@clossys/writer 0.4.0 → 0.5.0

package/dist/approve-cli.js

@@ -0,0 +1,430 @@
+/**
+ * `writer-check approve` — writes a `CopyRegistryEntry.approval` record so
+ * nobody has to hand-edit one. It exists as a command, not a hand-edited
+ * JSON field, for the same reason `textFingerprint` (`fingerprint.ts`) is a
+ * content hash rather than a human-maintained counter: a hand-typed record
+ * is easy to get wrong — copying yesterday's `approvedAt`, pinning `textFingerprint` to
+ * some other entry's text, or leaving `pendingOwnerReview` set after an
+ * owner actually reviewed it. Every field this command writes is either
+ * computed (`approvedAt` from the clock, `textFingerprint` from the
+ * entry's own current `text` via `computeCopyFingerprint`) or copied
+ * verbatim from an argument this command itself validated (`--delegate`,
+ * `--scope`, `--expires`) — there is no field here a human types free-form
+ * into the JSON.
+ *
+ * This module owns argument parsing, registry-file I/O, and the mutate-
+ * then-atomically-rename write; `./approval.ts`'s `isDelegateScopeItem` and
+ * `isEntryInDelegateScope` decide whether a requested id is in a delegate's
+ * declared scope, and `./schema.ts`'s `validateCopyRegistryShape` decides
+ * whether the registry file is trustworthy enough to mutate at all — this
+ * file calls both rather than re-deriving either.
+ *
+ * `main`-equivalent shape is `mainApproveCommand`, exported (unlike a
+ * typical CLI `main`) so this package's tests (which do not ship) can exercise the whole
+ * argv-to-exit-code contract directly against real `mkdtemp` fixture
+ * files, without spawning a subprocess — the same discipline every other
+ * subcommand in this package's `cli.ts` already holds to. `argv` excludes
+ * the leading `"approve"` token: `cli.ts`'s top-level dispatch calls
+ * `mainApproveCommand(argv.slice(1))` for `writer-check approve ...`, the same way `"passages"` and
+ * `"addressability"` are already dispatched there.
+ *
+ * Exit codes — a three-state contract matching every other gate/command in
+ * this package:
+ *
+ *   0 — written: every named entry was approved or revoked, and the
+ *       registry file on disk now reflects it.
+ *   1 — refused: at least one named entry is unknown, is `retired`, or —
+ *       for a delegate approval — falls outside `--scope`. This is
+ *       ALL-OR-NOTHING: when any requested id has a problem, EVERY problem
+ *       is printed and NOTHING is written, even for the other ids that
+ *       would otherwise have succeeded. A partial write here would leave a
+ *       consumer's own audit trail unable to tell whether a whole
+ *       requested batch was actually reviewed together.
+ *   2 — could not run: bad arguments (see below), or the registry file is
+ *       missing/unreadable, not valid JSON, or fails
+ *       `validateCopyRegistryShape`. Nothing is written in this state
+ *       either — this command never mutates a registry it does not first
+ *       fully trust.
+ *
+ * Bad-argument cases that produce exit 2, all before the registry file is
+ * ever opened: no registry-file argument, zero entry ids, neither `--by`
+ * nor `--revoke` (or both), `--by` other than `owner`/`delegate`, `--by
+ * owner` combined with `--delegate`/`--scope`/`--expires`, `--by delegate`
+ * missing `--delegate` or `--scope`, an empty `--delegate` value, a
+ * `--scope` item that fails `isDelegateScopeItem` or an empty scope list,
+ * `--revoke` combined with any of `--by`/`--delegate`/`--scope`/
+ * `--expires`, an `--expires` value that is not a well-formed ISO 8601 UTC
+ * timestamp or is not strictly after the current time, or an unknown flag.
+ * `--help`/`-h` always prints usage and returns 0, taking precedence over
+ * every other check reachable in the same parse. Any other unexpected
+ * exception is caught and mapped to exit 2 as well — this command never
+ * lets an uncaught error double as a "something went wrong" report.
+ */
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { isDelegateScopeItem, isEntryInDelegateScope } from "./approval.js";
+import { COPY_FINGERPRINT_ALGORITHM, computeCopyFingerprint } from "./fingerprint.js";
+import { isIsoUtcTimestamp, validateCopyRegistryShape } from "./schema.js";
+export const APPROVE_USAGE = `Usage: writer-check approve <registry-file> <entry-id>... --by owner
+   or: writer-check approve <registry-file> <entry-id>... --by delegate --delegate <id> --scope <ns>[,<ns>...] [--expires <ISO>]
+   or: writer-check approve <registry-file> <entry-id>... --revoke
+
+  registry-file  Path to a CopyRegistry JSON file. Required.
+  entry-id       One or more entry ids to approve or revoke (repeatable positional argument; duplicates are deduplicated). Required.
+
+Options:
+  --help                  Print this message and exit 0.
+  --by <owner|delegate>   Who is recording this approval. Exactly one of --by or --revoke is required.
+  --delegate <id>         Opaque delegate identifier, never a personal name. Required (and only allowed) with --by delegate.
+  --scope <ns>[,<ns>...]  One or more dot-separated entry-id namespaces the delegate may approve (repeatable; a comma-separated value and repeated flags union). Required (and only allowed) with --by delegate.
+  --expires <ISO>         ISO 8601 UTC timestamp (YYYY-MM-DDTHH:MM:SSZ, optionally with milliseconds) after which the delegate approval expires. Must be strictly after the current time. Only allowed with --by delegate.
+  --revoke                Return every named entry to "draft" and delete its approval record. Cannot be combined with --by, --delegate, --scope, or --expires.
+
+Approving an entry that already carries a delegate's approval record with
+--by owner replaces that record with the owner's own — this is how a
+pending delegate approval is durably confirmed.
+
+Exit codes: 0 = written (every named entry approved or revoked; the
+registry file was updated), 1 = refused (an unknown, retired, or — for a
+delegate approval — out-of-scope entry id was named; every problem is
+printed and nothing is written), 2 = could not run (bad arguments, or the
+registry file is missing/unreadable/not valid JSON/fails schema
+validation; nothing is written).
+`;
+/** Bad arguments only — never thrown once the registry file has been read. */
+class ApproveInputError extends Error {
+}
+function parseRawArgs(argv) {
+    let registryFile;
+    const entryIds = [];
+    let by;
+    let delegate;
+    let scope;
+    let expires;
+    let revoke = false;
+    let help = false;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            help = true;
+            continue;
+        }
+        if (arg === "--revoke") {
+            revoke = true;
+            continue;
+        }
+        if (arg === "--by") {
+            const value = argv[++i];
+            if (value === undefined || value.startsWith("-"))
+                throw new ApproveInputError("--by requires a value");
+            by = value;
+            continue;
+        }
+        if (arg === "--delegate") {
+            const value = argv[++i];
+            if (value === undefined || value.startsWith("-"))
+                throw new ApproveInputError("--delegate requires a value");
+            delegate = value;
+            continue;
+        }
+        if (arg === "--scope") {
+            const value = argv[++i];
+            if (value === undefined || value.startsWith("-"))
+                throw new ApproveInputError("--scope requires a value");
+            const tokens = value.split(",").map((token) => token.trim());
+            scope = [...(scope ?? []), ...tokens];
+            continue;
+        }
+        if (arg === "--expires") {
+            const value = argv[++i];
+            if (value === undefined || value.startsWith("-")) {
+                throw new ApproveInputError("--expires requires an ISO 8601 UTC timestamp");
+            }
+            expires = value;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            throw new ApproveInputError(`unknown flag "${arg}"`);
+        }
+        if (registryFile === undefined) {
+            registryFile = arg;
+        }
+        else {
+            entryIds.push(arg);
+        }
+    }
+    return { registryFile, entryIds, by, delegate, scope, expires, revoke, help };
+}
+/**
+ * `YYYY-MM-DDTHH:MM:SS(.sss)?Z` — deliberately the same shape
+ * `schema.ts`'s own (unexported) `ISO_UTC_TIMESTAMP_RE` accepts for
+ * `approvedAt`/`expiresAt`, so a value this command accepts on argv is
+ * never one `validateCopyRegistryShape` would then reject from the file
+ * this command just wrote. `Date.parse` must also actually accept it, so a
+ * string that merely matches the pattern but names an impossible date
+ * (e.g. a bad month) is still rejected.
+ */
+function validateExpires(raw, now) {
+    if (!isIsoUtcTimestamp(raw)) {
+        throw new ApproveInputError(`--expires must be an ISO 8601 UTC timestamp (e.g. 2026-01-01T00:00:00Z), got ${JSON.stringify(raw)}`);
+    }
+    if (Date.parse(raw) <= now.getTime()) {
+        throw new ApproveInputError(`--expires ${JSON.stringify(raw)} must be strictly after the current time`);
+    }
+    return raw;
+}
+/**
+ * Turns the raw, syntactically-parsed argv into a fully validated action —
+ * every semantic rule this command enforces before ever touching the
+ * registry file lives here. Throws `ApproveInputError` on the first
+ * violation, matching every other subcommand's `parseArgs` in this
+ * package.
+ */
+function validateArgs(raw, now) {
+    if (!raw.registryFile) {
+        throw new ApproveInputError("registry-file is required");
+    }
+    if (raw.entryIds.length === 0) {
+        throw new ApproveInputError("at least one entry-id is required");
+    }
+    if (!raw.revoke && raw.by === undefined) {
+        throw new ApproveInputError("exactly one of --by or --revoke is required");
+    }
+    let action;
+    if (raw.revoke) {
+        if (raw.by !== undefined || raw.delegate !== undefined || raw.scope !== undefined || raw.expires !== undefined) {
+            throw new ApproveInputError("--revoke cannot be combined with --by, --delegate, --scope, or --expires");
+        }
+        action = { kind: "revoke" };
+    }
+    else if (raw.by === "owner") {
+        if (raw.delegate !== undefined || raw.scope !== undefined || raw.expires !== undefined) {
+            throw new ApproveInputError("--by owner cannot be combined with --delegate, --scope, or --expires");
+        }
+        action = { kind: "approve-owner" };
+    }
+    else if (raw.by === "delegate") {
+        if (raw.delegate === undefined) {
+            throw new ApproveInputError("--by delegate requires --delegate <id>");
+        }
+        if (raw.delegate.trim().length === 0) {
+            throw new ApproveInputError("--delegate must not be empty");
+        }
+        const delegateId = raw.delegate;
+        if (raw.scope === undefined || raw.scope.length === 0) {
+            throw new ApproveInputError("--by delegate requires --scope <ns>[,<ns>...]");
+        }
+        for (const item of raw.scope) {
+            if (!isDelegateScopeItem(item)) {
+                throw new ApproveInputError(`invalid --scope item ${JSON.stringify(item)}`);
+            }
+        }
+        const expiresAt = raw.expires !== undefined ? validateExpires(raw.expires, now) : undefined;
+        action = { kind: "approve-delegate", delegate: delegateId, scope: raw.scope, expiresAt };
+    }
+    else {
+        throw new ApproveInputError(`--by must be "owner" or "delegate", got ${JSON.stringify(raw.by)}`);
+    }
+    return { registryFile: raw.registryFile, entryIds: [...new Set(raw.entryIds)], action };
+}
+/**
+ * Reads, parses, and shape-validates the registry file — never throws.
+ * Deliberately does NOT go through `parseCopyRegistry`/`buildCopyRegistry`
+ * (`schema.ts`): those rebuild a fresh object from validated fields, which
+ * would lose the original file's key order and any field this package
+ * does not itself model. This command mutates the raw parsed JSON value in
+ * place instead (see `mainApproveCommand`), so it only needs
+ * `validateCopyRegistryShape`'s findings, never a rebuilt object.
+ */
+function readRegistry(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        return {
+            ok: false,
+            messages: [`registry file "${path}" could not be read: ${error instanceof Error ? error.message : String(error)}`],
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            messages: [`registry file "${path}" is not valid JSON: ${error instanceof Error ? error.message : String(error)}`],
+        };
+    }
+    const findings = validateCopyRegistryShape(parsed);
+    if (findings.length > 0) {
+        return {
+            ok: false,
+            messages: findings.map((f) => `[${f.rule}]${f.path ? ` ${f.path}:` : ""} ${f.message}`),
+        };
+    }
+    return { ok: true, parsed: parsed, messages: [] };
+}
+function indexEntries(parsed) {
+    const entries = parsed.entries;
+    const byId = new Map();
+    for (const raw of entries) {
+        const entry = raw;
+        byId.set(entry.id, entry);
+    }
+    return byId;
+}
+/**
+ * All-or-nothing pre-flight: every requested id that is unknown, retired,
+ * or (for a delegate approval) outside `--scope` is collected here, so
+ * `mainApproveCommand` can print every problem and refuse the WHOLE batch
+ * — never write some of the requested entries and skip others.
+ */
+function findProblems(entriesById, entryIds, action) {
+    const problems = [];
+    for (const id of entryIds) {
+        const entry = entriesById.get(id);
+        if (!entry) {
+            problems.push(`unknown entry id "${id}"`);
+            continue;
+        }
+        if (entry.status === "retired") {
+            problems.push(`entry "${id}" is retired and cannot be approved or revoked`);
+            continue;
+        }
+        if (action.kind === "approve-delegate" && !isEntryInDelegateScope(id, action.scope)) {
+            problems.push(`entry "${id}" is outside delegate scope [${action.scope.join(", ")}]`);
+        }
+    }
+    return problems;
+}
+/**
+ * Builds a fresh `CopyApproval`-shaped record with keys in the exact order
+ * this package's contract fixes: `approvedBy`, `approvedAt`,
+ * `textFingerprint`, `fingerprintAlgorithm`, then — delegate records only —
+ * `delegate`, `pendingOwnerReview`, `expiresAt`. Assigning this whole
+ * object to `entry.approval` either appends a new `approval` key at the
+ * end of the entry (it did not exist before) or replaces an existing one
+ * in place (its position in the entry is unchanged, because reassigning an
+ * existing object key never moves it) — see this file's top doc comment
+ * and `mainApproveCommand` for why that is exactly the key-order contract
+ * this command must preserve.
+ */
+function buildApprovalRecord(action, entry, now) {
+    const record = {
+        approvedBy: action.kind === "approve-delegate" ? "delegate" : "owner",
+        approvedAt: now.toISOString(),
+        textFingerprint: computeCopyFingerprint(entry.text),
+        fingerprintAlgorithm: COPY_FINGERPRINT_ALGORITHM,
+    };
+    if (action.kind === "approve-delegate") {
+        record.delegate = { id: action.delegate, scope: [...action.scope] };
+        record.pendingOwnerReview = true;
+        if (action.expiresAt !== undefined) {
+            record.expiresAt = action.expiresAt;
+        }
+    }
+    return record;
+}
+/**
+ * Writes `data` to `path` by writing a temp file in the SAME directory,
+ * then `renameSync`-ing it into place, so the registry file is replaced by
+ * one rename rather than rewritten in place. The temp file is cleaned up
+ * on any failure; a failure after a successful `renameSync` cannot happen,
+ * since nothing runs after it.
+ */
+function writeRegistryFile(path, data) {
+    const dir = dirname(path);
+    const base = basename(path);
+    const tempPath = join(dir, `.${base}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    const content = `${JSON.stringify(data, null, 2)}\n`;
+    try {
+        writeFileSync(tempPath, content, "utf8");
+        renameSync(tempPath, path);
+    }
+    catch (error) {
+        try {
+            if (existsSync(tempPath))
+                unlinkSync(tempPath);
+        }
+        catch {
+            // Best-effort cleanup only — the original error below is what matters.
+        }
+        throw error;
+    }
+}
+/**
+ * Exported (unlike a typical CLI `main`) so this package's tests (which do
+ * not ship) can exercise the whole argv-to-exit-code contract directly against real
+ * `mkdtemp` fixture files, without spawning a subprocess — see this file's
+ * top doc comment for the full exit-code contract. `argv` excludes the
+ * leading `"approve"` subcommand token. `io.now` lets a test pin the clock
+ * that `approvedAt` and `--expires` validation are measured against;
+ * omitted, it defaults to `new Date()`.
+ *
+ * Never throws: every failure, expected or not, is caught here and mapped
+ * to an exit code — bad arguments and an untrustworthy registry file both
+ * become 2 with nothing written, a refused (but well-formed) request
+ * becomes 1 with nothing written, and a clean run becomes 0 with the
+ * registry file updated on disk.
+ */
+export function mainApproveCommand(argv, io = {}) {
+    try {
+        const now = io.now ?? new Date();
+        const raw = parseRawArgs(argv);
+        if (raw.help) {
+            console.log(APPROVE_USAGE);
+            return 0;
+        }
+        const validated = validateArgs(raw, now);
+        const registryFile = resolve(validated.registryFile);
+        const read = readRegistry(registryFile);
+        if (!read.ok || !read.parsed) {
+            console.error(`[approve] registry could not be loaded:`);
+            for (const message of read.messages)
+                console.error(`  ${message}`);
+            console.error("[approve] Refusing to modify a registry that could not be fully validated.");
+            return 2;
+        }
+        const entriesById = indexEntries(read.parsed);
+        const problems = findProblems(entriesById, validated.entryIds, validated.action);
+        if (problems.length > 0) {
+            console.error(`[approve] refusing to write — ${problems.length} problem(s) with the requested entries:`);
+            for (const problem of problems)
+                console.error(`  ${problem}`);
+            return 1;
+        }
+        const lines = [];
+        for (const id of validated.entryIds) {
+            const entry = entriesById.get(id);
+            if (validated.action.kind === "revoke") {
+                entry.status = "draft";
+                delete entry.approval;
+                lines.push(`[approve] ${id}: revoked (now draft)`);
+            }
+            else {
+                entry.status = "approved";
+                entry.approval = buildApprovalRecord(validated.action, entry, now);
+                lines.push(validated.action.kind === "approve-delegate"
+                    ? `[approve] ${id}: approved by delegate ${validated.action.delegate} (pending owner review)`
+                    : `[approve] ${id}: approved by owner`);
+            }
+        }
+        writeRegistryFile(registryFile, read.parsed);
+        for (const line of lines)
+            console.log(line);
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof ApproveInputError) {
+            console.error(`writer-check approve: ${error.message}`);
+            console.error(`\n${APPROVE_USAGE}`);
+            return 2;
+        }
+        console.error(`writer-check approve: unexpected error: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        return 2;
+    }
+}
+//# sourceMappingURL=approve-cli.js.map

package/dist/approve-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-cli.js","sourceRoot":"","sources":["../src/approve-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyB5B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAwBxC,SAAS,YAAY,CAAC,IAAc;IAClC,IAAI,YAAgC,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAsB,CAAC;IAC3B,IAAI,QAA4B,CAAC;IACjC,IAAI,KAA2B,CAAC;IAChC,IAAI,OAA2B,CAAC;IAChC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;YACvG,EAAE,GAAG,KAAK,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7G,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,GAAS;IAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,gFAAgF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,GAAS;IAC3C,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/G,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,iBAAiB,CAAC,sEAAsE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACrC,CAAC;SAAM,IAAI,GAAG,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC1F,CAAC;AAQD;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,kBAAkB,IAAI,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnH,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,kBAAkB,IAAI,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAiC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAoB,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAY,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,WAAiD,EACjD,QAAkB,EAClB,MAAqB;IAErB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,gDAAgD,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,gCAAgC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAAC,MAAqB,EAAE,KAA8B,EAAE,GAAS;IAC3F,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;QACrE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,eAAe,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAc,CAAC;QAC7D,oBAAoB,EAAE,0BAA0B;KACjD,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACjC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,IAAa;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACrD,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,KAAqB,EAAE;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAEzC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC5F,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,yCAAyC,CAAC,CAAC;YACzG,KAAK,MAAM,OAAO,IAAI,QAAQ;gBAAE,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAA4B,CAAC;YAC7D,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;gBACvB,OAAO,KAAK,CAAC,QAAQ,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC1B,KAAK,CAAC,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACnE,KAAK,CAAC,IAAI,CACR,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAC1C,CAAC,CAAC,aAAa,EAAE,0BAA0B,SAAS,CAAC,MAAM,CAAC,QAAQ,yBAAyB;oBAC7F,CAAC,CAAC,aAAa,EAAE,qBAAqB,CACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,KAAK,aAAa,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,CACX,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -109,6 +109,21 @@
  *       all. This is the explicit third state this gate is built around:
  *       "could not check" must never be reported as a pass.
  *
+ * A FIFTH and SIXTH subcommand, `approve` and `approval-state`, are
+ * dispatched the same way `addressability` and `passages` are — a fully
+ * separate top-level branch at the very bottom of this file, never folded
+ * through `main()`. `writer-check approve` writes a
+ * `CopyRegistryEntry.approval` record so nobody hand-edits one; its whole
+ * argument-parsing, validation, and atomic-write contract lives in
+ * `mainApproveCommand` (`./approve-cli.ts`) — this file only wires its
+ * exit code through. `writer-check approval-state` reports the current
+ * approval state of a registry from two angles at once: whether every
+ * approved entry's own record is current (`assessCopyApprovals`) and
+ * whether consumer source actually routes copy through the registry's
+ * approval lifecycle rather than around it (`scanApprovalBypass`/
+ * `checkApprovalBypass`); its own contract lives in
+ * `mainApprovalStateCommand` (`./approval.ts`).
+ *
  * A malformed `pathExclusions` entry (see `scan.ts`/`path-exclusions.ts`)
  * gets the same `2` treatment as `unchecked`, for the identical reason: an
  * exclusion list this run cannot trust means this run cannot say which

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwHG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,eAAe,EAAuB,MAAM,gBAAgB,CAAC;AAMxH,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAsEpF,qHAAqH;AACrH,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAojB3C;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;IAChD,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnD;AAmBD,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CA2R3C;AAsGD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAqCxD;AA4ID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAwC9D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuIG;AAWH,OAAO,EAAyB,KAAK,eAAe,EAAE,KAAK,eAAe,EAAuB,MAAM,gBAAgB,CAAC;AAQxH,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AA6EpF,qHAAqH;AACrH,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAojB3C;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,eAAe,CAAC;IAChD,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnD;AAmBD,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CA2R3C;AAsGD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAqCxD;AA4ID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAwC9D"}

package/dist/cli.js

@@ -109,6 +109,21 @@
  *       all. This is the explicit third state this gate is built around:
  *       "could not check" must never be reported as a pass.
  *
+ * A FIFTH and SIXTH subcommand, `approve` and `approval-state`, are
+ * dispatched the same way `addressability` and `passages` are — a fully
+ * separate top-level branch at the very bottom of this file, never folded
+ * through `main()`. `writer-check approve` writes a
+ * `CopyRegistryEntry.approval` record so nobody hand-edits one; its whole
+ * argument-parsing, validation, and atomic-write contract lives in
+ * `mainApproveCommand` (`./approve-cli.ts`) — this file only wires its
+ * exit code through. `writer-check approval-state` reports the current
+ * approval state of a registry from two angles at once: whether every
+ * approved entry's own record is current (`assessCopyApprovals`) and
+ * whether consumer source actually routes copy through the registry's
+ * approval lifecycle rather than around it (`scanApprovalBypass`/
+ * `checkApprovalBypass`); its own contract lives in
+ * `mainApprovalStateCommand` (`./approval.ts`).
+ *
  * A malformed `pathExclusions` entry (see `scan.ts`/`path-exclusions.ts`)
  * gets the same `2` treatment as `unchecked`, for the identical reason: an
  * exclusion list this run cannot trust means this run cannot say which
@@ -128,6 +143,8 @@ import { checkCopyTraceability } from "./copy-gate.js";
 import { checkLocaleCoverage } from "./locale-coverage.js";
 import { liveTreeExists, scanLiveCopyTrees } from "./live-copy-gate.js";
 import { checkPassageComposition, readPassageRecord } from "./passage.js";
+import { mainApprovalStateCommand } from "./approval.js";
+import { mainApproveCommand } from "./approve-cli.js";
 import { readCopyRecord } from "./registry.js";
 import { checkRenderRegistryParity } from "./render-registry-parity.js";
 import { scanCopySourceTree } from "./scan.js";
@@ -140,13 +157,18 @@ const USAGE = `Usage: writer-check <record-file> [scan-dir] [options]
   record-file    Path to a CopyRecord JSON file (see @clossys/writer's README). Required.
   scan-dir       Directory to scan for user-facing string/template literals. Defaults to the current working directory.
 
-See also "writer-check addressability [scan-dir]" and "writer-check passages
-<registry-file>" (this same file's other subcommands, both dispatched on
-argv[0] before anything below) — addressability asks whether user-facing
-prose is resolved from the copy registry by id, rather than typed inline;
-passages asks whether a passage composes registered entries/terms rather
-than inlining a literal or reaching into another passage's internals. Both
-are separate, stricter gates; neither runs as part of this default command.
+See also "writer-check addressability [scan-dir]", "writer-check passages
+<registry-file>", "writer-check approve <registry-file> <entry-id>...", and
+"writer-check approval-state <registry-file> <scan-dir>" (this same file's
+other subcommands, all dispatched on argv[0] before anything below) —
+addressability asks whether user-facing prose is resolved from the copy
+registry by id, rather than typed inline; passages asks whether a passage
+composes registered entries/terms rather than inlining a literal or
+reaching into another passage's internals; approve writes an entry's
+approval record; approval-state reports whether a
+registry's approval records are current and whether consumer source
+actually routes copy through them. All four are separate gates/commands;
+none runs as part of this default command.
 
 Options:
   --help         Print this message and exit 0.
@@ -170,6 +192,8 @@ Run "writer-check voice-derivation-coverage --help" for the second subcommand's
 Run "writer-check locale-coverage --help" for the third subcommand's own usage.
 Run "writer-check addressability --help" for that subcommand's own usage.
 Run "writer-check passages --help" for the passage-composition subcommand's own usage.
+Run "writer-check approve --help" for the approval-recording subcommand's own usage.
+Run "writer-check approval-state --help" for the approval-state subcommand's own usage.
 `;
 const VOICE_DERIVATION_COVERAGE_USAGE = `Usage: writer-check voice-derivation-coverage <obligations-file> <brand-derived-rule-ids-file> [options]
 
@@ -1301,11 +1325,12 @@ function detectMainModule() {
     }
 }
 /**
- * `writer-check`, `writer-check addressability`, and `writer-check passages`
- * are ONE `bin` entry, one compiled file, dispatched by an explicit FIRST
- * ARGUMENT — never by how this file was invoked (its own path, a symlink
- * name, an installed `bin` shim, ...). That is deliberate: this
- * repository's own root `package.json` invokes every gate by compiled path
+ * `writer-check`, `writer-check addressability`, `writer-check passages`,
+ * `writer-check approve`, and `writer-check approval-state` are ONE `bin`
+ * entry, one compiled file, dispatched by an explicit FIRST ARGUMENT — never
+ * by how this file was invoked (its own path, a symlink name, an installed
+ * `bin` shim, ...). That is deliberate: this repository's own root
+ * `package.json` invokes every gate by compiled path
  * (`node packages/ui/dist/tokens/contrast-cli.js`,
  * `node packages/controller/dist/cli.js`, ...), never by `bin` name, so
  * any dispatch keyed on the invoking path/name (a second `bin` entry
@@ -1315,7 +1340,11 @@ function detectMainModule() {
  * exactly the "runs the wrong thing without ever failing" failure mode a
  * gate must never have. `rawArgs[0]` is read BEFORE `main()`'s own
  * `parseArgs` ever sees the array, so the default command's argument
- * shape is completely unaffected by either subcommand existing at all.
+ * shape is completely unaffected by any subcommand existing at all.
+ * `mainApproveCommand`/`mainApprovalStateCommand` never throw (see their own
+ * doc comments), so — unlike `runAddressabilityCheck`/`runPassagesCheck`
+ * above — their branches assign `process.exitCode` directly, with no
+ * try/catch wrapper of their own to add.
  */
 if (detectMainModule()) {
     const rawArgs = process.argv.slice(2);
@@ -1325,6 +1354,12 @@ if (detectMainModule()) {
     else if (rawArgs[0] === "passages") {
         runPassagesCheck(rawArgs.slice(1));
     }
+    else if (rawArgs[0] === "approve") {
+        process.exitCode = mainApproveCommand(rawArgs.slice(1));
+    }
+    else if (rawArgs[0] === "approval-state") {
+        process.exitCode = mainApprovalStateCommand(rawArgs.slice(1));
+    }
     else {
         run();
     }