prismatica 0.2.0

package/dist/executor.js

@@ -0,0 +1,256 @@
+/**
+ * Who is running this command: the owner at a terminal, or an agent Prismatica
+ * itself launched.
+ *
+ * Every process Prismatica starts for an agent — which is now only the lane
+ * launch (`open`) and the reviewer session (`review --agent`) — carries
+ * `PRISMATICA_EXECUTOR=agent` in its environment, and the commands that are the
+ * OWNER's decision refuse when they see it. `OWNER_ONLY_COMMANDS` below is that
+ * whole list; `amend` was merely the first of them. Each moves a boundary,
+ * signs something, or makes a claim in the owner's name, so an agent doing it
+ * unattended is exactly the reversal principle 1 forbids ("the agent proposes;
+ * deterministic code decides").
+ *
+ * BE HONEST ABOUT WHAT THIS IS. An environment variable is inherited, not
+ * enforced: a child can clear it (`env -u PRISMATICA_EXECUTOR …`), and an agent
+ * with a shell could edit the contract file directly and never call `amend` at
+ * all. This is not a security boundary against an adversarial agent — no
+ * in-process check can be, once the agent can run arbitrary commands. It is a
+ * guard against the failure mode that actually happens: a well-meaning agent
+ * taking a decision that was never its to take. Paired with the interactive
+ * confirmation in `amend`, it means the unattended path fails closed and the
+ * owner sees the scope change before it exists.
+ *
+ * The enforceable version of this — recording who amended and having the GATE
+ * refuse an agent-initiated amendment without an owner signature — is a
+ * deliberately deferred, larger change (see DECISIONS.md "Guarding amend").
+ */
+export const EXECUTOR_ENV_VAR = 'PRISMATICA_EXECUTOR';
+export const AGENT_EXECUTOR = 'agent';
+/**
+ * The environment additions that mark a child process as agent-executed.
+ * Spread over the inherited environment at every agent launch site — one
+ * function, so the marker an injector writes and the marker a guard reads can
+ * never drift apart.
+ */
+export function agentExecutorEnv() {
+    return { [EXECUTOR_ENV_VAR]: AGENT_EXECUTOR };
+}
+/** Is this process running as an agent Prismatica launched? */
+export function isAgentExecutor(env = process.env) {
+    return env[EXECUTOR_ENV_VAR] === AGENT_EXECUTOR;
+}
+/**
+ * The commands that are the OWNER's decision, by command path as the CLI sees
+ * it. An agent Prismatica launched is refused all of them.
+ *
+ * The test is not "is it important" but "does it decide something, or reach
+ * outside this machine". Each entry earns its place:
+ *  - `init` — ADOPTS governance. It generates the owner's Ed25519 keypair (the
+ *    key `accept` signs with and the gate verifies), writes the config that
+ *    names the public half, writes the CI gate workflow, and can install the
+ *    pre-push hook. Every one of those is the owner deciding how this repo will
+ *    be governed, and the Flow that describes it names the owner as the actor.
+ *    Nothing automated needs it: CI runs `gate`, never `init`.
+ *  - `start`/`frame` — invent the contract and its scope. An agent that can
+ *    frame gives itself the bounds it prefers, which is `amend` by another
+ *    route. `start` also creates a real GitHub issue.
+ *  - `amend` — moves those bounds afterwards (also guarded inside `runAmend`,
+ *    which is the stronger check; this list keeps the policy in one place).
+ *  - `accept` — SIGNS with the owner's Ed25519 key. The severest of all: an
+ *    agent that can accept can approve its own diff, and the signature is what
+ *    the gate verifies offline.
+ *  - `seal` — binds a review to the exact diff. The flow's own record names the
+ *    owner as the actor. An agent that can review AND seal is not being
+ *    reviewed by anyone. ONE narrow exception, enumerated as data in
+ *    `AGENT_PERMITTED_INVOCATIONS` below: `--request-changes`, which never
+ *    advances the change. The approving form is what this entry is really about.
+ *  - `ship`/`merge`/`close` — reach GitHub, or delete a lane.
+ *  - `abandon` — ENDS a change: it closes the pull request on GitHub, closes
+ *    the linked issue, commits an archive on the owner's behalf (the only
+ *    command that ever commits) and removes the worktree. Deciding a piece of
+ *    work is not worth finishing is the owner's alone; an agent reaching this
+ *    could retire the change it was asked to build rather than finish it.
+ *  - `forget` — the weakest case on this list, and here deliberately. The board
+ *    registry is never in the trust path, so losing it forges nothing and
+ *    proves nothing false. But `forget --all` destroys the owner's own
+ *    cross-repo state OUTSIDE this repo, where no `.prismatica/` record
+ *    archives it and no git history restores it, and no agent workflow has any
+ *    use for it. "Archive over delete" is principle 5; an agent quietly
+ *    clearing that list is the sort of tidy-up nobody asked for.
+ *  - `flow`/`rules approve`+`dismiss`, `delta approve`+`reject` — canonical
+ *    truth and planning decisions, which rule
+ *    `r-canonical-atlas-records-are-owner-only` already reserves to the owner.
+ *    The scope hook blocks an agent EDITING those files; without this it could
+ *    still call the command that writes them.
+ *  - `flow verify`/`rules verify` — write `method: manual` evidence onto
+ *    canonical truth. "Manual" means A PERSON LOOKED; an agent asserting it has
+ *    marked its own work proven, and because evidence sits outside the truth
+ *    hash the owner's signature survives intact, so nothing downstream betrays
+ *    the claim.
+ *  - `flow status` — flips an approved Flow's status (e.g. to `works`) by
+ *    rewriting its canonical record directly. Same authorship problem as
+ *    `verify`, and it is the field the owner reads first.
+ *  - `view` — the board is only "the owner's own localhost window" when the
+ *    OWNER opened it. It serves POST /accept (which calls `runAccept` and signs
+ *    with the owner's key) plus the flow/rules approve and dismiss routes, so an
+ *    agent that can start it reaches, through a browser form, every decision
+ *    this list refuses at the CLI. Guarding the server's handlers instead would
+ *    be the narrower cut; guarding the launch is the one this contract's scope
+ *    allows, and it costs an agent nothing it needs.
+ *
+ * Deliberately absent: `check`, `gate` and `prepush` (CI and hooks run them
+ * non-interactively, and they only ever report), `review` (the flow's actor is
+ * "reviewer (human or agent)" — a fresh agent reviewing is the design, not a
+ * hole), `pack`/`open`/`delta new`/`flow report` (proposing and briefing are
+ * the agent's job), and every genuinely read-only command —
+ * `flow list`/`flow show`/`rules list`/`delta list`/`delta show`/`next`/
+ * `doctor`/`stats`/`guide`, which report and decide nothing.
+ *
+ * Two more are absent for reasons worth stating, because they are the seam this
+ * whole design rests on:
+ *
+ *  - `context start`/`context discover` EXPORT. They write one JSON file into a
+ *    private OS temp directory, touch nothing in the repository, reach nowhere,
+ *    and hand back only what `flow list` and `git status` would already show.
+ *    An agent that could not run them would have to ask the owner to fetch its
+ *    own reading material, which is ceremony with no decision behind it.
+ *  - `ready record`/`ready status` are the Get Change Ready controller's own
+ *    bookkeeping, and the controller is an agent by design. `record` appends
+ *    strict, already-validated JSON facts about work that has ALREADY happened
+ *    — which run boundary was generated, which real Check ledger entry and
+ *    evidence file an attempt spent, which verdict word a reviewer ended on —
+ *    into the append-only ledger. It is the first agent-allowed command that
+ *    writes a durable record under `.prismatica/`, so the reason has to be
+ *    stated rather than assumed: the events it writes are orchestration state,
+ *    never assurance evidence. No proof consumer reads them (`readLedger`
+ *    exposes only check/gate entries), it invents nothing (every field it does
+ *    not generate must match a record already on disk), and it decides no
+ *    verdict. Requiring the owner to type it would mean the owner transcribing
+ *    a machine's bookkeeping. `status` is read-only. ONE form of `record` is
+ *    the exception and is enumerated as data in `OWNER_ONLY_INVOCATIONS` below:
+ *    `--new-run`, which opens a second bounded run with fresh budgets after a
+ *    terminal one. That is a decision about how many attempts this change gets,
+ *    not a fact about work already done.
+ *  - `discover --import` and `propose --import` write Flow and Rule PROPOSALS,
+ *    which rule `r-canonical-atlas-records-are-owner-only` explicitly reserves
+ *    to agents: proposing is the agent's half of that rule, and `flow approve`
+ *    — the half that writes canonical truth — is on the list above. Neither
+ *    import can reach canonical truth, silently displace a pending review (the
+ *    materialiser fails closed on a conflicting proposal), or choose where its
+ *    records land: the COMMAND fixes the destination, so a document cannot
+ *    route itself from a lane onto main.
+ *
+ * `flow assume` was on neither list because it no longer exists. It wrote a
+ * prompt pack into the repository and asked an agent to reason about a
+ * hypothetical; the deterministic half of its answer — which Flows share
+ * mechanics with this one — is now `flow show --json`'s `possiblyAffected`, and
+ * a genuine proposed change goes through `delta new` exactly as it did before.
+ *
+ * This guards CLI INVOCATION only. A programmatic caller inside this process
+ * (`start` calling `runFrame`, the board server calling `runFlowApprove`) never
+ * passes through the hook — deliberately, since each has its own owner
+ * confirmation, and `view` is on this list precisely because the board's did
+ * not extend to who launched it.
+ */
+export const OWNER_ONLY_COMMANDS = [
+    'init',
+    'start',
+    'frame',
+    'amend',
+    'accept',
+    'seal',
+    'ship',
+    'merge',
+    'close',
+    'abandon',
+    'flow approve',
+    'flow dismiss',
+    'flow verify',
+    'flow status',
+    'rules approve',
+    'rules dismiss',
+    'rules verify',
+    'delta approve',
+    'delta reject',
+    'view',
+    'forget',
+];
+export function isOwnerOnlyCommand(commandPath) {
+    return OWNER_ONLY_COMMANDS.includes(commandPath);
+}
+export const AGENT_PERMITTED_INVOCATIONS = [
+    {
+        command: 'seal',
+        option: 'requestChanges',
+        flag: '--request-changes',
+        why: 'a request_changes verdict never advances a change; above light it blocks the gate and `accept`, and `next` sends the change back to the builder',
+    },
+];
+/**
+ * The exception matching this exact invocation, or `null`.
+ *
+ * Two conditions, both required. The permitted option must be exactly `true` —
+ * and no OTHER option may carry a value, because an exception can only be
+ * reasoned about for the invocation it was written for. A future
+ * `seal --request-changes --something` is an invocation nobody has thought
+ * about yet, so it fails closed and comes back here to be thought about.
+ */
+export function agentPermittedInvocation(commandPath, options = {}) {
+    const permitted = AGENT_PERMITTED_INVOCATIONS.find((entry) => entry.command === commandPath);
+    if (!permitted || options[permitted.option] !== true) {
+        return null;
+    }
+    const others = Object.entries(options).filter(([key, value]) => key !== permitted.option && value !== undefined);
+    return others.length > 0 ? null : permitted;
+}
+export const OWNER_ONLY_INVOCATIONS = [
+    {
+        command: 'ready record',
+        option: 'newRun',
+        flag: '--new-run',
+        why: 'a new run grants fresh Check and review budgets; deciding that three attempts were not enough is the owner’s call, not the controller’s',
+    },
+];
+/** The owner-only exception matching this exact invocation, or `null`. */
+export function ownerOnlyInvocation(commandPath, options = {}) {
+    return (OWNER_ONLY_INVOCATIONS.find((entry) => entry.command === commandPath && options[entry.option] === true) ?? null);
+}
+/**
+ * The refusal, as data rather than a thrown error, so the policy stays pure and
+ * the CLI decides how to present it. `null` means "carry on".
+ *
+ * `options` are the invocation's own parsed flags, and default to none so every
+ * existing caller keeps refusing exactly as it did: an exception is something a
+ * caller must PRESENT evidence for, never something it gets by omission.
+ *
+ * `invocation` is what was actually refused — the command path for an
+ * always-owner-only command, and the path PLUS the flag for one that is
+ * owner-only in a single form. Without it the refusal for
+ * `ready record --new-run` would have read "`prismatica ready record` is the
+ * owner's decision", which is false about the ordinary form the controller runs
+ * all day.
+ */
+export function ownerOnlyRefusal(commandPath, env = process.env, options = {}) {
+    if (!isAgentExecutor(env)) {
+        return null;
+    }
+    const restricted = ownerOnlyInvocation(commandPath, options);
+    if (restricted) {
+        const invocation = `${commandPath} ${restricted.flag}`;
+        return {
+            invocation,
+            command: `prismatica ${invocation}   (run it yourself)`,
+            why: restricted.why,
+        };
+    }
+    if (!isOwnerOnlyCommand(commandPath) || agentPermittedInvocation(commandPath, options)) {
+        return null;
+    }
+    return {
+        invocation: commandPath,
+        command: `prismatica ${commandPath}   (run it yourself)`,
+        why: 'this decision is the owner’s; an agent that could make it would be approving its own work',
+    };
+}
+//# sourceMappingURL=executor.js.map

package/dist/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,cAAc,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,cAAc;IACd,eAAe;IACf,cAAc;IACd,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAyCD,MAAM,CAAC,MAAM,2BAA2B,GAAwC;IAC9E;QACE,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,iJAAiJ;KACvJ;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;IAC7F,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,MAAM,IAAI,KAAK,KAAK,SAAS,CAClE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAmCD,MAAM,CAAC,MAAM,sBAAsB,GAAmC;IACpE;QACE,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,yIAAyI;KAC/I;CACF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,UAAmC,EAAE;IAErC,OAAO,CACL,sBAAsB,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,CAC3E,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAmC,EAAE;IAErC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO;YACL,UAAU;YACV,OAAO,EAAE,cAAc,UAAU,sBAAsB;YACvD,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,cAAc,WAAW,sBAAsB;QACxD,GAAG,EAAE,2FAA2F;KACjG,CAAC;AACJ,CAAC"}

package/dist/gate.js

@@ -0,0 +1,109 @@
+/**
+ * The gate evaluation — the single choke point, shared by the CI `gate` command
+ * and `ship`'s pre-flight. It re-runs the check engine and asserts every
+ * requirement deterministically. Default is "not ready": anything unproven fails.
+ */
+import fs from 'node:fs';
+import { assessDecision, assessReview, decisionProgresses, describeDecision, describeReview, reviewProgresses, } from './assurance/outcome.js';
+import { reportGaps } from './atlas/impact.js';
+import { runCheckEngine } from './checkengine.js';
+import * as git from './git.js';
+import { readContract, readDecision, readReview, readFlowReport, reportExists, decisionPath, reviewPath, } from './records/store.js';
+import { tierForFiles, tierRank } from './tier.js';
+export async function evaluateGate(ctx) {
+    const { data: contract } = readContract(ctx.home, ctx.contractId);
+    const engine = await runCheckEngine({ home: ctx.home, contract, config: ctx.config });
+    const patchId = await git.computePatchId(ctx.home, contract.baseline.commit, git.EXCLUDE_RECORDS);
+    const requirements = [];
+    const add = (id, label, met, detail) => {
+        requirements.push({ id, label, met, detail });
+    };
+    // 1. Intent binding — no contract without an issue; no merge without a contract.
+    add('issue', 'Linked to a GitHub issue', contract.issue.trim() !== '', contract.issue.trim() === '' ? 'no issue linked' : contract.issue);
+    // 2. A real change — no records (and no passport) for a no-op.
+    add('not-empty', 'The change actually changes something', engine.changedFiles.length > 0, engine.changedFiles.length > 0
+        ? `${engine.changedFiles.length} file(s) changed`
+        : 'the diff against the baseline is empty');
+    // 3. In-scope diff (the deterministic backstop).
+    const scope = engine.outcomes.find((o) => o.name === 'scope');
+    add('scope', 'Diff stays in scope', scope?.status === 'pass', scope?.detail ?? 'not evaluated');
+    // 3a. Changed-file risk-tier floor — a contract's declared tier can never sit
+    // below what the files it actually touches demand (config.tierRules, e.g.
+    // **/auth/** forces heavy). This closes the gap where a contract's own risk
+    // answers understated what it turned out to touch.
+    const floor = tierForFiles(engine.changedFiles, ctx.config.tierRules);
+    const meetsFloor = tierRank(contract.tier) >= tierRank(floor);
+    add('tier-floor', 'Risk tier matches the files touched', meetsFloor, meetsFloor
+        ? `tier "${contract.tier}" meets the floor for these files (${floor})`
+        : `these changed files require at least tier "${floor}", but the contract is "${contract.tier}"`);
+    // 3. Acceptance checks traced to passing tests.
+    const trace = engine.outcomes.find((o) => o.name === 'traceability');
+    add('traceability', 'Acceptance checks proven', trace?.status !== 'fail', trace?.detail ?? 'not evaluated');
+    // 4. Docs delta.
+    const docs = engine.outcomes.find((o) => o.name === 'docs-delta');
+    add('docs', 'Docs updated', docs?.status !== 'fail', docs?.detail ?? 'not evaluated');
+    // 5. All configured tool checks pass (typecheck/lint/unit/build/journeys/secrets).
+    const toolNames = ['typecheck', 'lint', 'unit', 'build', 'journeys', 'secrets'];
+    const failedTools = engine.outcomes.filter((o) => toolNames.includes(o.name) && o.status === 'fail');
+    add('checks', 'Proof checks pass', failedTools.length === 0, failedTools.length === 0
+        ? 'all configured checks green'
+        : `failed: ${failedTools.map((o) => o.name).join(', ')}`);
+    // 5a. Atlas records approved on main must actually be part of this branch's
+    // history — the release-blocker backstop. Mode-independence mirrors
+    // truth-integrity: checkengine.ts already only fails this in `govern` mode
+    // (map-only has no merge gate to enforce against), so this requirement is a
+    // no-op there without special-casing mode here too.
+    const atlasUncommittedMain = engine.outcomes.find((o) => o.name === 'atlas-uncommitted-main');
+    add('atlas-uncommitted-main', 'Approved Atlas records are committed, not left on main', atlasUncommittedMain?.status !== 'fail', atlasUncommittedMain?.detail ?? 'not evaluated');
+    // 5b. Atlas truth integrity — canonical Flow/Rule records were not tampered
+    // with (Requirement 1); applies regardless of mode, since a hash mismatch
+    // means truth was rewritten outside the approve path either way.
+    const truthIntegrity = engine.outcomes.find((o) => o.name === 'truth-integrity');
+    add('truth-integrity', 'Flow/Rule truth integrity verified', truthIntegrity?.status !== 'fail', truthIntegrity?.detail ?? 'not evaluated');
+    // 5c. Flow report required when Atlas assesses impact — governed repos only;
+    // map-only has no merge gate to enforce, so this stays advisory (WARN) there.
+    if (ctx.config.mode === 'govern') {
+        add('flow-report', 'Flow report covers what this change touches', ...flowReportRequirement(ctx.home, contract.id, engine.impact));
+    }
+    // 6. A sealed review APPROVING the head diff (normal + heavy).
+    if (contract.tier !== 'light') {
+        add('review', 'Sealed review approves this diff', ...reviewRequirement(ctx.home, contract.id, patchId));
+    }
+    // 7. A signed owner decision matching the head diff (heavy only).
+    if (contract.tier === 'heavy') {
+        add('decision', 'Signed owner decision matches the diff', ...decisionRequirement(ctx.home, ctx.config, contract.id, patchId));
+    }
+    const pass = requirements.every((requirement) => requirement.met);
+    return { requirements, pass, patchId, engine, contract };
+}
+function flowReportRequirement(home, contractId, impact) {
+    const report = reportExists(home, contractId) ? readFlowReport(home, contractId).data : null;
+    const gaps = reportGaps(impact, report);
+    return gaps.length === 0
+        ? [
+            true,
+            impact.level === 'none'
+                ? 'no Atlas flow overlaps this change'
+                : 'flow report covers the affected flow(s)',
+        ]
+        : [false, gaps.join('; ')];
+}
+/**
+ * A review that EXISTS and is sealed and matches the patch-id used to satisfy
+ * this requirement whatever it concluded, so `seal --request-changes` — the
+ * command whose entire purpose is to say no — let the change through. The
+ * verdict is now read, through the one shared assessment every other surface
+ * reads, so the gate and `next` and the board can no longer disagree about
+ * what the same record means.
+ */
+function reviewRequirement(home, id, patchId) {
+    const review = fs.existsSync(reviewPath(home, id)) ? readReview(home, id).data : undefined;
+    const standing = assessReview(review, patchId);
+    return [reviewProgresses(standing), describeReview(standing, review)];
+}
+function decisionRequirement(home, config, id, patchId) {
+    const decision = fs.existsSync(decisionPath(home, id)) ? readDecision(home, id) : undefined;
+    const standing = assessDecision(decision, id, patchId, config.owner.publicKey);
+    return [decisionProgresses(standing), describeDecision(standing, decision)];
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAyB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,cAAc,EAA0B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAuBnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB;IACjD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IAElG,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,GAAY,EAAE,MAAc,EAAQ,EAAE;QAC5E,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,iFAAiF;IACjF,GAAG,CACD,OAAO,EACP,0BAA0B,EAC1B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAC5B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAClE,CAAC;IAEF,+DAA+D;IAC/D,GAAG,CACD,WAAW,EACX,uCAAuC,EACvC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAC9B,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,kBAAkB;QACjD,CAAC,CAAC,wCAAwC,CAC7C,CAAC;IAEF,iDAAiD;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAC9D,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IAEhG,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,GAAG,CACD,YAAY,EACZ,qCAAqC,EACrC,UAAU,EACV,UAAU;QACR,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,sCAAsC,KAAK,GAAG;QACtE,CAAC,CAAC,8CAA8C,KAAK,2BAA2B,QAAQ,CAAC,IAAI,GAAG,CACnG,CAAC;IAEF,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACrE,GAAG,CACD,cAAc,EACd,0BAA0B,EAC1B,KAAK,EAAE,MAAM,KAAK,MAAM,EACxB,KAAK,EAAE,MAAM,IAAI,eAAe,CACjC,CAAC;IAEF,iBAAiB;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAClE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IAEtF,mFAAmF;IACnF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CACzD,CAAC;IACF,GAAG,CACD,QAAQ,EACR,mBAAmB,EACnB,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,WAAW,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,WAAW,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;IAEF,4EAA4E;IAC5E,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IAC9F,GAAG,CACD,wBAAwB,EACxB,wDAAwD,EACxD,oBAAoB,EAAE,MAAM,KAAK,MAAM,EACvC,oBAAoB,EAAE,MAAM,IAAI,eAAe,CAChD,CAAC;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACjF,GAAG,CACD,iBAAiB,EACjB,oCAAoC,EACpC,cAAc,EAAE,MAAM,KAAK,MAAM,EACjC,cAAc,EAAE,MAAM,IAAI,eAAe,CAC1C,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,CACD,aAAa,EACb,6CAA6C,EAC7C,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CACD,QAAQ,EACR,kCAAkC,EAClC,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CACrD,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CACD,UAAU,EACV,wCAAwC,EACxC,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,UAAkB,EAClB,MAAwB;IAExB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC;YACE,IAAI;YACJ,MAAM,CAAC,KAAK,KAAK,MAAM;gBACrB,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,yCAAyC;SAC9C;QACH,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,EAAU,EAAE,OAAe;IAClE,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAY,EACZ,MAAc,EACd,EAAU,EACV,OAAe;IAEf,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/gh.js

@@ -0,0 +1,236 @@
+/**
+ * Minimal wrapper around the user's own `gh` CLI. Prismatica never stores or
+ * handles a GitHub token — if `gh` is missing or unauthenticated, callers must
+ * say so clearly instead of working around it.
+ */
+import { execa } from 'execa';
+export async function ghInstalled() {
+    const result = await execa('gh', ['--version'], { reject: false });
+    return !result.failed;
+}
+export async function ghAuthenticated() {
+    const result = await execa('gh', ['auth', 'status'], { reject: false });
+    return !result.failed;
+}
+/** `owner/repo` of the origin remote, or null when there is no GitHub remote. */
+export async function githubSlug(cwd) {
+    const result = await execa('git', ['remote', 'get-url', 'origin'], { cwd, reject: false });
+    if (result.failed) {
+        return null;
+    }
+    const match = result.stdout.trim().match(/github\.com[/:]([^/]+\/.+?)(?:\.git)?$/);
+    return match?.[1] ?? null;
+}
+/** `HTTP/2.0 403 Forbidden` — the status line `gh api --include` prints. */
+const HTTP_STATUS_LINE = /^HTTP\/[\d.]+ (\d{3})\b/gm;
+/** `gh` appends `(HTTP 403)` to its own stderr message — a numeric fallback. */
+const HTTP_STATUS_IN_STDERR = /\(HTTP (\d{3})\)/;
+function parseJson(raw) {
+    try {
+        return { parsed: true, value: JSON.parse(raw) };
+    }
+    catch {
+        return { parsed: false };
+    }
+}
+/**
+ * Split `gh api --include` output into its status code and its body.
+ *
+ * Written to survive more than one header block (a redirect gh followed, a 1xx
+ * informational response): the LAST status line is the one that describes the
+ * body, and the body is the first blank-line remainder that actually parses as
+ * JSON. Getting this wrong would push a real 200 into "indeterminate", which is
+ * the honest-but-useless failure this whole module exists to avoid — so it
+ * degrades to the first remainder rather than to nothing.
+ */
+function splitHttpResponse(stdout) {
+    const statusCodes = [...stdout.matchAll(HTTP_STATUS_LINE)].map((match) => Number(match[1]));
+    if (statusCodes.length === 0) {
+        return { body: stdout };
+    }
+    const status = statusCodes.at(-1);
+    const remainders = [...stdout.matchAll(/\r?\n\r?\n/g)].map((separator) => stdout.slice(separator.index + separator[0].length));
+    const jsonBody = remainders.find((remainder) => parseJson(remainder.trim()).parsed);
+    return { status, body: jsonBody ?? remainders[0] ?? '' };
+}
+function errorMessageOf(body) {
+    if (!body.parsed || typeof body.value !== 'object' || body.value === null) {
+        return undefined;
+    }
+    const message = body.value.message;
+    return typeof message === 'string' ? message : undefined;
+}
+/**
+ * `gh api --include <endpoint>` — `--include` is what makes the response's own
+ * HTTP status readable, so callers can classify a failure structurally instead
+ * of pattern-matching English.
+ */
+export async function ghApiJson(endpoint, cwd) {
+    const result = await execa('gh', ['api', '--include', endpoint], { cwd, reject: false });
+    const { status, body } = splitHttpResponse(result.stdout);
+    const parsed = parseJson(body.trim());
+    const stderrStatus = HTTP_STATUS_IN_STDERR.exec(result.stderr)?.[1];
+    const httpStatus = status ?? (stderrStatus === undefined ? undefined : Number(stderrStatus));
+    if (result.failed) {
+        return {
+            ok: false,
+            status: httpStatus,
+            message: errorMessageOf(parsed),
+            error: (result.stderr || body || 'gh api failed').trim(),
+        };
+    }
+    if (!parsed.parsed) {
+        return {
+            ok: false,
+            status: httpStatus,
+            error: 'gh api returned a response that is not JSON',
+        };
+    }
+    return { ok: true, status: httpStatus, data: parsed.value };
+}
+/**
+ * `gh issue create` — the ONE outward-facing write `start` performs, and only
+ * after the owner has explicitly chosen to start the build. Title and body come
+ * from the approved proposal and are passed as argv, never interpolated into a
+ * shell string. An agent can never reach this: nothing calls it except the
+ * post-approval path.
+ */
+export async function ghIssueCreate(cwd, title, body) {
+    const result = await execa('gh', ['issue', 'create', '--title', title, '--body', body], {
+        cwd,
+        reject: false,
+    });
+    if (result.failed) {
+        const detail = (result.stderr || result.stdout).trim();
+        // A non-zero exit does not prove nothing was created. Only the failures
+        // that provably happen BEFORE the API call — gh missing, not
+        // authenticated, not a repo — are reported as certain.
+        const certainlyNotCreated = /could not find|not a git repository|no git remote|gh auth login|authentication|not logged|command not found|ENOENT|unknown (?:flag|command)/i.test(detail);
+        return { ok: false, error: detail, uncertain: !certainlyNotCreated };
+    }
+    // gh prints the new issue's URL on the last non-empty line.
+    const url = result.stdout
+        .trim()
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith('http'))
+        .at(-1);
+    // Exit 0 with no parseable URL is the clearest ambiguous case of all: gh
+    // believed it succeeded, and we simply cannot name what it created.
+    return url
+        ? { ok: true, url }
+        : {
+            ok: false,
+            error: 'gh reported success but did not print the new issue URL',
+            uncertain: true,
+        };
+}
+const PR_VIEW_FIELDS = [
+    'number',
+    'state',
+    'isDraft',
+    'mergeStateStatus',
+    'baseRefName',
+    'headRefName',
+    'headRefOid',
+    'url',
+];
+/** `gh pr view <branchOrUrl>` — null when gh can't answer at all (missing, unauthenticated, no such PR). */
+export async function ghPrView(cwd, branchOrUrl) {
+    const result = await execa('gh', ['pr', 'view', branchOrUrl, '--json', PR_VIEW_FIELDS.join(',')], {
+        cwd,
+        reject: false,
+    });
+    if (result.failed) {
+        return null;
+    }
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        return null;
+    }
+}
+/** gh's own wording when a branch genuinely has no PR — the one message that means "absent". */
+const NO_PR_FOUND = /no (?:pull requests|prs) found/i;
+/**
+ * `JSON.parse(...) as GhPrView` is a type ASSERTION, not a check: `{}` and
+ * `null` both parse and both satisfy it, and `abandon` then read `view?.state`
+ * as `undefined` and proceeded as though no PR existed at all — the opposite
+ * of fail-closed (ac-11). Every field the callers actually branch on must
+ * genuinely be present and the right type before a response counts as a view.
+ */
+function isGhPrView(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const v = value;
+    return (typeof v.number === 'number' &&
+        (v.state === 'OPEN' || v.state === 'CLOSED' || v.state === 'MERGED') &&
+        typeof v.isDraft === 'boolean' &&
+        typeof v.mergeStateStatus === 'string' &&
+        typeof v.baseRefName === 'string' &&
+        typeof v.headRefName === 'string' &&
+        typeof v.headRefOid === 'string' &&
+        typeof v.url === 'string');
+}
+export async function ghPrLookup(cwd, branchOrUrl) {
+    const result = await execa('gh', ['pr', 'view', branchOrUrl, '--json', PR_VIEW_FIELDS.join(',')], {
+        cwd,
+        reject: false,
+    });
+    if (result.failed) {
+        const detail = (result.stderr || result.stdout).trim();
+        return NO_PR_FOUND.test(detail)
+            ? { absent: true, uncertain: false }
+            : { absent: false, uncertain: true, error: detail };
+    }
+    const parsed = parseJson(result.stdout);
+    if (!parsed.parsed || !isGhPrView(parsed.value)) {
+        // Exit 0 with unparseable, or parseable-but-wrong-shape, output
+        // establishes nothing at all.
+        return { absent: false, uncertain: true, error: 'gh returned a PR view that is not JSON' };
+    }
+    return { absent: false, uncertain: false, view: parsed.value };
+}
+/** `gh pr close <number>` — used only by `abandon`, and only on a genuinely OPEN PR. */
+export async function ghPrClose(cwd, number) {
+    const result = await execa('gh', ['pr', 'close', String(number)], { cwd, reject: false });
+    return result.failed
+        ? { ok: false, error: (result.stderr || result.stdout).trim() }
+        : { ok: true };
+}
+/** `gh issue close <urlOrNumber>` — best effort by design; the caller reports failure, never hides it. */
+export async function ghIssueClose(cwd, issue, reason) {
+    const args = ['issue', 'close', issue, ...(reason ? ['--comment', reason] : [])];
+    const result = await execa('gh', args, { cwd, reject: false });
+    return result.failed
+        ? { ok: false, error: (result.stderr || result.stdout).trim() }
+        : { ok: true };
+}
+/** Same reasoning as `isGhPrView`: an unvalidated cast let a non-array or a
+ * malformed item reach `merge`/`ship --verify`'s check-list reading, which
+ * would then throw a TypeError instead of failing closed with "unknown". */
+function isGhCheckRunArray(value) {
+    return (Array.isArray(value) &&
+        value.every((item) => typeof item === 'object' &&
+            item !== null &&
+            typeof item.name === 'string' &&
+            typeof item.state === 'string' &&
+            typeof item.bucket === 'string'));
+}
+/** `gh pr checks <number>` for the exact PR (not "the PR for this branch") — avoids racing a branch that has moved on. */
+export async function ghPrChecks(cwd, number) {
+    const result = await execa('gh', ['pr', 'checks', String(number), '--json', 'name,state,bucket'], { cwd, reject: false });
+    if (result.failed) {
+        return null;
+    }
+    const parsed = parseJson(result.stdout);
+    return parsed.parsed && isGhCheckRunArray(parsed.value) ? parsed.value : null;
+}
+/** `gh pr merge --merge --match-head-commit <oid>` — never squash, never rebase. */
+export async function ghPrMerge(cwd, number, headOid) {
+    const result = await execa('gh', ['pr', 'merge', String(number), '--merge', '--match-head-commit', headOid], { cwd, reject: false });
+    return result.failed ? { ok: false, error: result.stderr || result.stdout } : { ok: true };
+}
+//# sourceMappingURL=gh.js.map

package/dist/gh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh.js","sourceRoot":"","sources":["../src/gh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACxB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAkBD,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACvE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CACpD,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CACrB,IAA0D;IAE1D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAI,IAAI,CAAC,KAA+B,CAAC,OAAO,CAAC;IAC9D,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAY;IAC5D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,6CAA6C;SACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QACtF,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,wEAAwE;QACxE,6DAA6D;QAC7D,uDAAuD;QACvD,MAAM,mBAAmB,GACvB,8IAA8I,CAAC,IAAI,CACjJ,MAAM,CACP,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,mBAAmB,EAAE,CAAC;IACvE,CAAC;IACD,4DAA4D;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM;SACtB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,yEAAyE;IACzE,oEAAoE;IACpE,OAAO,GAAG;QACR,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;QACnB,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD;YAChE,SAAS,EAAE,IAAI;SAChB,CAAC;AACR,CAAC;AAcD,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,OAAO;IACP,SAAS;IACT,kBAAkB;IAClB,aAAa;IACb,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAC;AAEF,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,WAAmB;IAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC/D;QACE,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CACF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAa,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoBD,gGAAgG;AAChG,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QACpE,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;QAC9B,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ;QACtC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,WAAmB;IAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;QAChG,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;YACpC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,gEAAgE;QAChE,8BAA8B;QAC9B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM;QAClB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACnB,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,KAAa,EACb,MAAe;IAEf,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM;QAClB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACnB,CAAC;AASD;;4EAE4E;AAC5E,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CACT,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,OAAQ,IAAgC,CAAC,IAAI,KAAK,QAAQ;YAC1D,OAAQ,IAAgC,CAAC,KAAK,KAAK,QAAQ;YAC3D,OAAQ,IAAgC,CAAC,MAAM,KAAK,QAAQ,CAC/D,CACF,CAAC;AACJ,CAAC;AAED,0HAA0H;AAC1H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,EAC/D,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CACvB,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,MAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAC1E,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CACvB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAC7F,CAAC"}