim the prior set is left unchanged.",
+            "The desired claim set is a full replacement performed atomically in one updateClaims() transaction; " +
+                "use exactly one concurrency intent: --if-generation <non-negative-integer> for claim-set generation CAS, " +
+                "or explicit --force for unconditional replacement. On any invalid, conflicting, or stale claim the prior set is left unchanged.",
             "Each --resource must be immediately followed by its own --mode; pairing is positional adjacency, not flag order.",
             "Target grammar: optional first positional <session-id> is an alias for --session <id>; do not supply both.",
         ],
     },
+    {
+        name: "session mutate",
+        summary: "Atomically apply exact-resource claim additions, changes, and releases",
+        usage: `${CLI_NAME} session mutate [<session>|--session <id>] [--repository <id>] ` +
+            `(--upsert-resource <path-or-glob> --mode <read|write|exclusive-write> | --release-resource <path-or-glob>)+ ` +
+            `(--if-generation <non-negative-safe-int> | --force)`,
+        options: [
+            option("--upsert-resource", "Exact repository-relative resource to add or change; each occurrence must be immediately followed by --mode", { value: "<path-or-glob>" }),
+            option("--mode", "Mode for the immediately preceding --upsert-resource", {
+                value: "<read|write|exclusive-write>",
+            }),
+            option("--release-resource", "Exact repository-relative resource to release; repeatable", {
+                value: "<path-or-glob>",
+            }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-safe-int>",
+            }),
+            option("--force", "Explicitly permit unconditional atomic mutation; mutually exclusive with --if-generation"),
+            option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
+            option("--repository", "Expected repository identity", { value: "<id>" }),
+        ],
+        notes: [
+            "Apply one or more ordered upsert/release deltas in one backend transaction; exactly one concurrency intent is required.",
+            "Every --upsert-resource must be immediately followed by its own --mode; --release-resource takes exactly one value.",
+            "Target grammar: optional first positional <session> is an alias for --session <id>; do not supply both.",
+        ],
+    },
+    {
+        name: "session transition",
+        summary: "Atomically transition one exact resource claim mode",
+        usage: `${CLI_NAME} session transition [<session>|--session <id>] [--repository <id>] ` +
+            `--resource <path-or-glob> --mode <read|write|exclusive-write> ` +
+            `(--if-generation <non-negative-safe-int> | --force)`,
+        options: [
+            option("--resource", "Exact repository-relative resource to acquire or change", {
+                value: "<path-or-glob>",
+                required: true,
+            }),
+            option("--mode", "Target mode for the immediately preceding --resource", {
+                value: "<read|write|exclusive-write>",
+                required: true,
+            }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-safe-int>",
+            }),
+            option("--force", "Explicitly permit unconditional atomic mutation; mutually exclusive with --if-generation"),
+            option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
+            option("--repository", "Expected repository identity", { value: "<id>" }),
+        ],
+        notes: [
+            "Exactly one resource/mode pair is projected as one atomic upsert delta; same mode is an idempotent no-op.",
+            "Use exactly one concurrency intent: --if-generation <non-negative-safe-int> or explicit --force.",
+            "The target grammar accepts an optional first positional <session> or --session <id>, but not both.",
+        ],
+    },
     {
         name: "session claims",
         summary: "List canonical resource claims",
@@ -169,16 +230,76 @@ const HELP_COMMANDS = [
                 value: "<read|write|exclusive-write>",
                 required: true,
             }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-integer>",
+            }),
+            option("--force", "Explicitly permit unconditional complete replacement; mutually exclusive with --if-generation"),
             option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
             option("--repository", "Expected repository identity", { value: "<id>" }),
         ],
         notes: [
-            "The desired claim set fully replaces the session's current claims in one updateClaims() transaction; " +
-                "on any invalid or conflicting claim the prior set is left unchanged.",
+            "The desired claim set is a full replacement performed atomically in one updateClaims() transaction; " +
+                "use exactly one concurrency intent: --if-generation <non-negative-integer> for claim-set generation CAS, " +
+                "or explicit --force for unconditional replacement. On any invalid, conflicting, or stale claim the prior set is left unchanged.",
             "Each --resource must be immediately followed by its own --mode; pairing is positional adjacency, not flag order.",
             "Target grammar matches session update: optional first positional <session-id> is an alias for --session <id>; do not supply both.",
         ],
     },
+    {
+        name: "resource mutate",
+        summary: "Atomically apply exact-resource claim additions, changes, and releases (alias)",
+        usage: `${CLI_NAME} resource mutate [<session>|--session <id>] [--repository <id>] ` +
+            `(--upsert-resource <path-or-glob> --mode <read|write|exclusive-write> | --release-resource <path-or-glob>)+ ` +
+            `(--if-generation <non-negative-safe-int> | --force)`,
+        options: [
+            option("--upsert-resource", "Exact repository-relative resource to add or change; each occurrence must be immediately followed by --mode", { value: "<path-or-glob>" }),
+            option("--mode", "Mode for the immediately preceding --upsert-resource", {
+                value: "<read|write|exclusive-write>",
+            }),
+            option("--release-resource", "Exact repository-relative resource to release; repeatable", {
+                value: "<path-or-glob>",
+            }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-safe-int>",
+            }),
+            option("--force", "Explicitly permit unconditional atomic mutation; mutually exclusive with --if-generation"),
+            option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
+            option("--repository", "Expected repository identity", { value: "<id>" }),
+        ],
+        notes: [
+            "Apply one or more ordered upsert/release deltas in one backend transaction; exactly one concurrency intent is required.",
+            "Every --upsert-resource must be immediately followed by its own --mode; --release-resource takes exactly one value.",
+            "Target grammar matches session mutate: optional first positional <session> is an alias for --session <id>; do not supply both.",
+        ],
+    },
+    {
+        name: "resource transition",
+        summary: "Atomically transition one exact resource claim mode (alias)",
+        usage: `${CLI_NAME} resource transition [<session>|--session <id>] [--repository <id>] ` +
+            `--resource <path-or-glob> --mode <read|write|exclusive-write> ` +
+            `(--if-generation <non-negative-safe-int> | --force)`,
+        options: [
+            option("--resource", "Exact repository-relative resource to acquire or change", {
+                value: "<path-or-glob>",
+                required: true,
+            }),
+            option("--mode", "Target mode for the immediately preceding --resource", {
+                value: "<read|write|exclusive-write>",
+                required: true,
+            }),
+            option("--if-generation", "Expected claim-set generation for CAS; mutually exclusive with --force", {
+                value: "<non-negative-safe-int>",
+            }),
+            option("--force", "Explicitly permit unconditional atomic mutation; mutually exclusive with --if-generation"),
+            option("--session", "Target active session; omitted resolves the current owner", { value: "<id>" }),
+            option("--repository", "Expected repository identity", { value: "<id>" }),
+        ],
+        notes: [
+            "Exactly one resource/mode pair is projected as one atomic upsert delta; same mode is an idempotent no-op.",
+            "Use exactly one concurrency intent: --if-generation <non-negative-safe-int> or explicit --force.",
+            "The target grammar accepts an optional first positional <session> or --session <id>, but not both.",
+        ],
+    },
     {
         name: "resource list",
         summary: "List canonical resource claims (alias)",
@@ -203,14 +324,20 @@ const HELP_COMMANDS = [
     {
         name: "session close",
         summary: "Close the current or selected session",
-        usage: `${CLI_NAME} session close [<session-id>|--session <id>] [--integrated-revision <rev>]`,
+        usage: `${CLI_NAME} session close [<session-id>|--session <id>] [--integrated-revision <rev>] [--fetch-remote <name> --fetch-branch <branch>]`,
         options: [
             option("--session", "Select a session instead of the current worktree owner", { value: "<id>" }),
             option("--integrated-revision", "Externally evidenced revision proving non-ancestry (squash/rebase) integration; independently re-verified via exact Git tree-object equivalence, never trusted blindly", { value: "<rev>" }),
+            option("--fetch-remote", "Explicitly fetch one remote integration branch into a disposable proof ref", {
+                value: "<name>",
+            }),
+            option("--fetch-branch", "Integration branch to fetch; requires --fetch-remote", { value: "<branch>" }),
         ],
         notes: [
             "Ordinary ancestry-based close remains the cheap/default path and requires no flags.",
-            "Nawabari never queries GitHub or any remote provider; --integrated-revision only names a local revision for Nawabari to independently verify.",
+            "Network access is never implicit; --fetch-remote and --fetch-branch are accepted only with a full lowercase --integrated-revision SHA.",
+            "Fetch updates only a disposable internal proof ref with no tags, FETCH_HEAD, tracking-ref, or local integration-branch changes; remote tip races fail closed.",
+            "Nawabari never calls provider APIs such as GitHub; only explicit --fetch-remote/--fetch-branch options connect to the configured Git remote.",
             "Target grammar: optional first positional <session-id> is an alias for --session <id>; do not supply both.",
         ],
     },
@@ -392,7 +519,18 @@ function helpPayload(spec) {
             session_targeting: {
                 canonical: "--session <id>",
                 positional_alias: "<session-id> as the first argument after a session-scoped subcommand",
-                commands: ["show", "inspect", "claim", "claims", "release", "update", "close", "discard"],
+                commands: [
+                    "show",
+                    "inspect",
+                    "claim",
+                    "claims",
+                    "release",
+                    "update",
+                    "mutate",
+                    "transition",
+                    "close",
+                    "discard",
+                ],
                 ambiguity: "supplying both positional and --session is rejected",
                 discard_requires_explicit_target: true,
             },
@@ -532,6 +670,8 @@ function parseOptions(arguments_, allowed) {
         max_bytes: null,
         max_hunks: null,
         integrated_revision: null,
+        fetch_remote: null,
+        fetch_branch: null,
     };
     let dryRun = false;
     for (let index = 0; index < arguments_.length; index += 1) {
@@ -619,6 +759,10 @@ function parseOptions(arguments_, allowed) {
             options.max_hunks = value;
         else if (name === "--integrated-revision")
             options.integrated_revision = value;
+        else if (name === "--fetch-remote")
+            options.fetch_remote = value;
+        else if (name === "--fetch-branch")
+            options.fetch_branch = value;
     }
     if (options.apply && dryRun) {
         return failure(usageError("INVALID_ARGUMENT", "--apply and --dry-run cannot be used together."));
@@ -656,6 +800,213 @@ function parseTargetedOptions(arguments_, allowed, required = false) {
     }
     return parsed;
 }
+const CLAIM_CONCURRENCY_OPTION_NAMES = new Set(["--if-generation", "--force"]);
+function isClaimConcurrencyOption(name) {
+    return CLAIM_CONCURRENCY_OPTION_NAMES.has(name);
+}
+/** Shared #176 CAS/force option vocabulary and value consumption. */
+function consumeClaimConcurrencyOption(name, inlineValue, nextValue, state) {
+    if (name === "--force") {
+        if (inlineValue !== null) {
+            return failure(usageError("INVALID_ARGUMENT", "--force does not accept a value.", { option: name }));
+        }
+        if (state.force) {
+            return failure(usageError("INVALID_ARGUMENT", "--force may be supplied only once.", { option: name }));
+        }
+        return { ok: true, value: { state: { ...state, force: true }, consumed_next_value: false } };
+    }
+    const value = inlineValue ?? nextValue;
+    const negativeGeneration = /^-\d+$/u.test(value ?? "");
+    if (value === undefined || value === "" || (inlineValue === null && value.startsWith("-") && !negativeGeneration)) {
+        return failure(usageError("MISSING_ARGUMENT", `${name} requires a value.`, { option: name }));
+    }
+    if (state.expected_claim_set_generation !== null) {
+        return failure(usageError("INVALID_ARGUMENT", "--if-generation may be supplied only once.", { option: name }));
+    }
+    if (!/^\d+$/u.test(value)) {
+        return failure(usageError("INVALID_ARGUMENT", "--if-generation requires a non-negative safe integer.", {
+            option: name,
+            value,
+        }));
+    }
+    const parsedGeneration = Number(value);
+    if (!Number.isSafeInteger(parsedGeneration)) {
+        return failure(usageError("INVALID_ARGUMENT", "--if-generation requires a non-negative safe integer.", {
+            option: name,
+            value,
+        }));
+    }
+    return {
+        ok: true,
+        value: {
+            state: { ...state, expected_claim_set_generation: parsedGeneration },
+            consumed_next_value: inlineValue === null,
+        },
+    };
+}
+function finalizeClaimConcurrency(state, requireConcurrencyIntent) {
+    if (!requireConcurrencyIntent && (state.force || state.expected_claim_set_generation !== null)) {
+        return failure(usageError("INVALID_ARGUMENT", "session claim does not accept --if-generation or --force.", {
+            options: ["--if-generation", "--force"],
+        }));
+    }
+    if (requireConcurrencyIntent && state.force && state.expected_claim_set_generation !== null) {
+        return failure(usageError("INVALID_ARGUMENT", "Specify exactly one of --if-generation or --force, not both.", {
+            options: ["--if-generation", "--force"],
+        }));
+    }
+    if (requireConcurrencyIntent && !state.force && state.expected_claim_set_generation === null) {
+        return failure(usageError("MISSING_ARGUMENT", "Exactly one of --if-generation or --force is required.", {
+            options: ["--if-generation", "--force"],
+        }));
+    }
+    return { ok: true, value: state };
+}
+/**
+ * Parse the public atomic delta grammar without interpreting resource identity.
+ * Resource canonicalization, duplicate/conflict authority, and all mutation
+ * semantics remain in the domain/backend primitive.
+ */
+function parseClaimDeltaMutation(arguments_) {
+    const positional = splitPositionalSessionTarget(arguments_);
+    if (!positional.ok)
+        return positional;
+    let sessionId = positional.value.sessionId;
+    let repository = null;
+    const deltas = [];
+    let pendingUpsertResource = null;
+    let concurrencyState = {
+        expected_claim_set_generation: null,
+        force: false,
+    };
+    const recognized = new Set([
+        "--session",
+        "--repository",
+        "--upsert-resource",
+        "--mode",
+        "--release-resource",
+        ...CLAIM_CONCURRENCY_OPTION_NAMES,
+    ]);
+    const rejectPending = (name) => failure(usageError("INVALID_ARGUMENT", `${name} cannot appear between --upsert-resource and its --mode; only --mode is permitted immediately after --upsert-resource.`, { option: name }));
+    const targetArguments = positional.value.arguments;
+    for (let index = 0; index < targetArguments.length; index += 1) {
+        const { name, inlineValue } = optionParts(targetArguments[index]);
+        if (!recognized.has(name)) {
+            if (pendingUpsertResource !== null)
+                return rejectPending(name);
+            return failure(usageError("INVALID_ARGUMENT", `Unknown option: ${name}.`, { option: name }));
+        }
+        if (pendingUpsertResource !== null && name !== "--mode")
+            return rejectPending(name);
+        if (isClaimConcurrencyOption(name)) {
+            const consumed = consumeClaimConcurrencyOption(name, inlineValue, targetArguments[index + 1], concurrencyState);
+            if (!consumed.ok)
+                return consumed;
+            concurrencyState = consumed.value.state;
+            if (consumed.value.consumed_next_value)
+                index += 1;
+            continue;
+        }
+        const value = inlineValue ?? targetArguments[index + 1];
+        if (value === undefined || value === "" || (inlineValue === null && value.startsWith("-"))) {
+            return failure(usageError("MISSING_ARGUMENT", `${name} requires a value.`, { option: name }));
+        }
+        if (inlineValue === null)
+            index += 1;
+        if (name === "--session") {
+            if (sessionId !== null) {
+                return failure(usageError("INVALID_ARGUMENT", "Specify a session target either positionally or with --session, not both.", {
+                    option: "--session",
+                }));
+            }
+            sessionId = value;
+        }
+        else if (name === "--repository") {
+            repository = value;
+        }
+        else if (name === "--upsert-resource") {
+            pendingUpsertResource = value;
+        }
+        else if (name === "--release-resource") {
+            deltas.push({ kind: "release", resource: value });
+        }
+        else {
+            if (pendingUpsertResource === null) {
+                return failure(usageError("INVALID_ARGUMENT", "--mode must be immediately preceded by its own --upsert-resource.", {
+                    option: "--mode",
+                }));
+            }
+            if (!isResourceClaimMode(value)) {
+                return failure(usageError("INVALID_ARGUMENT", "--mode requires read, write, or exclusive-write.", {
+                    option: "--mode",
+                    value,
+                }));
+            }
+            deltas.push({
+                kind: "upsert",
+                resource: pendingUpsertResource,
+                mode: value,
+            });
+            pendingUpsertResource = null;
+        }
+    }
+    if (pendingUpsertResource !== null) {
+        return failure(usageError("MISSING_ARGUMENT", "--upsert-resource must be immediately followed by --mode.", {
+            option: "--mode",
+        }));
+    }
+    if (deltas.length === 0) {
+        return failure(usageError("MISSING_ARGUMENT", "At least one --upsert-resource or --release-resource is required.", {
+            options: ["--upsert-resource", "--release-resource"],
+        }));
+    }
+    const concurrency = finalizeClaimConcurrency(concurrencyState, true);
+    if (!concurrency.ok)
+        return concurrency;
+    return {
+        ok: true,
+        value: {
+            session_id: sessionId,
+            repository,
+            deltas,
+            expected_claim_set_generation: concurrency.value.expected_claim_set_generation,
+            force: concurrency.value.force,
+        },
+    };
+}
+/**
+ * Parse the one-resource transition convenience grammar. The underlying
+ * mutation remains the canonical multi-delta primitive; this parser only
+ * constrains its public projection to exactly one upsert pair.
+ */
+function parseClaimTransition(arguments_) {
+    const parsed = parseClaimReplacementPairs(arguments_);
+    if (!parsed.ok)
+        return parsed;
+    if (parsed.value.pairs.length !== 1) {
+        return failure(usageError("INVALID_ARGUMENT", "transition accepts exactly one --resource/--mode pair.", {
+            pair_count: parsed.value.pairs.length,
+        }));
+    }
+    const pair = parsed.value.pairs[0];
+    if (pair === undefined || !isResourceClaimMode(pair.mode)) {
+        return failure(usageError("INVALID_ARGUMENT", "--mode requires read, write, or exclusive-write.", {
+            option: "--mode",
+            value: pair?.mode ?? null,
+        }));
+    }
+    return {
+        ok: true,
+        value: {
+            session_id: parsed.value.session_id,
+            repository: parsed.value.repository,
+            resource: pair.resource,
+            mode: pair.mode,
+            expected_claim_set_generation: parsed.value.expected_claim_set_generation,
+            force: parsed.value.force,
+        },
+    };
+}
 /**
  * `update` accepts a complete desired claim set as repeated
  * `--resource <path> --mode <mode>` pairs. Pairing is by strict local
@@ -664,7 +1015,7 @@ function parseTargetedOptions(arguments_, allowed, required = false) {
  * parallel-array position, so argv order can never associate a resource
  * with the wrong mode.
  */
-function parseClaimReplacementPairs(arguments_) {
+function parseClaimReplacementPairs(arguments_, requireConcurrencyIntent = true) {
     const positional = splitPositionalSessionTarget(arguments_);
     if (!positional.ok)
         return positional;
@@ -672,16 +1023,34 @@ function parseClaimReplacementPairs(arguments_) {
     let repository = null;
     const pairs = [];
     let pendingResource = null;
+    let concurrencyState = {
+        expected_claim_set_generation: null,
+        force: false,
+    };
     sessionId = positional.value.sessionId;
     const targetArguments = positional.value.arguments;
     for (let index = 0; index < targetArguments.length; index += 1) {
         const { name, inlineValue } = optionParts(targetArguments[index]);
-        if (name !== "--session" && name !== "--repository" && name !== "--resource" && name !== "--mode") {
+        const isConcurrencyOption = isClaimConcurrencyOption(name);
+        if (name !== "--session" &&
+            name !== "--repository" &&
+            name !== "--resource" &&
+            name !== "--mode" &&
+            !(requireConcurrencyIntent && isConcurrencyOption)) {
             return failure(usageError("INVALID_ARGUMENT", `Unknown option: ${name}.`, { option: name }));
         }
         if (pendingResource !== null && name !== "--mode") {
             return failure(usageError("INVALID_ARGUMENT", `${name} cannot appear between --resource and its --mode; only --mode is permitted immediately after --resource.`, { option: name }));
         }
+        if (requireConcurrencyIntent && isConcurrencyOption) {
+            const consumed = consumeClaimConcurrencyOption(name, inlineValue, targetArguments[index + 1], concurrencyState);
+            if (!consumed.ok)
+                return consumed;
+            concurrencyState = consumed.value.state;
+            if (consumed.value.consumed_next_value)
+                index += 1;
+            continue;
+        }
         const value = inlineValue ?? targetArguments[index + 1];
         if (value === undefined || value === "" || (inlineValue === null && value.startsWith("-"))) {
             return failure(usageError("MISSING_ARGUMENT", `${name} requires a value.`, { option: name }));
@@ -714,7 +1083,19 @@ function parseClaimReplacementPairs(arguments_) {
     if (pairs.length === 0) {
         return failure(usageError("MISSING_ARGUMENT", "--resource requires a value.", { option: "--resource" }));
     }
-    return { ok: true, value: { session_id: sessionId, repository, pairs } };
+    const concurrency = finalizeClaimConcurrency(concurrencyState, requireConcurrencyIntent);
+    if (!concurrency.ok)
+        return concurrency;
+    return {
+        ok: true,
+        value: {
+            session_id: sessionId,
+            repository,
+            pairs,
+            expected_claim_set_generation: concurrency.value.expected_claim_set_generation,
+            force: concurrency.value.force,
+        },
+    };
 }
 /**
  * `claim` accepts exactly one `--resource`/`--mode` pair. Reuses the same
@@ -723,7 +1104,7 @@ function parseClaimReplacementPairs(arguments_) {
  * first pair (last-wins).
  */
 function parseSingleClaimPair(arguments_) {
-    const parsed = parseClaimReplacementPairs(arguments_);
+    const parsed = parseClaimReplacementPairs(arguments_, false);
     if (!parsed.ok)
         return parsed;
     if (parsed.value.pairs.length > 1) {
@@ -794,6 +1175,40 @@ function sessionContext(cwd) {
 async function resolveSelectedSession(backend, context, sessionId) {
     return sessionId === null ? backend.resolveCurrentSession(context) : backend.getSession(context, sessionId);
 }
+async function executeClaimDeltaMutation(arguments_, backend, context, operation) {
+    const parsed = parseClaimDeltaMutation(arguments_);
+    if (!parsed.ok)
+        return parsed;
+    if (backend.applyClaimDeltas === undefined)
+        return claimCapabilityUnavailable(operation);
+    const concurrency = parsed.value.force
+        ? { force: true }
+        : { expected_claim_set_generation: parsed.value.expected_claim_set_generation };
+    const result = await backend.applyClaimDeltas(context, {
+        session_id: parsed.value.session_id,
+        repository: parsed.value.repository,
+        deltas: parsed.value.deltas,
+        ...concurrency,
+    });
+    return result.ok ? { ok: true, value: result.value } : result;
+}
+async function executeClaimTransition(arguments_, backend, context, operation) {
+    const parsed = parseClaimTransition(arguments_);
+    if (!parsed.ok)
+        return parsed;
+    if (backend.applyClaimDeltas === undefined)
+        return claimCapabilityUnavailable(operation);
+    const concurrency = parsed.value.force
+        ? { force: true }
+        : { expected_claim_set_generation: parsed.value.expected_claim_set_generation };
+    const result = await backend.applyClaimDeltas(context, {
+        session_id: parsed.value.session_id,
+        repository: parsed.value.repository,
+        deltas: [{ kind: "upsert", resource: parsed.value.resource, mode: parsed.value.mode }],
+        ...concurrency,
+    });
+    return result.ok ? { ok: true, value: result.value } : result;
+}
 async function executeCommand(commandArguments, dependencies) {
     const [command, subcommand, ...rest] = commandArguments;
     const context = sessionContext(dependencies.cwd);
@@ -820,6 +1235,9 @@ async function executeCommand(commandArguments, dependencies) {
                 return parsed;
             if (dependencies.backend.updateClaims === undefined)
                 return claimCapabilityUnavailable(subcommand);
+            const concurrency = parsed.value.force
+                ? { force: true }
+                : { expected_claim_set_generation: parsed.value.expected_claim_set_generation };
             const result = await dependencies.backend.updateClaims(context, {
                 session_id: parsed.value.session_id,
                 repository: parsed.value.repository,
@@ -827,9 +1245,16 @@ async function executeCommand(commandArguments, dependencies) {
                     resource: pair.resource,
                     mode: pair.mode,
                 })),
+                ...concurrency,
             });
             return result.ok ? { ok: true, value: result.value } : result;
         }
+        if (subcommand === "mutate") {
+            return executeClaimDeltaMutation(rest, dependencies.backend, context, "session mutate");
+        }
+        if (subcommand === "transition") {
+            return executeClaimTransition(rest, dependencies.backend, context, "session transition");
+        }
         if (subcommand === "claims") {
             const parsed = parseTargetedOptions(rest, new Set(["--session"]));
             if (!parsed.ok)
@@ -848,6 +1273,7 @@ async function executeCommand(commandArguments, dependencies) {
             const result = await dependencies.backend.releaseClaims(context, {
                 session_id: parsed.value.session_id,
                 claim_ids: parsed.value.claim_id === null ? null : [parsed.value.claim_id],
+                force: true,
             });
             return result.ok ? { ok: true, value: result.value } : result;
         }
@@ -922,13 +1348,27 @@ async function executeCommand(commandArguments, dependencies) {
                     return selected;
                 return { ok: true, value: { session_id: selected.value.session_id } };
             }
-            const parsed = parseTargetedOptions(rest, new Set(subcommand === "close" ? ["--session", "--integrated-revision"] : ["--session"]));
+            const parsed = parseTargetedOptions(rest, new Set(subcommand === "close"
+                ? ["--session", "--integrated-revision", "--fetch-remote", "--fetch-branch"]
+                : ["--session"]));
             if (!parsed.ok)
                 return parsed;
             if (subcommand === "close") {
+                const hasFetchRemote = parsed.value.fetch_remote !== null;
+                const hasFetchBranch = parsed.value.fetch_branch !== null;
+                if (hasFetchRemote !== hasFetchBranch) {
+                    return failure(usageError("INVALID_ARGUMENT", "--fetch-remote and --fetch-branch must be supplied together for an explicit integration fetch."));
+                }
+                if ((hasFetchRemote || hasFetchBranch) && parsed.value.integrated_revision === null) {
+                    return failure(usageError("MISSING_ARGUMENT", "Explicit integration fetch requires --integrated-revision <full-sha>.", {
+                        option: "--integrated-revision",
+                    }));
+                }
                 const closeOptions = {
                     session_id: parsed.value.session_id,
                     integrated_revision: parsed.value.integrated_revision,
+                    fetch_remote: parsed.value.fetch_remote,
+                    fetch_branch: parsed.value.fetch_branch,
                 };
                 const selected = await dependencies.backend.closeSession(context, closeOptions);
                 return selected.ok ? { ok: true, value: selected.value } : selected;
@@ -969,6 +1409,9 @@ async function executeCommand(commandArguments, dependencies) {
                 return parsed;
             if (dependencies.backend.updateClaims === undefined)
                 return claimCapabilityUnavailable(resourceSubcommand);
+            const concurrency = parsed.value.force
+                ? { force: true }
+                : { expected_claim_set_generation: parsed.value.expected_claim_set_generation };
             const result = await dependencies.backend.updateClaims(context, {
                 session_id: parsed.value.session_id,
                 repository: parsed.value.repository,
@@ -976,9 +1419,16 @@ async function executeCommand(commandArguments, dependencies) {
                     resource: pair.resource,
                     mode: pair.mode,
                 })),
+                ...concurrency,
             });
             return result.ok ? { ok: true, value: result.value } : result;
         }
+        if (resourceSubcommand === "mutate") {
+            return executeClaimDeltaMutation(rest, dependencies.backend, context, "resource mutate");
+        }
+        if (resourceSubcommand === "transition") {
+            return executeClaimTransition(rest, dependencies.backend, context, "resource transition");
+        }
         if (resourceSubcommand === "list" || resourceSubcommand === "claims") {
             const parsed = parseTargetedOptions(rest, new Set(["--session"]));
             if (!parsed.ok)
@@ -997,6 +1447,7 @@ async function executeCommand(commandArguments, dependencies) {
             const result = await dependencies.backend.releaseClaims(context, {
                 session_id: parsed.value.session_id,
                 claim_ids: parsed.value.claim_id === null ? null : [parsed.value.claim_id],
+                force: true,
             });
             return result.ok ? { ok: true, value: result.value } : result;
         }