prismatica 0.2.0

package/dist/commands/amend.js

@@ -0,0 +1,158 @@
+/**
+ * `amend` — change a contract's scope WITH an audited reason. It never touches
+ * the baseline (no re-baselining mid-change), it appends to the amendments log,
+ * and by changing the scope it invalidates the prior pack and any seal (their
+ * hashes/patch-ids no longer match). A change amended 3+ times is flagged.
+ */
+import { resolveChangeHome } from '../change.js';
+import { loadConfig } from '../config.js';
+import { UserError } from '../errors.js';
+import { isAgentExecutor } from '../executor.js';
+import * as git from '../git.js';
+import { installScopeHook } from '../claudehook.js';
+import { ContractSchema } from '../records/types.js';
+import { contractExists, readContract, writeContract } from '../records/store.js';
+import { renderContractBody } from '../render.js';
+import * as ui from '../ui.js';
+function describe(changes) {
+    const parts = [];
+    if (changes.tier) {
+        parts.push(`tier → ${changes.tier}`);
+    }
+    if (changes.addAllow?.length) {
+        parts.push(`allow += ${changes.addAllow.join(', ')}`);
+    }
+    if (changes.addForbid?.length) {
+        parts.push(`forbid += ${changes.addForbid.join(', ')}`);
+    }
+    if (changes.addNonGoal?.length) {
+        parts.push(`non-goals += ${changes.addNonGoal.join(', ')}`);
+    }
+    if (changes.addChecks?.length) {
+        parts.push(`checks += ${changes.addChecks.map((check) => check.id).join(', ')}`);
+    }
+    if (changes.addDocs?.length) {
+        parts.push(`docs += ${changes.addDocs.join(', ')}`);
+    }
+    return parts.join('; ');
+}
+function hasAnyChange(changes) {
+    return Boolean(changes.tier ||
+        changes.addAllow?.length ||
+        changes.addForbid?.length ||
+        changes.addNonGoal?.length ||
+        changes.addChecks?.length ||
+        changes.addDocs?.length);
+}
+export async function runAmend(options) {
+    const mainRoot = await git.mainRepoRoot(options.cwd);
+    loadConfig(mainRoot);
+    const home = await resolveChangeHome(options.cwd, options.contractId);
+    if (options.reason.trim() === '') {
+        throw new UserError('An amendment needs a reason (it is written into an audited log).', {
+            command: 'prismatica amend <id> --reason "why the scope must change" --allow "…"',
+            why: 'scope changes are auditable; the baseline is never touched',
+        });
+    }
+    if (!contractExists(home, options.contractId)) {
+        throw new UserError(`No contract "${options.contractId}" exists.`);
+    }
+    if (!hasAnyChange(options.changes)) {
+        throw new UserError('Amend must change something — add an allow/forbid/non-goal/check/docs, or set the tier.');
+    }
+    const { data: contract } = readContract(home, options.contractId);
+    const existingCheckIds = new Set(contract.acceptanceChecks.map((check) => check.id));
+    for (const check of options.changes.addChecks ?? []) {
+        if (existingCheckIds.has(check.id)) {
+            throw new UserError(`Acceptance check id "${check.id}" already exists on this contract.`);
+        }
+    }
+    const description = options.changes.description?.trim() || describe(options.changes);
+    // ── The scope boundary is the owner's, and only the owner's ────────────────
+    // Ordered deliberately: refuse an agent outright, then refuse an unattended
+    // run, then SHOW what is about to change and ask. Nothing durable exists
+    // until all three pass. See src/executor.ts for what this does and does not
+    // defend against.
+    if (isAgentExecutor(options.env)) {
+        throw new UserError('`amend` is the owner’s decision — an agent may not widen its own scope.', {
+            command: `prismatica amend ${options.contractId} --reason "…" --allow "…"   (run it yourself)`,
+            why: 'the contract bounds every other check; an agent that can move them decides its own limits',
+        });
+    }
+    if (!options.interactive) {
+        throw new UserError('`amend` needs a terminal — it shows you the new scope and asks once.', {
+            command: `prismatica amend ${options.contractId} --reason "…" --allow "…"`,
+            why: 'a scope change is the owner’s, so nothing may confirm one unattended (there is no --yes)',
+        });
+    }
+    const approved = await options.confirm({
+        contractId: contract.id,
+        title: contract.title,
+        reason: options.reason.trim(),
+        description,
+        currentAllowed: contract.allowedPaths,
+        addedAllowed: options.changes.addAllow ?? [],
+        currentForbidden: contract.forbiddenPaths,
+        addedForbidden: options.changes.addForbid ?? [],
+        addedNonGoals: options.changes.addNonGoal ?? [],
+        addedChecks: (options.changes.addChecks ?? []).map((check) => `${check.description} (proof: ${check.test})`),
+        addedDocs: options.changes.addDocs ?? [],
+        tier: options.changes.tier,
+        existingAmendments: contract.amendments.length,
+    });
+    if (!approved) {
+        throw new UserError('Amendment cancelled — the contract is unchanged.', {
+            command: `prismatica check ${options.contractId}`,
+            why: 'nothing was written, so the existing scope still stands',
+        });
+    }
+    const at = (options.now ?? new Date()).toISOString();
+    const amended = ContractSchema.parse({
+        ...contract,
+        // baseline is deliberately carried over untouched — never re-baseline mid-change.
+        tier: options.changes.tier ?? contract.tier,
+        allowedPaths: [...contract.allowedPaths, ...(options.changes.addAllow ?? [])],
+        forbiddenPaths: [...contract.forbiddenPaths, ...(options.changes.addForbid ?? [])],
+        nonGoals: [...contract.nonGoals, ...(options.changes.addNonGoal ?? [])],
+        acceptanceChecks: [...contract.acceptanceChecks, ...(options.changes.addChecks ?? [])],
+        docsDelta: [...contract.docsDelta, ...(options.changes.addDocs ?? [])],
+        amendments: [...contract.amendments, { at, reason: options.reason.trim(), description }],
+    });
+    writeContract(home, amended, renderContractBody(amended));
+    // Scope changed → refresh the lane's scope hook so it enforces the new bounds.
+    let hookRefreshed = false;
+    if (amended.worktree) {
+        try {
+            installScopeHook({
+                worktreeRoot: amended.worktree,
+                contractId: amended.id,
+                allowedPaths: amended.allowedPaths,
+                forbiddenPaths: amended.forbiddenPaths,
+            });
+            hookRefreshed = true;
+        }
+        catch {
+            hookRefreshed = false;
+        }
+    }
+    return {
+        contract: amended,
+        amendmentCount: amended.amendments.length,
+        overAmended: amended.amendments.length >= 3,
+        hookRefreshed,
+    };
+}
+export function printAmendResult(result) {
+    console.log(ui.ok(`✓ amended ${result.contract.id} (amendment #${result.amendmentCount})`));
+    console.log('');
+    console.log(ui.warn('  the prior pack and any seal are now invalid — re-pack and re-prove:'));
+    console.log(`     ${ui.bold(`prismatica pack ${result.contract.id}`)}`);
+    if (result.hookRefreshed) {
+        console.log(ui.dim('  the lane scope hook was refreshed to the new bounds'));
+    }
+    if (result.overAmended) {
+        console.log('');
+        console.log(ui.bad(`  ⚠ this change has been amended ${result.amendmentCount} times — consider splitting it into smaller changes`));
+    }
+}
+//# sourceMappingURL=amend.js.map

package/dist/commands/amend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"amend.js","sourceRoot":"","sources":["../../src/commands/amend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;AA4D/B,SAAS,QAAQ,CAAC,OAAqB;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB;IACzC,OAAO,OAAO,CACZ,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,QAAQ,EAAE,MAAM;QACxB,OAAO,CAAC,SAAS,EAAE,MAAM;QACzB,OAAO,CAAC,UAAU,EAAE,MAAM;QAC1B,OAAO,CAAC,SAAS,EAAE,MAAM;QACzB,OAAO,CAAC,OAAO,EAAE,MAAM,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,kEAAkE,EAAE;YACtF,OAAO,EAAE,wEAAwE;YACjF,GAAG,EAAE,4DAA4D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gBAAgB,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,wBAAwB,KAAK,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAErF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,yEAAyE,EAAE;YAC7F,OAAO,EAAE,oBAAoB,OAAO,CAAC,UAAU,+CAA+C;YAC9F,GAAG,EAAE,2FAA2F;SACjG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,sEAAsE,EAAE;YAC1F,OAAO,EAAE,oBAAoB,OAAO,CAAC,UAAU,2BAA2B;YAC1E,GAAG,EAAE,0FAA0F;SAChG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;QACrC,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;QAC7B,WAAW;QACX,cAAc,EAAE,QAAQ,CAAC,YAAY;QACrC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;QAC5C,gBAAgB,EAAE,QAAQ,CAAC,cAAc;QACzC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE;QAC/C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE;QAC/C,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,IAAI,GAAG,CACzD;QACD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE;QACxC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,kBAAkB,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CAAC,kDAAkD,EAAE;YACtE,OAAO,EAAE,oBAAoB,OAAO,CAAC,UAAU,EAAE;YACjD,GAAG,EAAE,yDAAyD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAErD,MAAM,OAAO,GAAa,cAAc,CAAC,KAAK,CAAC;QAC7C,GAAG,QAAQ;QACX,kFAAkF;QAClF,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QAC3C,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC7E,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACvE,gBAAgB,EAAE,CAAC,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACtF,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtE,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;KACzF,CAAC,CAAC;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1D,+EAA+E;IAC/E,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,gBAAgB,CAAC;gBACf,YAAY,EAAE,OAAO,CAAC,QAAQ;gBAC9B,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;YACH,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM;QACzC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC;QAC3C,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,oCAAoC,MAAM,CAAC,cAAc,qDAAqD,CAC/G,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/check.js

@@ -0,0 +1,128 @@
+/**
+ * `check` — run the proof checks for a change, write evidence, and append a
+ * ledger line (rework_count grows on each failed run). This is the same engine
+ * the CI gate runs; passing locally is what passing at the gate will mean.
+ *
+ * Evidence and the ledger line both land in `home` — the resolved change
+ * home (the lane, locally; the checkout itself in CI) — never the main
+ * checkout. Two lanes are separate git worktrees with separate working
+ * trees, so writing here can never collide with another lane's concurrent
+ * `check` run the way writing to a single shared `mainRoot` ledger file
+ * would. The lane's own `ledger.jsonl` already carries every entry main had
+ * as of the baseline commit, so filtering by contractId below sees exactly
+ * this change's own history — nothing more, nothing less.
+ */
+import { randomUUID } from 'node:crypto';
+import { uncommittedProofInputs } from '../assurance/proofinputs.js';
+import { resolveChangeHome, resolveContractId } from '../change.js';
+import { runCheckEngine } from '../checkengine.js';
+import { loadConfig } from '../config.js';
+import { UserError } from '../errors.js';
+import { writeCheckEvidence } from '../evidence.js';
+import * as git from '../git.js';
+import { appendLedgerEntry, readLedger } from '../ledger.js';
+import { contractExists, readContract, writeContract } from '../records/store.js';
+import { LedgerEntrySchema } from '../records/types.js';
+import { renderContractBody } from '../render.js';
+import { prismaticaVersion } from '../runtime.js';
+import { stageIndex } from '../state.js';
+import * as ui from '../ui.js';
+import { requireReadyAttemptAvailable } from './ready.js';
+export async function runCheck(options) {
+    const mainRoot = await git.mainRepoRoot(options.cwd);
+    const config = loadConfig(mainRoot);
+    const contractId = await resolveContractId(options.cwd, config.mainBranch, options.contractId);
+    const home = await resolveChangeHome(options.cwd, contractId);
+    if (!contractExists(home, contractId)) {
+        throw new UserError(`No contract "${contractId}" to check.`, {
+            command: 'prismatica frame …',
+            why: 'checks run against a framed change',
+        });
+    }
+    const { data: contract } = readContract(home, contractId);
+    await requireReadyAttemptAvailable(home, contractId, 'Check');
+    // A check is a claim about a diff, and the diff is `baseline..HEAD`. Anything
+    // the run reads but does not seal — the contract's own scope and acceptance
+    // terms, the approved intent, the pack, a Flow report, a Delta, a proposal, a
+    // canonical Atlas record, and the code itself — must therefore be COMMITTED
+    // before the claim is recorded, or the ledger line says "proven" about terms
+    // that ride no pull request. The one allowance is this sequence's own
+    // outputs; `assurance/proofinputs.ts` owns that list, and `review` applies
+    // the identical test, so the two can never drift apart.
+    const uncommitted = await uncommittedProofInputs(home, contract);
+    if (uncommitted.length > 0) {
+        throw new UserError(`The lane has uncommitted changes (${uncommitted.slice(0, 5).join(', ')}${uncommitted.length > 5 ? ', …' : ''}) — a check proves the committed diff and the committed records, so anything uncommitted would be recorded as proven without ever being checked.`, {
+            command: 'git add -- <only-the-expected-paths> && git commit -m "checkpoint: lane work and records" (in the lane)',
+            why: 'the check binds to a commit, and the records it reads — the contract, the pack, a Flow report, a proposal — must be the ones that ride the PR',
+        });
+    }
+    const checkedHead = await git.revParse(home, 'HEAD');
+    // The engine runs in the environment `check` was invoked in, deliberately.
+    // An earlier version deleted PRISMATICA_EXECUTOR around this call so the
+    // configured proof tools would not inherit it — which quietly made every
+    // nested Prismatica command inside a check look owner-run, on the one command
+    // an agent runs most. Whatever it fixed downstream, altering the authority
+    // marker is altering the owner-authority boundary, and a check must report
+    // the environment it was actually run in.
+    const result = await runCheckEngine({ home, contract, config });
+    const at = new Date().toISOString();
+    // Both durable outputs of this run say which runtime produced them. It is
+    // provenance, not a verdict: the outcomes, the changed files, `checkedHead`
+    // and the rework count are computed exactly as before, and nothing downstream
+    // reads the version to decide anything.
+    const runtimeVersion = prismaticaVersion();
+    const evidenceFile = writeCheckEvidence(home, {
+        contractId: contract.id,
+        event: 'check_run',
+        at,
+        pass: result.pass,
+        outcomes: result.outcomes,
+        changedFiles: result.changedFiles,
+        prismaticaVersion: runtimeVersion,
+    });
+    // rework_count: how many times checks have failed for this change so far —
+    // read from `home` (change-local), never `mainRoot` (see module comment).
+    // `readLedger` already excludes ready-run bookkeeping; keep the event test
+    // explicit too, so a legacy gate failure is not counted as Check rework.
+    const priorFailures = readLedger(home).entries.filter((entry) => entry.contractId === contract.id && entry.event === 'check_run' && !entry.pass).length;
+    const reworkCount = priorFailures + (result.pass ? 0 : 1);
+    appendLedgerEntry(home, LedgerEntrySchema.parse({
+        id: randomUUID(),
+        contractId: contract.id,
+        tier: contract.tier,
+        event: 'check_run',
+        at,
+        pass: result.pass,
+        checks: result.outcomes,
+        checkedHead,
+        prismaticaVersion: runtimeVersion,
+        reworkCount,
+    }));
+    // On a clean pass, mark the change proven.
+    if (result.pass && stageIndex(contract.stage) < stageIndex('prove')) {
+        const advanced = { ...contract, stage: 'prove' };
+        writeContract(home, advanced, renderContractBody(advanced));
+    }
+    return { result, evidenceFile, reworkCount };
+}
+const STATUS_MARK = {
+    pass: ui.ok('pass'),
+    fail: ui.bad('FAIL'),
+    skipped: ui.dim('skip'),
+    warn: ui.warn('warn'),
+};
+export function printCheckReport(report) {
+    console.log(report.result.pass ? ui.ok('✓ checks passed') : ui.bad('✗ checks failed'));
+    console.log('');
+    for (const outcome of report.result.outcomes) {
+        const mark = STATUS_MARK[outcome.status] ?? outcome.status;
+        console.log(`  ${mark}  ${ui.bold(outcome.name.padEnd(13))} ${ui.dim(outcome.detail ?? '')}`);
+    }
+    console.log('');
+    console.log(ui.dim(`  evidence: ${report.evidenceFile}`));
+    if (!report.result.pass) {
+        console.log('');
+        console.log(ui.warn(`  fix what failed and run it again (rework loops so far: ${report.reworkCount}).`));
+    }
+}
+//# sourceMappingURL=check.js.map

package/dist/commands/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/commands/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAc1D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,gBAAgB,UAAU,aAAa,EAAE;YAC3D,OAAO,EAAE,oBAAoB;YAC7B,GAAG,EAAE,oCAAoC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,4BAA4B,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CACjB,qCAAqC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,kJAAkJ,EAC/P;YACE,OAAO,EACL,yGAAyG;YAC3G,GAAG,EAAE,+IAA+I;SACrJ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrD,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpC,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAE3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE;QAC5C,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,WAAW;QAClB,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,iBAAiB,EAAE,cAAc;KAClC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAC1F,CAAC,MAAM,CAAC;IACT,MAAM,WAAW,GAAG,aAAa,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,iBAAiB,CACf,IAAI,EACJ,iBAAiB,CAAC,KAAK,CAAC;QACtB,EAAE,EAAE,UAAU,EAAE;QAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,WAAW;QAClB,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,WAAW;QACX,iBAAiB,EAAE,cAAc;QACjC,WAAW;KACZ,CAAC,CACH,CAAC;IAEF,2CAA2C;IAC3C,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAgB,EAAE,CAAC;QAC1D,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC;IACnB,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;IACpB,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,IAAI,CAAC,4DAA4D,MAAM,CAAC,WAAW,IAAI,CAAC,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/close.js

@@ -0,0 +1,274 @@
+/**
+ * `close` — remove a shipped change's lane, safely. Requires the exact
+ * registered lane (never `resolveChangeHome`'s fallbacks, which can silently
+ * land on `mainRoot`), refuses a dirty lane, refuses a lane holding
+ * non-disposable ignored files (`.env` and the like — invisible to a normal
+ * dirty check, but still destroyed with the rest of the worktree), and
+ * requires GitHub's own confirmation that this exact commit merged before
+ * removing anything. Never touches a remote branch, a record, or unmerged
+ * work — a partial failure (branch delete refused) always leaves a
+ * recoverable state, never a half-broken one.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import picomatch from 'picomatch';
+import { generateScopeHookScript, generatedScopeHookEntry, HOOK_SCRIPT_NAME, HOOK_SETTINGS_NAME, } from '../claudehook.js';
+import { mainSyncCommand } from '../atlas/next.js';
+import { changeBranch, resolveContractId } from '../change.js';
+import { loadConfig } from '../config.js';
+import { UserError } from '../errors.js';
+import * as git from '../git.js';
+import { ghAuthenticated, ghInstalled, ghPrView } from '../gh.js';
+import { contractExists, contractPath, parseMarkdownRecord, readContract, } from '../records/store.js';
+import { ContractSchema } from '../records/types.js';
+import { shellQuote } from '../shellquote.js';
+import { contractFieldsEqualExceptStage, stageIndex } from '../state.js';
+import * as ui from '../ui.js';
+/**
+ * Ignored paths that are always safe to discard silently with the rest of a
+ * removed worktree: dependency/build output and OS metadata only. Logs,
+ * evidence blobs, `.env`, and every other ignored path can contain unique
+ * owner or audit data, so a filename alone never proves them disposable.
+ *
+ * Prismatica's two Claude hook artifacts are handled separately below:
+ * their paths alone are insufficient because `settings.local.json` may
+ * contain owner settings and the hook script may have been hand-edited.
+ * They are disposable only when their CONTENT exactly matches the output
+ * Prismatica would generate for this contract and lane.
+ */
+const DISPOSABLE_IGNORED_GLOBS = ['node_modules/**', 'dist/**', 'coverage/**', '**/.DS_Store'];
+/**
+ * `git status --ignored=matching` reports an ignored DIRECTORY as a single
+ * entry with a trailing slash (`dist/`) rather than recursing into it, while
+ * an ignored file is reported bare — so a directory-rooted glob like
+ * `dist/**` must be checked against both the raw entry and its
+ * slash-stripped form.
+ */
+function isDisposableGeneratedPath(relPath) {
+    const posix = relPath.split(path.sep).join('/');
+    const stripped = posix.replace(/\/$/, '');
+    return DISPOSABLE_IGNORED_GLOBS.some((glob) => picomatch.isMatch(posix, glob, { dot: true }) ||
+        picomatch.isMatch(stripped, glob, { dot: true }));
+}
+function expectedScopeHookInput(lanePath, contract) {
+    return {
+        worktreeRoot: lanePath,
+        contractId: contract.id,
+        allowedPaths: contract.allowedPaths,
+        forbiddenPaths: contract.forbiddenPaths,
+    };
+}
+/**
+ * True only for an untouched Prismatica-generated Claude artifact. The
+ * settings file is intentionally compared structurally: formatting and key
+ * order are irrelevant, but ANY extra setting/hook/permission means the file
+ * contains state Prismatica does not own and `close` must preserve it.
+ */
+function isExactGeneratedClaudeArtifact(lanePath, contract, relPath) {
+    const posix = relPath.split(path.sep).join('/');
+    const absolute = path.join(lanePath, relPath);
+    try {
+        if (posix === `.claude/${HOOK_SCRIPT_NAME}`) {
+            return (fs.readFileSync(absolute, 'utf8') ===
+                generateScopeHookScript(expectedScopeHookInput(lanePath, contract)));
+        }
+        if (posix === `.claude/${HOOK_SETTINGS_NAME}`) {
+            const actual = JSON.parse(fs.readFileSync(absolute, 'utf8'));
+            const expected = {
+                hooks: { PreToolUse: [generatedScopeHookEntry(lanePath)] },
+            };
+            return isDeepStrictEqual(actual, expected);
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+/**
+ * Exported for `abandon`, which removes a worktree for the same reason and so
+ * must answer the same question: is this ignored file safe to destroy with it?
+ * Shared rather than reimplemented — a second, laxer copy of this list is
+ * exactly how someone's `.env` gets deleted by the command that was not
+ * updated.
+ */
+export function isDisposableIgnoredPath(lanePath, contract, relPath) {
+    return (isDisposableGeneratedPath(relPath) ||
+        isExactGeneratedClaudeArtifact(lanePath, contract, relPath));
+}
+/**
+ * The ONE kind of "dirty lane" close ever tolerates: `ship`'s own uncommitted
+ * stage bump, and nothing else. `ship` cannot commit for the owner (see
+ * AGENTS.md/CLAUDE.md), so a lane that just shipped is always left with
+ * exactly this one uncommitted, self-generated diff — never real work.
+ * Removing the lane simply discards this bookkeeping (the merged code's
+ * truth on main is authoritative from here on); anything else uncommitted
+ * still refuses, unchanged.
+ */
+async function isShipsOwnStageBump(lanePath, contractId, current, dirty) {
+    const relContractPath = path.relative(lanePath, contractPath(lanePath, contractId));
+    if (dirty.length !== 1 || dirty[0] !== relContractPath) {
+        return false;
+    }
+    const committed = await git.showFile(lanePath, 'HEAD', relContractPath);
+    if (committed === null) {
+        return false;
+    }
+    let previous;
+    try {
+        previous = parseMarkdownRecord(committed, ContractSchema).data;
+    }
+    catch {
+        return false;
+    }
+    // `ship` jumps straight to 'ship' (or 'verify') from wherever the contract
+    // currently sits — for a normal/light tier that never visits 'accept',
+    // this can legitimately skip more than one stage index. `mainpush.ts`
+    // applies the same forward-only, no-fixed-step tolerance to a main-branch
+    // record push. What matters here is only: forward, and landing on a
+    // stage ship itself ever writes.
+    return (contractFieldsEqualExceptStage(current, previous) &&
+        (current.stage === 'ship' || current.stage === 'verify') &&
+        stageIndex(current.stage) > stageIndex(previous.stage));
+}
+export async function runClose(options) {
+    const mainRoot = await git.mainRepoRoot(options.cwd);
+    const config = loadConfig(mainRoot);
+    const contractId = await resolveContractId(options.cwd, config.mainBranch, options.contractId);
+    const branch = changeBranch(contractId);
+    // Require the EXACT registered lane — a worktree whose branch is this
+    // change's own, found via `git worktree list` directly (never
+    // `resolveChangeHome`'s "here"/mainRoot fallbacks, which exist for
+    // record-reading commands, not for something this destructive).
+    const worktrees = await git.worktreeList(mainRoot);
+    const lane = worktrees.find((worktree) => worktree.branch === branch);
+    if (!lane) {
+        throw new UserError(`No registered lane for "${contractId}" — nothing to close.`, {
+            command: 'prismatica view',
+            why: 'close only ever removes a real, currently-registered worktree',
+        });
+    }
+    if (!contractExists(lane.path, contractId)) {
+        throw new UserError(`The lane at ${lane.path} has no contract for "${contractId}".`);
+    }
+    const { data: contract } = readContract(lane.path, contractId);
+    // Refuse a dirty lane — UNLESS the only uncommitted change is `ship`'s own
+    // stage bump (see isShipsOwnStageBump): that specific, narrow diff is
+    // Prismatica's own disposable bookkeeping, not owner work, and tolerating
+    // it is what makes the documented ship -> merge -> close sequence actually
+    // completable (ship can never commit for the owner, so without this,
+    // close would refuse every lane ship had ever touched).
+    const dirty = await git.dirtyPaths(lane.path);
+    if (dirty.length > 0 && !(await isShipsOwnStageBump(lane.path, contractId, contract, dirty))) {
+        throw new UserError(`The lane has uncommitted changes (${dirty.slice(0, 5).join(', ')}${dirty.length > 5 ? ', …' : ''}) — close refuses a dirty lane.`, {
+            command: `git -C ${lane.path} status`,
+            why: 'close only ever removes a lane with nothing left to lose',
+        });
+    }
+    // Refuse when the lane holds ignored files git status can't see are there
+    // (`.env`, a stray local note) — `git worktree remove` deletes the entire
+    // directory, ignored or not, so a lane that "looks clean" via dirtyPaths
+    // alone would silently destroy them. Known disposable generated/cache
+    // paths (node_modules, dist, coverage) and exact, untouched Prismatica
+    // Claude-hook artifacts are exempt; everything else fails closed.
+    const ignored = (await git.ignoredPaths(lane.path)).filter((p) => !isDisposableIgnoredPath(lane.path, contract, p));
+    if (ignored.length > 0) {
+        throw new UserError(`The lane has ignored local files that are not safe to auto-discard (${ignored.slice(0, 5).join(', ')}${ignored.length > 5 ? ', …' : ''}) — close refuses to remove them.`, {
+            command: `git -C ${lane.path} status --ignored`,
+            why: 'close only ever removes a lane with nothing left to lose; ignored files are invisible to a normal dirty check but are still deleted with the rest of the worktree',
+        });
+    }
+    // Require GitHub's own confirmation that a merged PR's head OID is EXACTLY
+    // this lane's HEAD — the one authoritative source that this work is safe
+    // to remove. Any ambiguity (gh unavailable, no PR, wrong branch/base,
+    // not merged, head mismatch) fails closed.
+    if (!(await ghInstalled()) || !(await ghAuthenticated())) {
+        throw new UserError('gh is unavailable to confirm the PR merged (offline-uncertain) — close fails closed.', {
+            command: 'gh auth login',
+            why: 'close never removes a lane it cannot independently verify is safe',
+        });
+    }
+    const view = await ghPrView(lane.path, contract.branch);
+    if (!view) {
+        throw new UserError(`Could not find a PR for branch "${contract.branch}".`, {
+            command: `prismatica ship ${contractId}`,
+            why: 'close only removes a lane whose change actually shipped through a PR',
+        });
+    }
+    if (view.state !== 'MERGED') {
+        throw new UserError(`PR ${view.url} is not merged yet (state: ${view.state}).`, {
+            command: `gh pr view ${view.url}`,
+            why: "close requires GitHub's own confirmation the PR merged",
+        });
+    }
+    if (view.baseRefName !== config.mainBranch) {
+        throw new UserError(`PR ${view.url} targets "${view.baseRefName}", not the configured main branch "${config.mainBranch}".`);
+    }
+    if (view.headRefName !== contract.branch) {
+        throw new UserError(`PR ${view.url}'s head branch ("${view.headRefName}") does not match the contract's branch ("${contract.branch}").`);
+    }
+    const laneHead = await git.revParse(lane.path, 'HEAD');
+    if (view.headRefOid !== laneHead) {
+        throw new UserError(`The lane's HEAD (${laneHead}) does not match the merged PR's head (${view.headRefOid}) — closing now could discard unmerged work.`, {
+            command: `git -C ${lane.path} log --oneline ${laneHead.slice(0, 12)}..`,
+            why: 'close only ever removes a lane at EXACTLY the head that actually merged',
+        });
+    }
+    // Remove only the verified worktree — a git-level operation that either
+    // fully succeeds or leaves the worktree exactly as it was (git itself is
+    // transactional about this). `git worktree remove` itself additionally
+    // refuses on ANY uncommitted change, so `force` is passed here only when
+    // `dirty.length > 0` — which, having survived the check above, can only
+    // ever be `ship`'s own tolerated stage bump, never real work.
+    await git.worktreeRemove(mainRoot, lane.path, dirty.length > 0);
+    // Branch deletion is best-effort and SAFE (`-d`, never `-D`): if the local
+    // checkout hasn't pulled the merge yet, git refuses rather than risking an
+    // unmerged branch — the worktree is already gone either way, so a refusal
+    // here is a fully recoverable partial state (`git pull` then `git branch
+    // -d <branch>`), never a broken one.
+    let branchDeleted;
+    try {
+        await git.deleteLocalBranch(mainRoot, contract.branch);
+        branchDeleted = true;
+    }
+    catch {
+        branchDeleted = false;
+    }
+    return {
+        contractId,
+        removedWorktree: lane.path,
+        branchDeleted,
+        branch: contract.branch,
+        prUrl: view.url,
+        mainRoot,
+        mainBranch: config.mainBranch,
+    };
+}
+export function printCloseResult(report) {
+    console.log(ui.ok(`✓ closed ${report.contractId}`));
+    console.log('');
+    console.log(`  ${ui.bold('lane removed')}   ${report.removedWorktree}`);
+    console.log(`  ${ui.bold('merged via')}     ${report.prUrl}`);
+    if (report.branchDeleted) {
+        console.log(`  ${ui.bold('branch')}         ${report.branch} (deleted locally)`);
+    }
+    else {
+        console.log(`  ${ui.warn('branch')}         ${report.branch} kept`);
+    }
+    console.log('');
+    // ALWAYS, not only when the branch was kept. The merge happened on GitHub,
+    // so this checkout is now behind by definition — every close leaves main
+    // stale, and the owner who is told nothing discovers it at the next
+    // `frame`, which refuses. Never pulled automatically: a fast-forward on the
+    // owner's main is the owner's to run.
+    console.log(ui.bold('Bring main up to date'));
+    console.log(`  ${mainSyncCommand(report.mainRoot, report.mainBranch)}`);
+    if (!report.branchDeleted) {
+        // A refused `-d` means this checkout has not seen the merge yet, so the
+        // safe delete becomes possible only AFTER the pull above — and it stays
+        // `-d`, never `-D`: if git still refuses, there really is unmerged work.
+        console.log(ui.dim(`  then, once main has the merge: git -C ${shellQuote(report.mainRoot)} branch -d ${shellQuote(report.branch)}`));
+    }
+}
+//# sourceMappingURL=close.js.map

package/dist/commands/close.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"close.js","sourceRoot":"","sources":["../../src/commands/close.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAiB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAG,CAAC,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;AAE/F;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,wBAAwB,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,QAAkB;IAClE,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CACrC,QAAgB,EAChB,QAAkB,EAClB,OAAe;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,WAAW,gBAAgB,EAAE,EAAE,CAAC;YAC5C,OAAO,CACL,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACjC,uBAAuB,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,WAAW,kBAAkB,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAC;YACxE,MAAM,QAAQ,GAAG;gBACf,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,EAAE;aAC3D,CAAC;YACF,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,QAAkB,EAClB,OAAe;IAEf,OAAO,CACL,yBAAyB,CAAC,OAAO,CAAC;QAClC,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAChC,QAAgB,EAChB,UAAkB,EAClB,OAAiB,EACjB,KAAe;IAEf,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,iCAAiC;IACjC,OAAO,CACL,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC;QACjD,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC;QACxD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvD,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAExC,sEAAsE;IACtE,8DAA8D;IAC9D,mEAAmE;IACnE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,CAAC,2BAA2B,UAAU,uBAAuB,EAAE;YAChF,OAAO,EAAE,iBAAiB;YAC1B,GAAG,EAAE,+DAA+D;SACrE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,eAAe,IAAI,CAAC,IAAI,yBAAyB,UAAU,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE/D,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,SAAS,CACjB,qCAAqC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAClI;YACE,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,SAAS;YACrC,GAAG,EAAE,0DAA0D;SAChE,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,uEAAuE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,mCAAmC,EAC1K;YACE,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,mBAAmB;YAC/C,GAAG,EAAE,mKAAmK;SACzK,CACF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CACjB,sFAAsF,EACtF;YACE,OAAO,EAAE,eAAe;YACxB,GAAG,EAAE,mEAAmE;SACzE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,EAAE;YAC1E,OAAO,EAAE,mBAAmB,UAAU,EAAE;YACxC,GAAG,EAAE,sEAAsE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,8BAA8B,IAAI,CAAC,KAAK,IAAI,EAAE;YAC9E,OAAO,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,wDAAwD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CACjB,MAAM,IAAI,CAAC,GAAG,aAAa,IAAI,CAAC,WAAW,sCAAsC,MAAM,CAAC,UAAU,IAAI,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CACjB,MAAM,IAAI,CAAC,GAAG,oBAAoB,IAAI,CAAC,WAAW,6CAA6C,QAAQ,CAAC,MAAM,KAAK,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CACjB,oBAAoB,QAAQ,0CAA0C,IAAI,CAAC,UAAU,8CAA8C,EACnI;YACE,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,kBAAkB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;YACvE,GAAG,EAAE,yEAAyE;SAC/E,CACF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,OAAO;QACL,UAAU;QACV,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,aAAa;QACb,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,CAAC,MAAM,oBAAoB,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,2CAA2C,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAChH,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/context.js

@@ -0,0 +1,46 @@
+/**
+ * `context start` / `context discover` — export what an agent needs to answer
+ * one question, and nothing else.
+ *
+ * Neither takes an argument. What the owner wants is settled in the
+ * conversation they are already having with the agent, and comes back inside
+ * the answer; what to map is whatever the snapshot says is here.
+ *
+ * This command WRITES NOTHING into the repository, and nothing anywhere the
+ * caller chooses. Its whole output is one JSON file in a fresh private OS temp
+ * directory — there is deliberately no `--out`, because these two commands are
+ * among the very few an AGENT may run for itself, and a caller-supplied
+ * destination would turn a read-only export into a write primitive pointed at
+ * any path the process can reach. It decides nothing, reaches nowhere, and
+ * hands back only what `flow list` and `git status` would already show.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHandoffDir } from '../paths.js';
+import { buildContextEnvelope } from '../planning/context.js';
+import { takeSnapshot } from '../planning/snapshot.js';
+import * as ui from '../ui.js';
+export async function runContext(options) {
+    const now = options.now ?? new Date();
+    const snapshot = await takeSnapshot(options.cwd, now);
+    const envelope = buildContextEnvelope({ kind: options.kind, snapshot, now });
+    const target = path.join(createHandoffDir(), `${options.kind}-context.json`);
+    fs.writeFileSync(target, `${JSON.stringify(envelope, null, 2)}\n`);
+    return { kind: options.kind, envelope, path: target };
+}
+export function printContextResult(result) {
+    console.log(ui.ok(`✓ ${result.kind} context written`));
+    console.log('');
+    console.log(`  ${result.path}`);
+    console.log('');
+    console.log(ui.dim(`  snapshot ${result.envelope.snapshot.snapshotId.slice(0, 12)} at ${result.envelope.snapshot.head.slice(0, 8)} — the answer is bound to this exact tree`));
+    console.log('');
+    console.log(ui.bold('Next'));
+    console.log('  1. Read that file: `instructions` says what to do, `answerSchema` says what to return.');
+    console.log('  2. Save the JSON answer to a file.');
+    console.log('  3. The OWNER imports it, in their OWN terminal:');
+    for (const command of result.envelope.importCommands) {
+        console.log(`     ${ui.bold(command)}`);
+    }
+}
+//# sourceMappingURL=context.js.map