pm-github 2026.10.14 → 2026.10.16

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2026.10.16 - 2026-10-16
+
+### Added
+
+- Add a reusable gated closeout PR workflow ([pm-github-0x3y](https://github.com/unbraind/pm-github/blob/main/.agents/pm/tasks/pm-github-0x3y.toon))
+- Let reusable sync choose its npm project directory ([pm-github-z5z1](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-z5z1.toon))
+
+### Fixed
+
+- Refuse reusable sync runs outside the caller default branch ([pm-github-q4uz](https://github.com/unbraind/pm-github/blob/main/.agents/pm/issues/pm-github-q4uz.toon))
+
+## 2026.10.15 - 2026-10-15
+
+### Added
+
+- Close pm items delivered by merged pull requests with verifiable GitHub evidence ([pm-github-t4i2](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-t4i2.toon))
+- Regenerate caller changelogs and dispatch required CI for gated sync PRs ([pm-github-wrmt](https://github.com/unbraind/pm-github/blob/main/.agents/pm/features/pm-github-wrmt.toon))
+
 ## 2026.10.14 - 2026-10-14
 
 ### Added

package/README.md

@@ -17,6 +17,109 @@ pm install npm:pm-github --global
 > `github.com/unbraind/pm-github` source cannot work either — pm copies a GitHub
 > source as-is without building it, and this repository does not commit `dist/`.
 
+## Close items delivered by merged pull requests
+
+Agents can use `pm github closeout` to replace manual post-merge tracker cleanup.
+It resolves `--repo` or `PM_GITHUB_REPO` through the existing
+repository resolver, and uses the normal `GITHUB_TOKEN` / `GH_TOKEN` / `gh auth`
+token resolution. Use repeatable `--pr` numbers **or** `--since` with an ISO date
+or timestamp including a timezone. `--since` selects merge times inclusively,
+drains the closed-PR listing, and verifies each selected PR individually.
+
+```sh
+# Agent: inspect the plan first. No tracker writes happen by default.
+pm github closeout --repo owner/repo --pr 42 --pr 43 --skip pm-deferred --json
+# Apply the reviewed selection; repeatable --skip always excludes those ids.
+pm github closeout --repo owner/repo --pr 42 --pr 43 --skip pm-deferred --apply
+# Incremental sweep, including merges exactly at the cutoff.
+PM_GITHUB_REPO=owner/repo pm github closeout --since 2026-10-01T00:00:00Z --json
+```
+
+Only `https://github.com/owner/repo/blob/main/.agents/pm/<folder>/<id>.toon`
+links in PR bodies are recognized. Percent-encoded names and nested SDK tracker
+folders are supported; malformed encodings and traversal segments are ignored. Repository comparisons ignore case. Links to
+other repositories, unknown ids, closed/canceled items and `--skip` ids produce
+explicit skip rows. Bare ids and `pm:` trailers are not supported. If several
+selected PRs reference one item, the lowest PR number supplies its evidence and
+later references are skipped.
+
+**A mention is not delivery.** PR bodies routinely link follow-ups, epics and
+related work for context, so a link alone never closes an item. An item is
+closed only when:
+
+- it is `in_progress` (claimed work), **or** its link is preceded on the same
+  line by a GitHub-style closing keyword: `Closes`, `Fixes`, `Resolves` or
+  `Delivers` (and their tense forms), for example `- Closes [pm-x](…/pm-x.toon)`;
+- it is not an `Epic`; epics close when their children are done;
+- it has no non-terminal child items.
+
+Each refused item gets a skip row naming the rule, so the plan shows why
+deferred follow-ups stay open. `--skip` still excludes any id unconditionally. Items are read through a certified complete SDK
+corpus, including terminal items.
+
+A PR must be merged and have complete merge facts. Required head checks from
+classic branch protection and active branch rulesets must conclude **success**;
+missing, pending, neutral, skipped, failed or app-mismatched required checks
+prevent closure. Required legacy commit-status contexts must succeed too, using their
+latest status. Check-run, status and ruleset pages are fully read. Rulesets are
+read through GitHub's [effective branch rules API](https://docs.github.com/en/rest/repos/rules#get-rules-for-a-branch).
+The check policy reflects the rules readable at invocation time.
+
+When a protection source is unreadable (HTTP 403/404), or no required contexts
+are configured, the report labels the **fallback** rule. Every readable required
+context still must conclude success, including its app binding. The fallback
+additionally requires at least one head check run, every run completed with
+`success`, `neutral` or `skipped`, and successful latest legacy head statuses.
+It never discards a known requirement because another source is unreadable.
+Missing, malformed or incomplete head evidence, malformed metadata and other
+metadata errors fail closed. The plan reports which rule was used.
+
+TOON lists actionable `close`/`refuse` rows individually and summarizes routine skips
+as counts by stable code, for example `skipped: {already_terminal: 30,
+other_repository: 10, duplicate_selection: 5}`. Explicit exclusions use
+`explicit_skip`. Only checks for actionable rows are shown. Use `--full` for every
+plan row and selected PR check. Global `--json` always returns the full shape
+`{command, repo, dry_run, plan, checks, closed, failed}`. Each full plan row is
+`{item, pr, action: "close" | "skip", code, reason}`. Codes distinguish
+`head_evidence_unavailable`, `incomplete_merge`, `head_checks_failed`, and
+`head_checks_passed` without parsing explanations. `checks` reports each PR's rule,
+verdict, explanation and successful check names. Dry-run rows describe intended
+closes; `closed` counts writes only with `--apply`. `--dry-run` overrides
+`--apply`. All API planning finishes before the first SDK close. Individual SDK
+refusals become skip rows containing a diagnostic code (or a generic failure
+class), without raw error prose, paths or lock-owner identities. Remaining
+closes continue; `failed` counts refused writes and `closed` counts successful
+writes. After processing everything, any failed close produces a `CommandError`
+with exit code 1 and the complete JSON report in its message. Eligibility skips
+alone do not fail the command. Inspect the report before retrying.
+
+The SDK close reason is a JSON string containing **only** verified facts:
+`{pr, url, merge_commit_sha, head_sha, merged_at, checks}`. `checks` contains the
+sorted unique names that actually succeeded at that head; neutral/skipped runs
+are not described as passed. PR body, title and comments are never persisted.
+For both default and strict close validation, the SDK always receives the three
+structured close fields it supports, without overriding tracker policy:
+
+- `resolution`: `Delivered by <PR URL> (merge <sha12>, head <sha12>)`.
+- `expected_result`: the item's own acceptance criteria verbatim when present;
+  otherwise `Delivered by the linked pull request, merged after its head check gate passed.`
+- `actual_result`: `Merged at <time>; required checks satisfied; successful head checks:
+  <names>` when branch protection or rulesets name required checks (the list holds every
+  successful head check, optional ones included). Under the fallback rule (no readable
+  required contexts) it reads `Merged at <time>; no readable required checks, so every
+  completed head check run had to succeed, be neutral or be skipped; successful checks:
+  <names>`, or `…; no check reported success` when only neutral or skipped runs exist.
+  Only the verified merge time, the applied check policy and sorted successful check
+  names are used; no platform, coverage or test-execution claims are made.
+
+Item titles never supply any of these fields. Existing tracker acceptance
+criteria remain the only prose source; PR body and comments supply no field text.
+Completion time is the GitHub merge time. Repeating a completed selection skips
+terminal items and performs zero additional tracker writes. The command edits
+only the tracker; commit it with its history and regenerate the caller's
+changelog in a closeout PR. The [automated closeout workflow](#automated-closeout-workflow)
+performs that daily review-PR preparation for fleet repositories.
+
 ## Revalidate GitHub blockers
 
 **Compatibility:** pm-github now requires PM CLI 2026.10.5 or newer for complete
@@ -69,7 +172,7 @@ containing this command before adopting the updated workflow.
 |---|---|
 | `importers` | `pm github import <owner/repo>` — idempotent native import pipeline |
 | `importers` (exporter) | `pm github export` — pm items → GitHub issues (dry-run by default; upsert) |
-| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github project list\|fields\|import\|sync` (Projects v2) |
+| `commands` | `pm gh-issues import` (legacy import alias), `pm github sync` (push status), `pm github gate` (fail-closed pre-push privacy gate), `pm github validate` (diagnostics), `pm github closeout` (verified merged-PR delivery), `pm github project list\|fields\|import\|sync` (Projects v2) |
 | `schema` | declares `github_url`, `github_number`, `github_state`, `github_author`, `github_created_at`, `github_updated_at` item fields |
 | `hooks` | `afterCommand` — opt-in sync reminder (`PM_GITHUB_SYNC`) for linked items |
 | `preflight` | early warning when a mutating github command lacks a token |
@@ -347,9 +450,94 @@ Rendered values are also scanned in memory before mutation, so a known finding c
 
 The `gate` receipt reports the verdict, scanned file count, findings, and allowlisted count. With `--json`, successful reports go to stdout; failures use the host CLI's JSON error envelope on stderr, with the redacted gate report serialized in `detail` (`jq ' .detail | fromjson ' gate-error.json`). Unreadable inputs produce a nonzero JSON refusal.
 
+## Automated closeout workflow
+
+[`.github/workflows/pm-github-closeout.yml`](.github/workflows/pm-github-closeout.yml)
+is a reusable `workflow_call` that opens or updates **one** PR titled
+`chore(pm): close items delivered by merged pull requests` from `pm-github/closeout`.
+Copy [the caller template](docs/closeout-workflow-caller.yml) into the caller's
+workflows directory and replace `RELEASE_COMMIT_SHA` and `RELEASE_VERSION` with a
+reviewed workflow commit and an exact published pm-github version containing
+`github closeout`. The template schedules a daily run and allows manual dispatch.
+Adopting callers is a separate change; the existing sync workflow is unchanged.
+
+The workflow resolves the caller's default branch through the repository API,
+with event metadata as fallback, and refuses other run refs before checkout.
+This works for scheduled payloads without a `repository` object and for branches
+such as `trunk` or `release/stable`. The caller's pinned PM CLI comes from
+`npm ci --ignore-scripts` in `npm-project-dir` (default `.`), which must resolve
+inside the workspace and contain `package.json`. The SDK resolves the tracker
+from the repository root. The exact `pm-github-version` is installed and verified.
+
+Each run rebuilds the bot branch from the current default branch and invokes
+`pm github closeout --since 1970-01-01 --apply --json`. Scanning all merge history
+avoids losing deliveries during schedule outages; it costs more API reads for
+large repositories. Terminal items are skipped and the command retains its
+normal eligibility, child/epic, required-check and strict-close rules. Full
+closeout reports stay in runner scratch storage. The PR body lists
+actionable rows with item, PR number, action and code, plus skip counts by reason.
+This compact summary passes its own privacy scan before publication. The caller's `post-closeout-script` defaults to `changelog:full`,
+run through `npm run --if-present` in the npm project; empty disables it.
+The script must emit the root `CHANGELOG.md` and remain inside the publication scope.
+
+| Safety boundary | Closeout and sync parity |
+| --- | --- |
+| Entry and install | Caller default-branch guard, contained npm project, exact package version, SHA-pinned Actions, no persisted checkout credentials |
+| Proposed publication | SDK-resolved tracker plus root changelog; setup, extension, lock and checkpoint files excluded; every changed path checked |
+| Privacy | Same fail-closed full-context staged-diff scan after the caller script and immediately before commit; unreadable input refuses publication |
+| Validation | Strict PM health; explicit item/history scope committed together |
+| Branch and PR | Explicit force-with-lease against the observed bot ref; push only bot branch; owned PR lookup excludes forks |
+| No-op | Zero closes or no tracker diff creates no remote branch or PR; caller-only drift unpublished; stale owned PR closed |
+| CI | Caller workflow dispatch after PR create/update; parked approval-required runs reported; no merge |
+
+`ci-workflows` defaults to `ci.yml`; use whitespace-separated filenames for every
+required caller CI workflow. Each must support `workflow_dispatch` and produce
+its required checks on that event. Missing files are skipped with a notice,
+matching sync; empty disables dispatch. CI dispatch starts checks; it does not
+certify that they passed. Review and required-check enforcement remain with the
+caller's protected branch. A repository concurrency group serializes closeout
+runs, and the explicit lease rejects competing writers.
+
+The caller grants only `contents: write`, `pull-requests: write`, `checks: read`
+and `actions: write`. Closeout uses `checks: read` instead of sync's `issues: read`
+to retrieve head-check evidence ([GitHub Checks API permissions](https://docs.github.com/en/rest/checks/runs#list-check-runs-for-a-git-reference)).
+The reusable workflow cannot elevate the caller's token
+permissions ([GitHub reusable workflow permissions](https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations)).
+Repository Actions settings must allow Actions to create PRs. Read denial stops
+closeout before push with a diagnostic, including unavailable head-check evidence
+reported by the command as a skip when it blocks a local, existing, non-terminal,
+non-excluded tracker item. Unlinked PRs and foreign/terminal/excluded links do
+not fail the run for unavailable evidence. Incomplete merge facts use a separate
+`incomplete_merge` refusal before any head lookup. The pinned extension must
+emit plan decision codes; repin to a release containing this contract. A push/PR denial fails publication and
+CI dispatch denial fails the job explicitly. A PR creation denial may leave the
+gated bot branch pushed, and a dispatch denial leaves the review PR open; neither
+case changes the default branch or merges anything. Explicit dispatch is used
+for reliable caller CI invocation with `GITHUB_TOKEN`
+([GitHub token event behavior](https://docs.github.com/en/actions/concepts/security/github_token)).
+
 ## Automated sync workflow
 
-Fleet repos sync their issues into pm through ONE audited implementation: the reusable `workflow_call` workflow at [`.github/workflows/pm-github-sync.yml`](.github/workflows/pm-github-sync.yml) in this repository. It runs the gated pipeline in fail-closed order — checkout → install the **pinned** extension → `pm github validate` → dry-run plan → **gated import** → verify the repeat import is a no-op → `pm health --strict-exit` → and only then commit, push the sync branch, and open/update a review PR whose body links every changed item as `https://github.com/<repo>/blob/main/.agents/pm/<folder>/<id>.toon`. Because `--gate` exits non-zero on any finding, the job can never reach the push step with a leak in the change. Actions are pinned by commit SHA; permissions are least-privilege (`contents: write`, `pull-requests: write`, `issues: read`).
+The reusable workflow's first step resolves the caller's default branch using the repository API with the job token, falling back to `github.event.repository.default_branch` only when present. Scheduled payloads need no `repository` object. If neither source provides a valid branch, the job fails closed with a clear error before checkout. It requires `github.ref` to equal `refs/heads/<resolved-default-branch>`. A mismatch fails before checkout or any sync operation with a one-line error naming both refs. Scheduled calls and manual `workflow_dispatch` calls on the default branch are accepted; manual dispatches selecting another branch are refused. Checkout, sync-branch preparation, PR lookup/base and tracker links all use that resolved branch, including defaults such as `trunk` or `release/stable`. Callers need no guard of their own. Repin the reusable workflow to a release commit containing this guard to receive it.
+
+Fleet repos sync their issues into pm through ONE audited implementation: the reusable `workflow_call` workflow at [`.github/workflows/pm-github-sync.yml`](.github/workflows/pm-github-sync.yml). Its safety order is validate → dry-run plan → **gated import** → verify the repeat import is a no-op → caller post-import script → **full changed-path scope check and privacy gate** → strict health → repeat scope check and scan immediately before commit/push/review PR → caller CI dispatch. The default `post-import-script` is `changelog:full`, invoked with `npm run --if-present`: it runs the caller's own generator when present, so imported closed issues and their changelog entries land in the same commit. Actions are pinned by commit SHA. The job requests `contents: write`, `pull-requests: write`, `issues: read`, and `actions: write` for dispatch.
+
+When the tracker has no changes, regenerated `CHANGELOG.md` drift is discarded and the run emits a notice that the caller's own `changelog:check` owns that drift. The sync closes any owned open review PR and exits successfully without pushing or dispatching CI. Changelog changes are published only together with tracker changes.
+
+The explicit allowed scope for changed paths is:
+
+- Files beneath the SDK-resolved repository-local pm tracker, excluding its `extensions/`, `locks/`, and `checkpoints/` runtime directories. The extension setup files `settings.json` and `history/_workspace.jsonl` are permitted during setup, then restored before publication and excluded from both the scan and commit.
+- The repository-root `CHANGELOG.md`.
+
+After the caller script and again immediately before committing, `git status --porcelain=v1 -z --untracked-files=all` enumerates staged, unstaged, and untracked changes, including both sides of renames. Every path outside this list produces an error and prevents publication. Allowed changes are staged and the privacy gate scans the exact NUL-delimited path list passed to `git commit --only --pathspec-from-file` with literal pathspecs. The final scan is regenerated from current content; any finding, unreadable input, or script failure prevents publication. The restricted commit also excludes unrelated staged content if a scope check is bypassed.
+
+Optional inputs:
+
+| Input | Default | Behavior |
+| --- | --- | --- |
+| `npm-project-dir` | `.` | Relative npm project directory for `npm ci --ignore-scripts`, the CLI `node_modules/.bin` PATH entry, and `post-import-script`. Must have `package.json`, contain no `..` segments, and resolve inside the workspace (including symlinks); invalid paths fail before caching/install. The tracker and publication scope stay at the repository root. |
+| `post-import-script` | `changelog:full` | Caller npm script name invoked with `npm run --if-present` after import and before the final scan. Override for a different package script, or set `""` to disable. Missing scripts are skipped. Raw shell commands are not accepted. Generated `CHANGELOG.md` is staged with the tracker. Changing any file outside the documented scope fails the run, whether staged, unstaged, or untracked. |
+| `ci-workflows` | `ci.yml` | Whitespace-separated filenames in the caller's `.github/workflows`, for example `ci.yml codeql.yml`. Missing files emit a notice and are skipped; set `""` to disable dispatch. Existing workflows must enable `workflow_dispatch`; dispatch errors fail the sync job. |
 
 A fleet repo owns the schedule and calls it with the pinned versions (see [`docs/sync-workflow-caller.yml`](docs/sync-workflow-caller.yml)):
 
@@ -364,6 +552,7 @@ permissions:
   contents: write
   pull-requests: write
   issues: read
+  actions: write
 
 jobs:
   gated-sync:
@@ -372,7 +561,15 @@ jobs:
       pm-github-version: "RELEASE_VERSION"     # required: exact published version
 ```
 
-Replace the two release placeholders after the gated extension is published; the current published version does not contain this feature. The calling repo needs `@unbrained/pm-cli` as a devDependency (the workflow's `npm ci` provides the CLI) and its pm tracker at `.agents/pm` committed on `main`. Under **Settings → Actions → General → Workflow permissions** it must also allow read and write token permissions and enable **Allow GitHub Actions to create and approve pull requests** (an organization can disable this), or the run pushes the sync branch and then fails to open the review PR. A PR that `GITHUB_TOKEN` opens or edits does not trigger `pull_request` workflows, so the sync PR gets no CI checks until a maintainer re-runs them (for example by closing and reopening the PR); the reusable workflow always uses the job's `GITHUB_TOKEN`.
+Replace the two release placeholders with the release commit and package version containing this change; existing callers must repin both. The selected npm project needs a committed npm lockfile (`package-lock.json` or `npm-shrinkwrap.json`) and `@unbrained/pm-cli` as a devDependency (the workflow's `npm ci` provides the CLI) and its pm tracker at `.agents/pm` committed on the caller's default branch. Under **Settings → Actions → General → Workflow permissions** it must allow read and write token permissions and enable **Allow GitHub Actions to create and approve pull requests** (an organization can disable this), or the run pushes the sync branch and then fails to open the review PR. The caller must grant `actions: write`; a reusable workflow cannot elevate its caller's permissions.
+
+For a caller such as `unbraind/pm-rust` with no root `package.json`, add
+`npm-project-dir: tests/oracle` under `with:`. Its `tests/oracle/package.json`
+provides the CLI and post-import npm script; Git and pm tracker operations still
+run from the repository root. A script that regenerates the changelog must write
+the repository-root `CHANGELOG.md` to stay within the publication allowlist.
+
+Bot-created review PRs may have missing required checks or `pull_request` runs parked in `action_required`. After a successful push and PR creation/update, the reusable workflow uses the job's `GITHUB_TOKEN` to run `gh workflow run <file> --ref "$SYNC_BRANCH"` for each configured caller CI workflow. Explicit `workflow_dispatch` creates runs on the sync head, so callers must enable that trigger and ensure those runs produce their required check names (and do not restrict the required jobs to the `pull_request` event). It also lists `action_required` runs for the exact pushed SHA and prints their URLs as notices without failing because approval is needed. Missing workflows, disabled dispatch, or approval notices do not establish that required CI passed; inspect the dispatched checks. A no-change sync closes its stale own review PR and dispatches nothing. See GitHub's [GITHUB_TOKEN event rules](https://docs.github.com/en/actions/concepts/security/github_token) and [dispatch trigger and permission requirements](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event).
 
 ### Installed CLI timeout acceptance
 

package/dist/closeout.d.ts

@@ -0,0 +1,104 @@
+/** Existing GitHub REST transport, supplied by the extension entry point. */
+export interface CloseoutApi {
+    base: string;
+    get(url: string): Promise<{
+        body: string;
+        linkHeader?: string;
+    }>;
+    next(link?: string): string | undefined;
+}
+/** Stable machine-readable decision; reasons never quote pull-request prose. */
+export interface CloseoutRow {
+    item: string;
+    pr: number;
+    action: "close" | "skip";
+    reason: string;
+    code: CloseoutCode;
+}
+/** Stable decisions used by automation and compact skip counts. */
+export type CloseoutCode = "already_terminal" | "other_repository" | "duplicate_selection" | "explicit_skip" | "unknown_item" | "epic" | "active_children" | "not_delivery" | "close_failed" | "head_checks_passed" | "head_checks_failed" | "head_evidence_unavailable" | "incomplete_merge";
+/** Which head-check policy was evaluated for one selected pull request. */
+interface CheckGate {
+    pr: number;
+    code: CloseoutCode;
+    rule: "required" | "fallback" | "unavailable";
+    reason: string;
+    passed: string[];
+    ok: boolean;
+}
+/** Fields retained from a pull request; its body is used only for extraction. */
+interface PullRequest {
+    number: number;
+    body: string | null;
+    merged: boolean;
+    merged_at: string | null;
+    merge_commit_sha: string | null;
+    html_url: string;
+    head: {
+        sha: string;
+    };
+    base: {
+        ref: string;
+        repo: {
+            full_name: string;
+        };
+    };
+}
+/** Verify required checks or the explicitly reported conservative fallback at the PR head. */
+export declare function checkCloseoutHead(api: CloseoutApi, repo: string, pr: PullRequest): Promise<CheckGate>;
+/**
+ * Whether a closing keyword directly precedes a link, given the line text before the link.
+ *
+ * Only earlier links (markdown or bare), commas and "and" may sit between the keyword and the link, so
+ * `Delivers [a](…) and [b](…)` declares both while `Not fixed here; see <link>` declares nothing.
+ * Scans backwards with plain string operations; no backtracking pattern touches PR text.
+ */
+export declare function declaresDelivery(prefix: string): boolean;
+/** Extract only canonical tracker links, retaining foreign references solely for skip rows. */
+export declare function extractCloseoutItems(body: string): {
+    item: string;
+    repo: string;
+    declared: boolean;
+}[];
+/** Report SDK refusal codes without exposing paths, identities or arbitrary error prose. */
+export declare function closeoutFailureReason(error: unknown): string;
+/** Invalid selectors or repository input: the caller must change the command, so the host maps it to a usage exit. */
+export declare class CloseoutUsageError extends Error {
+}
+/**
+ * Describe the verified check evidence for a passed gate without overstating it.
+ *
+ * The required rule states that the required checks were satisfied and lists every successful head check (optional
+ * ones included). The fallback rule (no readable required contexts)
+ * may pass on neutral or skipped runs alone, so it states that policy and lists successful checks only when any exist.
+ */
+export declare function checkEvidence(gate: CheckGate): string;
+/** Plan all selected PRs before closing eligible items through the real SDK. */
+export declare function runCloseout(pmRoot: string, repo: string | undefined, options: Record<string, unknown>, api: CloseoutApi): Promise<{
+    command: string;
+    repo: string;
+    dry_run: boolean;
+    plan: CloseoutRow[];
+    checks: CheckGate[];
+    closed: number;
+    failed: number;
+}>;
+/** Keep actionable decisions and their checks while counting routine skips by stable code. */
+export declare function compactCloseoutReport(report: Awaited<ReturnType<typeof runCloseout>>): {
+    command: string;
+    repo: string;
+    dry_run: boolean;
+    closed: number;
+    failed: number;
+    plan: {
+        item: string;
+        pr: number;
+        reason: string;
+        code: CloseoutCode;
+        action: string;
+    }[];
+    skipped: Partial<Record<CloseoutCode, number>>;
+    checks: CheckGate[];
+};
+export {};
+//# sourceMappingURL=closeout.d.ts.map

package/dist/closeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"closeout.d.ts","sourceRoot":"","sources":["../closeout.ts"],"names":[],"mappings":"AAGA,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,eAAe,GACxG,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,cAAc,GAAG,cAAc,GAC7E,oBAAoB,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,kBAAkB,CAAC;AAEnG,2EAA2E;AAC3E,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,aAAa,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACb;AAED,iFAAiF;AACjF,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD;AA8ID,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAgD3G;AAQD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAuBxD;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,EAAE,CAuBtG;AAQD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED,sHAAsH;AACtH,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAOhD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAKrD;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW;;;;;;;;GA0F7H;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;;;;;;;cAra7E,MAAM;YACR,MAAM;gBAEF,MAAM;cACR,YAAY;;;;;EA4anB"}