@ddt-tools/cli 0.2.0 → 0.2.5

package/dist/advise-tests-YNMKVJCD.js

@@ -0,0 +1,87 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/advise-tests.ts
+import { promises as fs } from "fs";
+import path from "path";
+import { Command } from "commander";
+import { ai, regressionAdvisor } from "@ddt-tools/core";
+function adviseTestsCommand() {
+  const cmd = new Command("advise-tests");
+  cmd.description(
+    "PR-time AI regression-test advisor. Walks the DDT feature catalog, flags features whose surfaces match the changed files, and recommends 1\u20138 tests to add alongside the diff."
+  ).option(
+    "--changed-files <path>",
+    "File containing one changed-file path per line. Defaults to reading from stdin when not provided."
+  ).option(
+    "--diff-summary <text>",
+    'Optional prose summary of the diff. Use "-" to read from stdin.'
+  ).option(
+    "--existing-tests <path>",
+    "File listing existing test file paths so the advisor avoids duplicates."
+  ).option("--format <fmt>", "Output format: markdown | json. Default markdown.", "markdown").option("-o, --out <path>", "Output file path. Defaults to stdout.").option(
+    "--ai-max-spend <usd>",
+    "Refuse the AI call if today's estimated spend \u2265 this (USD). 0 = no cap.",
+    "0"
+  ).action(async (opts) => {
+    await runAdviseTests(opts, "ddt");
+  });
+  return cmd;
+}
+async function runAdviseTests(opts, toolName) {
+  const changedFiles = opts.changedFiles ? splitLines(await fs.readFile(path.resolve(String(opts.changedFiles)), "utf8")) : splitLines(await readStdin());
+  if (changedFiles.length === 0) {
+    throw new Error(
+      "advise-tests: no changed files supplied. Pass --changed-files or pipe via stdin."
+    );
+  }
+  const diffSummary = opts.diffSummary === "-" ? await readStdin() : opts.diffSummary ? String(opts.diffSummary) : void 0;
+  const existingTestFiles = opts.existingTests ? splitLines(await fs.readFile(path.resolve(String(opts.existingTests)), "utf8")) : void 0;
+  const result = await regressionAdvisor.adviseTests(
+    {
+      changedFiles,
+      ...diffSummary ? { diffSummary } : {},
+      ...existingTestFiles ? { existingTestFiles } : {}
+    },
+    {
+      completeFn: async (user, system) => {
+        const r = await ai.complete(
+          [
+            { role: "system", content: system },
+            { role: "user", content: user }
+          ],
+          {
+            feature: "advise-tests",
+            maxSpendUsd: Number(opts.aiMaxSpend ?? "0") || 0
+          }
+        );
+        return r.text;
+      }
+    },
+    toolName
+  );
+  const format = String(opts.format ?? "markdown").toLowerCase();
+  const payload = format === "json" ? JSON.stringify({ ...result, rawModelText: void 0 }, null, 2) : regressionAdvisor.renderAdvisorMarkdown(result, toolName);
+  if (opts.out) {
+    const outPath = path.resolve(String(opts.out));
+    await fs.mkdir(path.dirname(outPath), { recursive: true });
+    await fs.writeFile(outPath, payload + (payload.endsWith("\n") ? "" : "\n"), "utf8");
+    console.error(`Wrote ${outPath} (${payload.length} bytes).`);
+  } else {
+    process.stdout.write(payload + (payload.endsWith("\n") ? "" : "\n"));
+  }
+}
+function splitLines(s) {
+  return s.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+export {
+  adviseTestsCommand,
+  runAdviseTests
+};
+//# sourceMappingURL=advise-tests-YNMKVJCD.js.map

package/dist/advise-tests-YNMKVJCD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/advise-tests.ts"],"sourcesContent":["/**\n * `ddt advise-tests` — AI-assisted regression-test recommender\n * (Testing Infrastructure Phase 4).\n *\n * Walks a list of changed files (typically the output of\n * `git diff --name-only base..head`), runs a pre-AI heuristic against\n * `@ddt-tools/core/features.DDT_FEATURE_CATALOG`, and asks the configured AI\n * provider to recommend a minimal regression-test set.\n *\n * Mirrors `sdt advise-tests`.\n */\nimport { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { Command } from 'commander';\nimport { ai, regressionAdvisor } from '@ddt-tools/core';\n\nexport function adviseTestsCommand(): Command {\n  const cmd = new Command('advise-tests');\n  cmd\n    .description(\n      'PR-time AI regression-test advisor. Walks the DDT feature catalog, flags features whose surfaces match the changed files, ' +\n        'and recommends 1–8 tests to add alongside the diff.',\n    )\n    .option(\n      '--changed-files <path>',\n      'File containing one changed-file path per line. Defaults to reading from stdin when not provided.',\n    )\n    .option(\n      '--diff-summary <text>',\n      'Optional prose summary of the diff. Use \"-\" to read from stdin.',\n    )\n    .option(\n      '--existing-tests <path>',\n      'File listing existing test file paths so the advisor avoids duplicates.',\n    )\n    .option('--format <fmt>', 'Output format: markdown | json. Default markdown.', 'markdown')\n    .option('-o, --out <path>', 'Output file path. Defaults to stdout.')\n    .option(\n      '--ai-max-spend <usd>',\n      \"Refuse the AI call if today's estimated spend ≥ this (USD). 0 = no cap.\",\n      '0',\n    )\n    .action(async (opts) => {\n      await runAdviseTests(opts, 'ddt');\n    });\n  return cmd;\n}\n\nexport async function runAdviseTests(\n  opts: Record<string, unknown>,\n  toolName: 'ddt' | 'ddt',\n): Promise<void> {\n  const changedFiles = opts.changedFiles\n    ? splitLines(await fs.readFile(path.resolve(String(opts.changedFiles)), 'utf8'))\n    : splitLines(await readStdin());\n  if (changedFiles.length === 0) {\n    throw new Error(\n      'advise-tests: no changed files supplied. Pass --changed-files or pipe via stdin.',\n    );\n  }\n  const diffSummary =\n    opts.diffSummary === '-'\n      ? await readStdin()\n      : opts.diffSummary\n        ? String(opts.diffSummary)\n        : undefined;\n  const existingTestFiles = opts.existingTests\n    ? splitLines(await fs.readFile(path.resolve(String(opts.existingTests)), 'utf8'))\n    : undefined;\n\n  const result = await regressionAdvisor.adviseTests(\n    {\n      changedFiles,\n      ...(diffSummary ? { diffSummary } : {}),\n      ...(existingTestFiles ? { existingTestFiles } : {}),\n    },\n    {\n      completeFn: async (user, system) => {\n        const r = await ai.complete(\n          [\n            { role: 'system', content: system },\n            { role: 'user', content: user },\n          ],\n          {\n            feature: 'advise-tests',\n            maxSpendUsd: Number(opts.aiMaxSpend ?? '0') || 0,\n          },\n        );\n        return r.text;\n      },\n    },\n    toolName,\n  );\n\n  const format = String(opts.format ?? 'markdown').toLowerCase();\n  const payload =\n    format === 'json'\n      ? JSON.stringify({ ...result, rawModelText: undefined }, null, 2)\n      : regressionAdvisor.renderAdvisorMarkdown(result, toolName);\n\n  if (opts.out) {\n    const outPath = path.resolve(String(opts.out));\n    await fs.mkdir(path.dirname(outPath), { recursive: true });\n    await fs.writeFile(outPath, payload + (payload.endsWith('\\n') ? '' : '\\n'), 'utf8');\n    console.error(`Wrote ${outPath} (${payload.length} bytes).`);\n  } else {\n    process.stdout.write(payload + (payload.endsWith('\\n') ? '' : '\\n'));\n  }\n}\n\nfunction splitLines(s: string): string[] {\n  return s\n    .split(/\\r?\\n/)\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0 && !l.startsWith('#'));\n}\n\nasync function readStdin(): Promise<string> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of process.stdin) {\n    chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : (chunk as Buffer));\n  }\n  return Buffer.concat(chunks).toString('utf8');\n}\n"],"mappings":";;;AAWA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,eAAe;AACxB,SAAS,IAAI,yBAAyB;AAE/B,SAAS,qBAA8B;AAC5C,QAAM,MAAM,IAAI,QAAQ,cAAc;AACtC,MACG;AAAA,IACC;AAAA,EAEF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,kBAAkB,qDAAqD,UAAU,EACxF,OAAO,oBAAoB,uCAAuC,EAClE;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,SAAS;AACtB,UAAM,eAAe,MAAM,KAAK;AAAA,EAClC,CAAC;AACH,SAAO;AACT;AAEA,eAAsB,eACpB,MACA,UACe;AACf,QAAM,eAAe,KAAK,eACtB,WAAW,MAAM,GAAG,SAAS,KAAK,QAAQ,OAAO,KAAK,YAAY,CAAC,GAAG,MAAM,CAAC,IAC7E,WAAW,MAAM,UAAU,CAAC;AAChC,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,cACJ,KAAK,gBAAgB,MACjB,MAAM,UAAU,IAChB,KAAK,cACH,OAAO,KAAK,WAAW,IACvB;AACR,QAAM,oBAAoB,KAAK,gBAC3B,WAAW,MAAM,GAAG,SAAS,KAAK,QAAQ,OAAO,KAAK,aAAa,CAAC,GAAG,MAAM,CAAC,IAC9E;AAEJ,QAAM,SAAS,MAAM,kBAAkB;AAAA,IACrC;AAAA,MACE;AAAA,MACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACrC,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,IACnD;AAAA,IACA;AAAA,MACE,YAAY,OAAO,MAAM,WAAW;AAClC,cAAM,IAAI,MAAM,GAAG;AAAA,UACjB;AAAA,YACE,EAAE,MAAM,UAAU,SAAS,OAAO;AAAA,YAClC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,UAChC;AAAA,UACA;AAAA,YACE,SAAS;AAAA,YACT,aAAa,OAAO,KAAK,cAAc,GAAG,KAAK;AAAA,UACjD;AAAA,QACF;AACA,eAAO,EAAE;AAAA,MACX;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,KAAK,UAAU,UAAU,EAAE,YAAY;AAC7D,QAAM,UACJ,WAAW,SACP,KAAK,UAAU,EAAE,GAAG,QAAQ,cAAc,OAAU,GAAG,MAAM,CAAC,IAC9D,kBAAkB,sBAAsB,QAAQ,QAAQ;AAE9D,MAAI,KAAK,KAAK;AACZ,UAAM,UAAU,KAAK,QAAQ,OAAO,KAAK,GAAG,CAAC;AAC7C,UAAM,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,UAAM,GAAG,UAAU,SAAS,WAAW,QAAQ,SAAS,IAAI,IAAI,KAAK,OAAO,MAAM;AAClF,YAAQ,MAAM,SAAS,OAAO,KAAK,QAAQ,MAAM,UAAU;AAAA,EAC7D,OAAO;AACL,YAAQ,OAAO,MAAM,WAAW,QAAQ,SAAS,IAAI,IAAI,KAAK,KAAK;AAAA,EACrE;AACF;AAEA,SAAS,WAAW,GAAqB;AACvC,SAAO,EACJ,MAAM,OAAO,EACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC;AACrD;AAEA,eAAe,YAA6B;AAC1C,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,QAAQ,OAAO;AACvC,WAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAK,KAAgB;AAAA,EAChF;AACA,SAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAC9C;","names":[]}

package/dist/ai-NTNPYEKZ.js

@@ -0,0 +1,86 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/ai.ts
+import { Command } from "commander";
+import { ai } from "@ddt-tools/core";
+function aiCommand() {
+  const cmd = new Command("ai");
+  cmd.description("Configure and test the AI provider adapter (BYO key).");
+  cmd.command("status").description("Show the resolved AI provider config (provider, model, key source).").action(async () => {
+    const config = await ai.resolveAiConfig();
+    const apiKey = ai.resolveApiKey(config);
+    console.log("AI provider config (configured):");
+    console.log(`  provider:    ${config.provider}`);
+    console.log(`  model:       ${config.model}`);
+    console.log(`  endpoint:    ${config.endpoint ?? "(provider default)"}`);
+    console.log(`  apiKey:      ${apiKey ? "\u2713 resolved" : "\u2717 not set"}`);
+    console.log(`  maxTokens:   ${config.maxTokens ?? "(provider default)"}`);
+    console.log(`  temperature: ${config.temperature ?? "(provider default)"}`);
+    console.log(
+      `  preferLocal: ${config.preferLocal !== false ? "true (local-first)" : "false (cloud only)"}`
+    );
+    console.log(`  configPath:  ${ai.defaultConfigPath()}`);
+    if (config.preferLocal !== false) {
+      const probe = await ai.detectOllamaAvailability({ fetch: globalThis.fetch });
+      console.log("Local Ollama probe:");
+      if (probe.available) {
+        const best = ai.pickBestLocalModel(probe.models);
+        console.log(`  status:   \u2713 available at ${probe.endpoint}`);
+        console.log(`  models:   ${probe.models.join(", ") || "(none pulled)"}`);
+        console.log(`  selected: ${best ?? "(none)"}`);
+        console.log("Effective routing: Ollama (local, zero cloud cost)");
+      } else {
+        console.log(`  status:   \u2717 unavailable (${probe.reason})`);
+        console.log(`  fallback: ${config.provider} / ${config.model}`);
+        console.log(`Effective routing: ${config.provider} (cloud)`);
+      }
+    }
+  });
+  cmd.command("test").description("Round-trip a small prompt against the configured provider.").option("--prompt <text>", "Prompt to send.", "Reply with exactly the four characters: PONG").option(
+    "--ai-max-spend <usd>",
+    "Refuse the call if today's estimated spend \u2265 this (USD). 0 = no cap.",
+    "0"
+  ).action(async (opts) => {
+    const result = await ai.complete(
+      [
+        { role: "system", content: "You are a terse assistant. Follow instructions exactly." },
+        { role: "user", content: String(opts.prompt) }
+      ],
+      {
+        feature: "ai.test",
+        maxSpendUsd: Number(opts.aiMaxSpend ?? "0") || 0
+      }
+    );
+    console.log(`Response from ${result.provider} (${result.model}):`);
+    console.log(result.text);
+    console.log(
+      `  tokens: ${result.usage.promptTokens} in / ${result.usage.completionTokens} out`
+    );
+  });
+  cmd.command("usage").description("Summarize the local AI usage ledger.").action(async () => {
+    const records = await ai.readUsage();
+    const today = ai.todayRecords(records);
+    const todayUsd = ai.totalSpend(today);
+    const allUsd = ai.totalSpend(records);
+    console.log("AI usage (local ledger):");
+    console.log(`  today:  ${today.length} call(s), ~$${todayUsd.toFixed(4)}`);
+    console.log(`  total:  ${records.length} call(s), ~$${allUsd.toFixed(4)}`);
+    console.log(`  ledger: ${ai.defaultUsagePath()}`);
+    if (records.length > 0) {
+      const byFeature = /* @__PURE__ */ new Map();
+      for (const r of records) {
+        const key = r.feature ?? "(unknown)";
+        byFeature.set(key, (byFeature.get(key) ?? 0) + 1);
+      }
+      console.log("  features:");
+      for (const [feature, count] of [...byFeature.entries()].sort((a, b) => b[1] - a[1])) {
+        console.log(`    ${feature}: ${count}`);
+      }
+    }
+  });
+  return cmd;
+}
+export {
+  aiCommand
+};
+//# sourceMappingURL=ai-NTNPYEKZ.js.map

package/dist/ai-NTNPYEKZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/ai.ts"],"sourcesContent":["/**\n * `ddt ai` — configure + test the AI provider adapter.\n *\n * Subcommands:\n *   ddt ai status     — show current config (provider, model, key source)\n *   ddt ai test       — round-trip a hello-world prompt\n *   ddt ai usage      — summarize ai-usage.json (today + this month)\n *\n * Phase-1 of the AI rollout (see docs/AI_FEATURES.md). Mirrors\n * `sdt ai` — same subcommands, same shape, only the default config\n * path differs (`~/.config/ddt/ai.json`).\n */\nimport { Command } from 'commander';\nimport { ai } from '@ddt-tools/core';\n\nexport function aiCommand(): Command {\n  const cmd = new Command('ai');\n  cmd.description('Configure and test the AI provider adapter (BYO key).');\n\n  cmd\n    .command('status')\n    .description('Show the resolved AI provider config (provider, model, key source).')\n    .action(async () => {\n      const config = await ai.resolveAiConfig();\n      const apiKey = ai.resolveApiKey(config);\n      console.log('AI provider config (configured):');\n      console.log(`  provider:    ${config.provider}`);\n      console.log(`  model:       ${config.model}`);\n      console.log(`  endpoint:    ${config.endpoint ?? '(provider default)'}`);\n      console.log(`  apiKey:      ${apiKey ? '✓ resolved' : '✗ not set'}`);\n      console.log(`  maxTokens:   ${config.maxTokens ?? '(provider default)'}`);\n      console.log(`  temperature: ${config.temperature ?? '(provider default)'}`);\n      console.log(\n        `  preferLocal: ${config.preferLocal !== false ? 'true (local-first)' : 'false (cloud only)'}`,\n      );\n      console.log(`  configPath:  ${ai.defaultConfigPath()}`);\n\n      if (config.preferLocal !== false) {\n        const probe = await ai.detectOllamaAvailability({ fetch: globalThis.fetch });\n        console.log('Local Ollama probe:');\n        if (probe.available) {\n          const best = ai.pickBestLocalModel(probe.models);\n          console.log(`  status:   ✓ available at ${probe.endpoint}`);\n          console.log(`  models:   ${probe.models.join(', ') || '(none pulled)'}`);\n          console.log(`  selected: ${best ?? '(none)'}`);\n          console.log('Effective routing: Ollama (local, zero cloud cost)');\n        } else {\n          console.log(`  status:   ✗ unavailable (${probe.reason})`);\n          console.log(`  fallback: ${config.provider} / ${config.model}`);\n          console.log(`Effective routing: ${config.provider} (cloud)`);\n        }\n      }\n    });\n\n  cmd\n    .command('test')\n    .description('Round-trip a small prompt against the configured provider.')\n    .option('--prompt <text>', 'Prompt to send.', 'Reply with exactly the four characters: PONG')\n    .option(\n      '--ai-max-spend <usd>',\n      \"Refuse the call if today's estimated spend ≥ this (USD). 0 = no cap.\",\n      '0',\n    )\n    .action(async (opts) => {\n      const result = await ai.complete(\n        [\n          { role: 'system', content: 'You are a terse assistant. Follow instructions exactly.' },\n          { role: 'user', content: String(opts.prompt) },\n        ],\n        {\n          feature: 'ai.test',\n          maxSpendUsd: Number(opts.aiMaxSpend ?? '0') || 0,\n        },\n      );\n      console.log(`Response from ${result.provider} (${result.model}):`);\n      console.log(result.text);\n      console.log(\n        `  tokens: ${result.usage.promptTokens} in / ${result.usage.completionTokens} out`,\n      );\n    });\n\n  cmd\n    .command('usage')\n    .description('Summarize the local AI usage ledger.')\n    .action(async () => {\n      const records = await ai.readUsage();\n      const today = ai.todayRecords(records);\n      const todayUsd = ai.totalSpend(today);\n      const allUsd = ai.totalSpend(records);\n      console.log('AI usage (local ledger):');\n      console.log(`  today:  ${today.length} call(s), ~$${todayUsd.toFixed(4)}`);\n      console.log(`  total:  ${records.length} call(s), ~$${allUsd.toFixed(4)}`);\n      console.log(`  ledger: ${ai.defaultUsagePath()}`);\n      if (records.length > 0) {\n        const byFeature = new Map<string, number>();\n        for (const r of records) {\n          const key = r.feature ?? '(unknown)';\n          byFeature.set(key, (byFeature.get(key) ?? 0) + 1);\n        }\n        console.log('  features:');\n        for (const [feature, count] of [...byFeature.entries()].sort((a, b) => b[1] - a[1])) {\n          console.log(`    ${feature}: ${count}`);\n        }\n      }\n    });\n\n  return cmd;\n}\n"],"mappings":";;;AAYA,SAAS,eAAe;AACxB,SAAS,UAAU;AAEZ,SAAS,YAAqB;AACnC,QAAM,MAAM,IAAI,QAAQ,IAAI;AAC5B,MAAI,YAAY,uDAAuD;AAEvE,MACG,QAAQ,QAAQ,EAChB,YAAY,qEAAqE,EACjF,OAAO,YAAY;AAClB,UAAM,SAAS,MAAM,GAAG,gBAAgB;AACxC,UAAM,SAAS,GAAG,cAAc,MAAM;AACtC,YAAQ,IAAI,kCAAkC;AAC9C,YAAQ,IAAI,kBAAkB,OAAO,QAAQ,EAAE;AAC/C,YAAQ,IAAI,kBAAkB,OAAO,KAAK,EAAE;AAC5C,YAAQ,IAAI,kBAAkB,OAAO,YAAY,oBAAoB,EAAE;AACvE,YAAQ,IAAI,kBAAkB,SAAS,oBAAe,gBAAW,EAAE;AACnE,YAAQ,IAAI,kBAAkB,OAAO,aAAa,oBAAoB,EAAE;AACxE,YAAQ,IAAI,kBAAkB,OAAO,eAAe,oBAAoB,EAAE;AAC1E,YAAQ;AAAA,MACN,kBAAkB,OAAO,gBAAgB,QAAQ,uBAAuB,oBAAoB;AAAA,IAC9F;AACA,YAAQ,IAAI,kBAAkB,GAAG,kBAAkB,CAAC,EAAE;AAEtD,QAAI,OAAO,gBAAgB,OAAO;AAChC,YAAM,QAAQ,MAAM,GAAG,yBAAyB,EAAE,OAAO,WAAW,MAAM,CAAC;AAC3E,cAAQ,IAAI,qBAAqB;AACjC,UAAI,MAAM,WAAW;AACnB,cAAM,OAAO,GAAG,mBAAmB,MAAM,MAAM;AAC/C,gBAAQ,IAAI,mCAA8B,MAAM,QAAQ,EAAE;AAC1D,gBAAQ,IAAI,eAAe,MAAM,OAAO,KAAK,IAAI,KAAK,eAAe,EAAE;AACvE,gBAAQ,IAAI,eAAe,QAAQ,QAAQ,EAAE;AAC7C,gBAAQ,IAAI,oDAAoD;AAAA,MAClE,OAAO;AACL,gBAAQ,IAAI,mCAA8B,MAAM,MAAM,GAAG;AACzD,gBAAQ,IAAI,eAAe,OAAO,QAAQ,MAAM,OAAO,KAAK,EAAE;AAC9D,gBAAQ,IAAI,sBAAsB,OAAO,QAAQ,UAAU;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,MAAM,EACd,YAAY,4DAA4D,EACxE,OAAO,mBAAmB,mBAAmB,8CAA8C,EAC3F;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,SAAS;AACtB,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,QACE,EAAE,MAAM,UAAU,SAAS,0DAA0D;AAAA,QACrF,EAAE,MAAM,QAAQ,SAAS,OAAO,KAAK,MAAM,EAAE;AAAA,MAC/C;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,aAAa,OAAO,KAAK,cAAc,GAAG,KAAK;AAAA,MACjD;AAAA,IACF;AACA,YAAQ,IAAI,iBAAiB,OAAO,QAAQ,KAAK,OAAO,KAAK,IAAI;AACjE,YAAQ,IAAI,OAAO,IAAI;AACvB,YAAQ;AAAA,MACN,aAAa,OAAO,MAAM,YAAY,SAAS,OAAO,MAAM,gBAAgB;AAAA,IAC9E;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,OAAO,EACf,YAAY,sCAAsC,EAClD,OAAO,YAAY;AAClB,UAAM,UAAU,MAAM,GAAG,UAAU;AACnC,UAAM,QAAQ,GAAG,aAAa,OAAO;AACrC,UAAM,WAAW,GAAG,WAAW,KAAK;AACpC,UAAM,SAAS,GAAG,WAAW,OAAO;AACpC,YAAQ,IAAI,0BAA0B;AACtC,YAAQ,IAAI,aAAa,MAAM,MAAM,eAAe,SAAS,QAAQ,CAAC,CAAC,EAAE;AACzE,YAAQ,IAAI,aAAa,QAAQ,MAAM,eAAe,OAAO,QAAQ,CAAC,CAAC,EAAE;AACzE,YAAQ,IAAI,aAAa,GAAG,iBAAiB,CAAC,EAAE;AAChD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,YAAY,oBAAI,IAAoB;AAC1C,iBAAW,KAAK,SAAS;AACvB,cAAM,MAAM,EAAE,WAAW;AACzB,kBAAU,IAAI,MAAM,UAAU,IAAI,GAAG,KAAK,KAAK,CAAC;AAAA,MAClD;AACA,cAAQ,IAAI,aAAa;AACzB,iBAAW,CAAC,SAAS,KAAK,KAAK,CAAC,GAAG,UAAU,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG;AACnF,gBAAQ,IAAI,OAAO,OAAO,KAAK,KAAK,EAAE;AAAA,MACxC;AAAA,IACF;AAAA,EACF,CAAC;AAEH,SAAO;AACT;","names":[]}

package/dist/anonymize-LERTWUQO.js

@@ -0,0 +1,139 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/anonymize.ts
+import { promises as fs } from "fs";
+import path from "path";
+import { Command } from "commander";
+import { loadProject, pac, parseProjectModel } from "@ddt-tools/core";
+function anonymizeCommand() {
+  const cmd = new Command("anonymize");
+  cmd.description("Generate column-mask DDL for PII columns detected in the project model.").requiredOption("--source <path>", ".ddtproj or .ddtpac to analyze.").option(
+    "--unmasked-user <name>",
+    "User / service-principal that sees unmasked values. Default 'ddt-deploy'.",
+    "ddt-deploy"
+  ).option(
+    "--mask-catalog <catalog>",
+    "Catalog the mask functions live in. Default: same catalog as the columns."
+  ).option("-o, --out <path>", "Output file path. Default: ./anonymize.sql in CWD.").action(async (opts) => {
+    const sourcePath = String(opts.source);
+    const model = await loadModel(sourcePath);
+    const unmaskedUser = String(opts.unmaskedUser);
+    const maskCatalog = opts.maskCatalog ? String(opts.maskCatalog) : void 0;
+    const candidates = collectPiiColumns(model);
+    if (candidates.length === 0) {
+      console.error("No PII columns detected (heuristic on column names).");
+      return;
+    }
+    const sql = renderAnonymizeSql(candidates, unmaskedUser, maskCatalog);
+    const outPath = opts.out ? path.resolve(String(opts.out)) : path.resolve("anonymize.sql");
+    await fs.mkdir(path.dirname(outPath), { recursive: true });
+    await fs.writeFile(outPath, sql, "utf8");
+    console.error(`Wrote ${outPath} (${candidates.length} column(s), ${sql.length} bytes).`);
+    console.error(
+      "Review the user allow-list before applying. Default fully masks values from every user except the one passed in."
+    );
+  });
+  return cmd;
+}
+function collectPiiColumns(model) {
+  const out = [];
+  for (const o of model) {
+    if (o.objectType !== "MANAGED_TABLE" && o.objectType !== "EXTERNAL_TABLE") continue;
+    const rec = o;
+    const cols = rec.columns;
+    if (!Array.isArray(cols)) continue;
+    const catalog = o.fqn.database ?? "main";
+    const schema = o.fqn.schema ?? "default";
+    for (const c of cols) {
+      const category = classify(c.name);
+      if (category) out.push({ catalog, schema, table: o.fqn.name, column: c.name, category });
+    }
+  }
+  return out;
+}
+function classify(name) {
+  const lower = name.toLowerCase();
+  if (/(^|_)email(_|$)/.test(lower)) return "email";
+  if (/(^|_)(phone|mobile|cell)(_|$)/.test(lower)) return "phone";
+  if (/(^|_)(first_name|last_name|full_name|surname|given_name)(_|$)/.test(lower)) return "name";
+  if (/(^|_)(dob|birth_date|date_of_birth)(_|$)/.test(lower)) return "dob";
+  if (/(^|_)ssn(_|$)/.test(lower) || /(^|_)tax_id(_|$)/.test(lower)) return "ssn";
+  if (/(^|_)(address|street|zip_code|postal_code|postcode)(_|$)/.test(lower)) return "address";
+  if (/(^|_)(credit_card|card_number)(_|$)/.test(lower)) return "credit-card";
+  return void 0;
+}
+function renderAnonymizeSql(cols, unmaskedUser, maskCatalogOverride) {
+  const lines = [];
+  lines.push(`-- Generated by \`ddt anonymize\`.`);
+  lines.push(
+    `-- Edit the user allow-list before applying. Default: only ${unmaskedUser} sees unmasked values.`
+  );
+  lines.push("");
+  const byCatalog = /* @__PURE__ */ new Map();
+  for (const c of cols) {
+    const target = maskCatalogOverride ?? c.catalog;
+    const arr = byCatalog.get(target) ?? [];
+    arr.push(c);
+    byCatalog.set(target, arr);
+  }
+  for (const [catalog, catalogCols] of byCatalog) {
+    const cats = new Set(catalogCols.map((c) => c.category));
+    lines.push(`-- \u2500\u2500 Mask functions in catalog \`${catalog}\`.security \u2500\u2500`);
+    lines.push(`CREATE SCHEMA IF NOT EXISTS ${catalog}.security;`);
+    lines.push("");
+    for (const cat of cats) {
+      lines.push(
+        `CREATE OR REPLACE FUNCTION ${catalog}.security.mask_${cat.replace(/-/g, "_")}(val STRING)`
+      );
+      lines.push(`  RETURNS STRING`);
+      lines.push(`  RETURN CASE`);
+      lines.push(
+        `    WHEN is_member('${unmaskedUser}') OR current_user() = '${unmaskedUser}' THEN val`
+      );
+      lines.push(`    ELSE ${maskExpression(cat)}`);
+      lines.push(`  END;`);
+      lines.push("");
+    }
+  }
+  lines.push("-- Apply masks to columns");
+  for (const c of cols) {
+    const fnCatalog = maskCatalogOverride ?? c.catalog;
+    const fnName = `${fnCatalog}.security.mask_${c.category.replace(/-/g, "_")}`;
+    lines.push(
+      `ALTER TABLE ${c.catalog}.${c.schema}.${c.table} ALTER COLUMN ${c.column} SET MASK ${fnName};`
+    );
+  }
+  lines.push("");
+  return lines.join("\n") + "\n";
+}
+function maskExpression(cat) {
+  switch (cat) {
+    case "email":
+      return `regexp_replace(val, '^(.).*(@.*)$', '$1***$2')`;
+    case "phone":
+      return `concat('***-***-', right(val, 4))`;
+    case "ssn":
+      return `concat('***-**-', right(val, 4))`;
+    case "credit-card":
+      return `concat('****-****-****-', right(val, 4))`;
+    case "dob":
+      return `concat(left(val, 4), '-XX-XX')`;
+    case "name":
+    case "address":
+    case "generic":
+    default:
+      return `sha2(val, 256)`;
+  }
+}
+async function loadModel(sourcePath) {
+  if (sourcePath.endsWith(".ddtpac")) {
+    const c = await pac.readPac(sourcePath);
+    return c.model;
+  }
+  const loaded = await loadProject(sourcePath);
+  return await parseProjectModel(loaded);
+}
+export {
+  anonymizeCommand
+};
+//# sourceMappingURL=anonymize-LERTWUQO.js.map

package/dist/anonymize-LERTWUQO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/anonymize.ts"],"sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { Command } from 'commander';\nimport { loadProject, pac, parseProjectModel, type DatabricksObject } from '@ddt-tools/core';\n\n/**\n * `ddt anonymize` — generate column-mask DDL for PII columns\n * discovered in a project model. Pairs with the L012 `pii-without-mask`\n * lint rule.\n *\n * Databricks Unity Catalog uses `ALTER TABLE ... ALTER COLUMN ... SET\n * MASK <function>` (column masks via UC functions). This command\n * generates:\n *   1. A UC FUNCTION per PII category (mask_email, mask_phone, …)\n *      that returns the value unchanged when current_user() is in an\n *      allow-list, else returns a masked variant.\n *   2. ALTER COLUMN SET MASK statements wiring each PII column to\n *      its category's function.\n *\n * Output is conservative: default allow-list is just the deploy\n * service-principal; production access should be added before\n * applying.\n */\nexport function anonymizeCommand(): Command {\n  const cmd = new Command('anonymize');\n  cmd\n    .description('Generate column-mask DDL for PII columns detected in the project model.')\n    .requiredOption('--source <path>', '.ddtproj or .ddtpac to analyze.')\n    .option(\n      '--unmasked-user <name>',\n      \"User / service-principal that sees unmasked values. Default 'ddt-deploy'.\",\n      'ddt-deploy',\n    )\n    .option(\n      '--mask-catalog <catalog>',\n      'Catalog the mask functions live in. Default: same catalog as the columns.',\n    )\n    .option('-o, --out <path>', 'Output file path. Default: ./anonymize.sql in CWD.')\n    .action(async (opts) => {\n      const sourcePath = String(opts.source);\n      const model = await loadModel(sourcePath);\n      const unmaskedUser = String(opts.unmaskedUser);\n      const maskCatalog = opts.maskCatalog ? String(opts.maskCatalog) : undefined;\n      const candidates = collectPiiColumns(model);\n      if (candidates.length === 0) {\n        console.error('No PII columns detected (heuristic on column names).');\n        return;\n      }\n      const sql = renderAnonymizeSql(candidates, unmaskedUser, maskCatalog);\n      const outPath = opts.out ? path.resolve(String(opts.out)) : path.resolve('anonymize.sql');\n      await fs.mkdir(path.dirname(outPath), { recursive: true });\n      await fs.writeFile(outPath, sql, 'utf8');\n      console.error(`Wrote ${outPath} (${candidates.length} column(s), ${sql.length} bytes).`);\n      console.error(\n        'Review the user allow-list before applying. Default fully masks values from every user except the one passed in.',\n      );\n    });\n  return cmd;\n}\n\ninterface PiiColumn {\n  catalog: string;\n  schema: string;\n  table: string;\n  column: string;\n  category: 'email' | 'phone' | 'name' | 'dob' | 'ssn' | 'address' | 'credit-card' | 'generic';\n}\n\nfunction collectPiiColumns(model: readonly DatabricksObject[]): PiiColumn[] {\n  const out: PiiColumn[] = [];\n  for (const o of model) {\n    if (o.objectType !== 'MANAGED_TABLE' && o.objectType !== 'EXTERNAL_TABLE') continue;\n    const rec = o as unknown as Record<string, unknown>;\n    const cols = rec.columns as Array<{ name: string }> | undefined;\n    if (!Array.isArray(cols)) continue;\n    const catalog = o.fqn.database ?? 'main';\n    const schema = o.fqn.schema ?? 'default';\n    for (const c of cols) {\n      const category = classify(c.name);\n      if (category) out.push({ catalog, schema, table: o.fqn.name, column: c.name, category });\n    }\n  }\n  return out;\n}\n\nfunction classify(name: string): PiiColumn['category'] | undefined {\n  const lower = name.toLowerCase();\n  if (/(^|_)email(_|$)/.test(lower)) return 'email';\n  if (/(^|_)(phone|mobile|cell)(_|$)/.test(lower)) return 'phone';\n  if (/(^|_)(first_name|last_name|full_name|surname|given_name)(_|$)/.test(lower)) return 'name';\n  if (/(^|_)(dob|birth_date|date_of_birth)(_|$)/.test(lower)) return 'dob';\n  if (/(^|_)ssn(_|$)/.test(lower) || /(^|_)tax_id(_|$)/.test(lower)) return 'ssn';\n  if (/(^|_)(address|street|zip_code|postal_code|postcode)(_|$)/.test(lower)) return 'address';\n  if (/(^|_)(credit_card|card_number)(_|$)/.test(lower)) return 'credit-card';\n  return undefined;\n}\n\nfunction renderAnonymizeSql(\n  cols: PiiColumn[],\n  unmaskedUser: string,\n  maskCatalogOverride: string | undefined,\n): string {\n  const lines: string[] = [];\n  lines.push(`-- Generated by \\`ddt anonymize\\`.`);\n  lines.push(\n    `-- Edit the user allow-list before applying. Default: only ${unmaskedUser} sees unmasked values.`,\n  );\n  lines.push('');\n  // Group columns by mask-function catalog. If override, all go there;\n  // else group by each column's own catalog.\n  const byCatalog = new Map<string, PiiColumn[]>();\n  for (const c of cols) {\n    const target = maskCatalogOverride ?? c.catalog;\n    const arr = byCatalog.get(target) ?? [];\n    arr.push(c);\n    byCatalog.set(target, arr);\n  }\n  // For each catalog that hosts mask functions, emit one FUNCTION per\n  // category present.\n  for (const [catalog, catalogCols] of byCatalog) {\n    const cats = new Set(catalogCols.map((c) => c.category));\n    lines.push(`-- ── Mask functions in catalog \\`${catalog}\\`.security ──`);\n    lines.push(`CREATE SCHEMA IF NOT EXISTS ${catalog}.security;`);\n    lines.push('');\n    for (const cat of cats) {\n      lines.push(\n        `CREATE OR REPLACE FUNCTION ${catalog}.security.mask_${cat.replace(/-/g, '_')}(val STRING)`,\n      );\n      lines.push(`  RETURNS STRING`);\n      lines.push(`  RETURN CASE`);\n      lines.push(\n        `    WHEN is_member('${unmaskedUser}') OR current_user() = '${unmaskedUser}' THEN val`,\n      );\n      lines.push(`    ELSE ${maskExpression(cat)}`);\n      lines.push(`  END;`);\n      lines.push('');\n    }\n  }\n  // Apply masks.\n  lines.push('-- Apply masks to columns');\n  for (const c of cols) {\n    const fnCatalog = maskCatalogOverride ?? c.catalog;\n    const fnName = `${fnCatalog}.security.mask_${c.category.replace(/-/g, '_')}`;\n    lines.push(\n      `ALTER TABLE ${c.catalog}.${c.schema}.${c.table} ALTER COLUMN ${c.column} SET MASK ${fnName};`,\n    );\n  }\n  lines.push('');\n  return lines.join('\\n') + '\\n';\n}\n\nfunction maskExpression(cat: PiiColumn['category']): string {\n  switch (cat) {\n    case 'email':\n      return `regexp_replace(val, '^(.).*(@.*)$', '$1***$2')`;\n    case 'phone':\n      return `concat('***-***-', right(val, 4))`;\n    case 'ssn':\n      return `concat('***-**-', right(val, 4))`;\n    case 'credit-card':\n      return `concat('****-****-****-', right(val, 4))`;\n    case 'dob':\n      return `concat(left(val, 4), '-XX-XX')`;\n    case 'name':\n    case 'address':\n    case 'generic':\n    default:\n      return `sha2(val, 256)`;\n  }\n}\n\nasync function loadModel(sourcePath: string): Promise<DatabricksObject[]> {\n  if (sourcePath.endsWith('.ddtpac')) {\n    const c = await pac.readPac(sourcePath);\n    return c.model;\n  }\n  const loaded = await loadProject(sourcePath);\n  return await parseProjectModel(loaded);\n}\n"],"mappings":";;;AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,eAAe;AACxB,SAAS,aAAa,KAAK,yBAAgD;AAoBpE,SAAS,mBAA4B;AAC1C,QAAM,MAAM,IAAI,QAAQ,WAAW;AACnC,MACG,YAAY,yEAAyE,EACrF,eAAe,mBAAmB,iCAAiC,EACnE;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,oBAAoB,oDAAoD,EAC/E,OAAO,OAAO,SAAS;AACtB,UAAM,aAAa,OAAO,KAAK,MAAM;AACrC,UAAM,QAAQ,MAAM,UAAU,UAAU;AACxC,UAAM,eAAe,OAAO,KAAK,YAAY;AAC7C,UAAM,cAAc,KAAK,cAAc,OAAO,KAAK,WAAW,IAAI;AAClE,UAAM,aAAa,kBAAkB,KAAK;AAC1C,QAAI,WAAW,WAAW,GAAG;AAC3B,cAAQ,MAAM,sDAAsD;AACpE;AAAA,IACF;AACA,UAAM,MAAM,mBAAmB,YAAY,cAAc,WAAW;AACpE,UAAM,UAAU,KAAK,MAAM,KAAK,QAAQ,OAAO,KAAK,GAAG,CAAC,IAAI,KAAK,QAAQ,eAAe;AACxF,UAAM,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,UAAM,GAAG,UAAU,SAAS,KAAK,MAAM;AACvC,YAAQ,MAAM,SAAS,OAAO,KAAK,WAAW,MAAM,eAAe,IAAI,MAAM,UAAU;AACvF,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF,CAAC;AACH,SAAO;AACT;AAUA,SAAS,kBAAkB,OAAiD;AAC1E,QAAM,MAAmB,CAAC;AAC1B,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,eAAe,mBAAmB,EAAE,eAAe,iBAAkB;AAC3E,UAAM,MAAM;AACZ,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,QAAQ,IAAI,EAAG;AAC1B,UAAM,UAAU,EAAE,IAAI,YAAY;AAClC,UAAM,SAAS,EAAE,IAAI,UAAU;AAC/B,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,SAAS,EAAE,IAAI;AAChC,UAAI,SAAU,KAAI,KAAK,EAAE,SAAS,QAAQ,OAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,MAAM,SAAS,CAAC;AAAA,IACzF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,MAAiD;AACjE,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,kBAAkB,KAAK,KAAK,EAAG,QAAO;AAC1C,MAAI,gCAAgC,KAAK,KAAK,EAAG,QAAO;AACxD,MAAI,gEAAgE,KAAK,KAAK,EAAG,QAAO;AACxF,MAAI,2CAA2C,KAAK,KAAK,EAAG,QAAO;AACnE,MAAI,gBAAgB,KAAK,KAAK,KAAK,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAC1E,MAAI,2DAA2D,KAAK,KAAK,EAAG,QAAO;AACnF,MAAI,sCAAsC,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAEA,SAAS,mBACP,MACA,cACA,qBACQ;AACR,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,oCAAoC;AAC/C,QAAM;AAAA,IACJ,8DAA8D,YAAY;AAAA,EAC5E;AACA,QAAM,KAAK,EAAE;AAGb,QAAM,YAAY,oBAAI,IAAyB;AAC/C,aAAW,KAAK,MAAM;AACpB,UAAM,SAAS,uBAAuB,EAAE;AACxC,UAAM,MAAM,UAAU,IAAI,MAAM,KAAK,CAAC;AACtC,QAAI,KAAK,CAAC;AACV,cAAU,IAAI,QAAQ,GAAG;AAAA,EAC3B;AAGA,aAAW,CAAC,SAAS,WAAW,KAAK,WAAW;AAC9C,UAAM,OAAO,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AACvD,UAAM,KAAK,+CAAqC,OAAO,0BAAgB;AACvE,UAAM,KAAK,+BAA+B,OAAO,YAAY;AAC7D,UAAM,KAAK,EAAE;AACb,eAAW,OAAO,MAAM;AACtB,YAAM;AAAA,QACJ,8BAA8B,OAAO,kBAAkB,IAAI,QAAQ,MAAM,GAAG,CAAC;AAAA,MAC/E;AACA,YAAM,KAAK,kBAAkB;AAC7B,YAAM,KAAK,eAAe;AAC1B,YAAM;AAAA,QACJ,uBAAuB,YAAY,2BAA2B,YAAY;AAAA,MAC5E;AACA,YAAM,KAAK,YAAY,eAAe,GAAG,CAAC,EAAE;AAC5C,YAAM,KAAK,QAAQ;AACnB,YAAM,KAAK,EAAE;AAAA,IACf;AAAA,EACF;AAEA,QAAM,KAAK,2BAA2B;AACtC,aAAW,KAAK,MAAM;AACpB,UAAM,YAAY,uBAAuB,EAAE;AAC3C,UAAM,SAAS,GAAG,SAAS,kBAAkB,EAAE,SAAS,QAAQ,MAAM,GAAG,CAAC;AAC1E,UAAM;AAAA,MACJ,eAAe,EAAE,OAAO,IAAI,EAAE,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,MAAM;AAAA,IAC7F;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEA,SAAS,eAAe,KAAoC;AAC1D,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAEA,eAAe,UAAU,YAAiD;AACxE,MAAI,WAAW,SAAS,SAAS,GAAG;AAClC,UAAM,IAAI,MAAM,IAAI,QAAQ,UAAU;AACtC,WAAO,EAAE;AAAA,EACX;AACA,QAAM,SAAS,MAAM,YAAY,UAAU;AAC3C,SAAO,MAAM,kBAAkB,MAAM;AACvC;","names":[]}

package/dist/approval-GGZGKIU4.js

@@ -0,0 +1,73 @@
+import "./chunk-DGUM43GV.js";
+
+// src/commands/approval.ts
+import path from "path";
+import { Command } from "commander";
+import { approval } from "@ddt-tools/core";
+var DEFAULT_ROOT = path.join(".ddt", "approvals");
+function approvalCommand() {
+  const cmd = new Command("approval");
+  cmd.description("Record / list / verify multi-approver gate tokens for prod deploys.");
+  cmd.command("add").description("Record an approval for a deploy id.").argument("<deploy-id>", "Stable deploy identifier (slug; sanitised in filenames).").requiredOption("--as <approver>", "Approver identifier (email, username, OIDC subject).").option("--message <text>", "Optional approval message.").option("--digest <hex>", "Optional compare/safety digest the approver reviewed.").option("--root <path>", "Approvals directory.", DEFAULT_ROOT).action(async (deployId, opts) => {
+    const record = {
+      approver: String(opts.as),
+      signedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...opts.message ? { message: String(opts.message) } : {},
+      ...opts.digest ? { digest: String(opts.digest) } : {}
+    };
+    const file = await approval.appendApproval(String(opts.root), deployId, record);
+    console.log(
+      `Recorded approval from ${record.approver} for ${deployId} (${file.approvals.length} total).`
+    );
+  });
+  cmd.command("list").description("List approvals recorded for a deploy id.").argument("<deploy-id>").option("--root <path>", "Approvals directory.", DEFAULT_ROOT).option("--json", "Emit JSON.", false).action(async (deployId, opts) => {
+    const file = await approval.readApprovalFile(String(opts.root), deployId);
+    if (opts.json) {
+      console.log(JSON.stringify(file, null, 2));
+      return;
+    }
+    if (file.approvals.length === 0) {
+      console.log(`No approvals recorded for "${deployId}".`);
+      return;
+    }
+    console.log(`Approvals for ${deployId}:`);
+    for (const a of file.approvals) {
+      const meta = [a.signedAt];
+      if (a.digest) meta.push(`digest=${a.digest}`);
+      if (a.message) meta.push(`message=${JSON.stringify(a.message)}`);
+      console.log(`  - ${a.approver}  (${meta.join("; ")})`);
+    }
+  });
+  cmd.command("clear").description("Remove all approvals for a deploy id.").argument("<deploy-id>").option("--root <path>", "Approvals directory.", DEFAULT_ROOT).action(async (deployId, opts) => {
+    await approval.clearApprovals(String(opts.root), deployId);
+    console.log(`Cleared approvals for ${deployId}.`);
+  });
+  cmd.command("check").description("Evaluate the gate. Exits 0 when satisfied, 2 when blocked.").argument("<deploy-id>").requiredOption("--required <n>", "Number of distinct approvals required.", "2").option("--allowed <ids>", "Comma-separated allow-list of approvers (empty = any).").option("--digest <hex>", "Current compare/safety digest; rejects stale approvals.").option("--root <path>", "Approvals directory.", DEFAULT_ROOT).option("--json", "Emit JSON.", false).action(async (deployId, opts) => {
+    const allowedApprovers = opts.allowed ? String(opts.allowed).split(",").map((s) => s.trim()).filter(Boolean) : [];
+    const file = await approval.readApprovalFile(String(opts.root), deployId);
+    const outcome = approval.evaluateApprovalGate(
+      {
+        deployId,
+        required: Number(opts.required ?? "2") || 0,
+        allowedApprovers,
+        ...opts.digest ? { currentDigest: String(opts.digest) } : {}
+      },
+      file.approvals
+    );
+    if (opts.json) {
+      console.log(JSON.stringify(outcome, null, 2));
+    } else if (outcome.satisfied) {
+      console.log(
+        `OK: ${outcome.satisfiedBy.length} approval(s) \u2014 ${outcome.satisfiedBy.join(", ")}.`
+      );
+    } else {
+      console.error(`BLOCKED: ${outcome.blockReason ?? "approval gate not satisfied"}.`);
+    }
+    if (!outcome.satisfied) process.exitCode = 2;
+  });
+  return cmd;
+}
+export {
+  approvalCommand
+};
+//# sourceMappingURL=approval-GGZGKIU4.js.map

package/dist/approval-GGZGKIU4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/approval.ts"],"sourcesContent":["/**\n * `ddt approval` — manage multi-approver gate tokens (Team-tier).\n *\n *   ddt approval add <deploy-id> --as <approver> [--message <text>] [--digest <hex>]\n *   ddt approval list <deploy-id>\n *   ddt approval clear <deploy-id>\n *   ddt approval check <deploy-id> --required N --allowed <ids>\n *\n * Tokens default to `.ddt/approvals/` under the current working\n * directory; override with `--root <path>` on every subcommand.\n *\n * Mirrors `sdt approval`.\n */\nimport path from 'node:path';\nimport { Command } from 'commander';\nimport { approval } from '@ddt-tools/core';\n\nconst DEFAULT_ROOT = path.join('.ddt', 'approvals');\n\nexport function approvalCommand(): Command {\n  const cmd = new Command('approval');\n  cmd.description('Record / list / verify multi-approver gate tokens for prod deploys.');\n\n  cmd\n    .command('add')\n    .description('Record an approval for a deploy id.')\n    .argument('<deploy-id>', 'Stable deploy identifier (slug; sanitised in filenames).')\n    .requiredOption('--as <approver>', 'Approver identifier (email, username, OIDC subject).')\n    .option('--message <text>', 'Optional approval message.')\n    .option('--digest <hex>', 'Optional compare/safety digest the approver reviewed.')\n    .option('--root <path>', 'Approvals directory.', DEFAULT_ROOT)\n    .action(async (deployId: string, opts: Record<string, unknown>) => {\n      const record: approval.ApprovalRecord = {\n        approver: String(opts.as),\n        signedAt: new Date().toISOString(),\n        ...(opts.message ? { message: String(opts.message) } : {}),\n        ...(opts.digest ? { digest: String(opts.digest) } : {}),\n      };\n      const file = await approval.appendApproval(String(opts.root), deployId, record);\n      console.log(\n        `Recorded approval from ${record.approver} for ${deployId} ` +\n          `(${file.approvals.length} total).`,\n      );\n    });\n\n  cmd\n    .command('list')\n    .description('List approvals recorded for a deploy id.')\n    .argument('<deploy-id>')\n    .option('--root <path>', 'Approvals directory.', DEFAULT_ROOT)\n    .option('--json', 'Emit JSON.', false)\n    .action(async (deployId: string, opts: Record<string, unknown>) => {\n      const file = await approval.readApprovalFile(String(opts.root), deployId);\n      if (opts.json) {\n        console.log(JSON.stringify(file, null, 2));\n        return;\n      }\n      if (file.approvals.length === 0) {\n        console.log(`No approvals recorded for \"${deployId}\".`);\n        return;\n      }\n      console.log(`Approvals for ${deployId}:`);\n      for (const a of file.approvals) {\n        const meta = [a.signedAt];\n        if (a.digest) meta.push(`digest=${a.digest}`);\n        if (a.message) meta.push(`message=${JSON.stringify(a.message)}`);\n        console.log(`  - ${a.approver}  (${meta.join('; ')})`);\n      }\n    });\n\n  cmd\n    .command('clear')\n    .description('Remove all approvals for a deploy id.')\n    .argument('<deploy-id>')\n    .option('--root <path>', 'Approvals directory.', DEFAULT_ROOT)\n    .action(async (deployId: string, opts: Record<string, unknown>) => {\n      await approval.clearApprovals(String(opts.root), deployId);\n      console.log(`Cleared approvals for ${deployId}.`);\n    });\n\n  cmd\n    .command('check')\n    .description('Evaluate the gate. Exits 0 when satisfied, 2 when blocked.')\n    .argument('<deploy-id>')\n    .requiredOption('--required <n>', 'Number of distinct approvals required.', '2')\n    .option('--allowed <ids>', 'Comma-separated allow-list of approvers (empty = any).')\n    .option('--digest <hex>', 'Current compare/safety digest; rejects stale approvals.')\n    .option('--root <path>', 'Approvals directory.', DEFAULT_ROOT)\n    .option('--json', 'Emit JSON.', false)\n    .action(async (deployId: string, opts: Record<string, unknown>) => {\n      const allowedApprovers = opts.allowed\n        ? String(opts.allowed)\n            .split(',')\n            .map((s) => s.trim())\n            .filter(Boolean)\n        : [];\n      const file = await approval.readApprovalFile(String(opts.root), deployId);\n      const outcome = approval.evaluateApprovalGate(\n        {\n          deployId,\n          required: Number(opts.required ?? '2') || 0,\n          allowedApprovers,\n          ...(opts.digest ? { currentDigest: String(opts.digest) } : {}),\n        },\n        file.approvals,\n      );\n      if (opts.json) {\n        console.log(JSON.stringify(outcome, null, 2));\n      } else if (outcome.satisfied) {\n        console.log(\n          `OK: ${outcome.satisfiedBy.length} approval(s) — ${outcome.satisfiedBy.join(', ')}.`,\n        );\n      } else {\n        console.error(`BLOCKED: ${outcome.blockReason ?? 'approval gate not satisfied'}.`);\n      }\n      if (!outcome.satisfied) process.exitCode = 2;\n    });\n\n  return cmd;\n}\n"],"mappings":";;;AAaA,OAAO,UAAU;AACjB,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAEzB,IAAM,eAAe,KAAK,KAAK,QAAQ,WAAW;AAE3C,SAAS,kBAA2B;AACzC,QAAM,MAAM,IAAI,QAAQ,UAAU;AAClC,MAAI,YAAY,qEAAqE;AAErF,MACG,QAAQ,KAAK,EACb,YAAY,qCAAqC,EACjD,SAAS,eAAe,0DAA0D,EAClF,eAAe,mBAAmB,sDAAsD,EACxF,OAAO,oBAAoB,4BAA4B,EACvD,OAAO,kBAAkB,uDAAuD,EAChF,OAAO,iBAAiB,wBAAwB,YAAY,EAC5D,OAAO,OAAO,UAAkB,SAAkC;AACjE,UAAM,SAAkC;AAAA,MACtC,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,MACjC,GAAI,KAAK,UAAU,EAAE,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC;AAAA,MACxD,GAAI,KAAK,SAAS,EAAE,QAAQ,OAAO,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,IACvD;AACA,UAAM,OAAO,MAAM,SAAS,eAAe,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM;AAC9E,YAAQ;AAAA,MACN,0BAA0B,OAAO,QAAQ,QAAQ,QAAQ,KACnD,KAAK,UAAU,MAAM;AAAA,IAC7B;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,MAAM,EACd,YAAY,0CAA0C,EACtD,SAAS,aAAa,EACtB,OAAO,iBAAiB,wBAAwB,YAAY,EAC5D,OAAO,UAAU,cAAc,KAAK,EACpC,OAAO,OAAO,UAAkB,SAAkC;AACjE,UAAM,OAAO,MAAM,SAAS,iBAAiB,OAAO,KAAK,IAAI,GAAG,QAAQ;AACxE,QAAI,KAAK,MAAM;AACb,cAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACzC;AAAA,IACF;AACA,QAAI,KAAK,UAAU,WAAW,GAAG;AAC/B,cAAQ,IAAI,8BAA8B,QAAQ,IAAI;AACtD;AAAA,IACF;AACA,YAAQ,IAAI,iBAAiB,QAAQ,GAAG;AACxC,eAAW,KAAK,KAAK,WAAW;AAC9B,YAAM,OAAO,CAAC,EAAE,QAAQ;AACxB,UAAI,EAAE,OAAQ,MAAK,KAAK,UAAU,EAAE,MAAM,EAAE;AAC5C,UAAI,EAAE,QAAS,MAAK,KAAK,WAAW,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AAC/D,cAAQ,IAAI,OAAO,EAAE,QAAQ,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,IACvD;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,OAAO,EACf,YAAY,uCAAuC,EACnD,SAAS,aAAa,EACtB,OAAO,iBAAiB,wBAAwB,YAAY,EAC5D,OAAO,OAAO,UAAkB,SAAkC;AACjE,UAAM,SAAS,eAAe,OAAO,KAAK,IAAI,GAAG,QAAQ;AACzD,YAAQ,IAAI,yBAAyB,QAAQ,GAAG;AAAA,EAClD,CAAC;AAEH,MACG,QAAQ,OAAO,EACf,YAAY,4DAA4D,EACxE,SAAS,aAAa,EACtB,eAAe,kBAAkB,0CAA0C,GAAG,EAC9E,OAAO,mBAAmB,wDAAwD,EAClF,OAAO,kBAAkB,yDAAyD,EAClF,OAAO,iBAAiB,wBAAwB,YAAY,EAC5D,OAAO,UAAU,cAAc,KAAK,EACpC,OAAO,OAAO,UAAkB,SAAkC;AACjE,UAAM,mBAAmB,KAAK,UAC1B,OAAO,KAAK,OAAO,EAChB,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,IACjB,CAAC;AACL,UAAM,OAAO,MAAM,SAAS,iBAAiB,OAAO,KAAK,IAAI,GAAG,QAAQ;AACxE,UAAM,UAAU,SAAS;AAAA,MACvB;AAAA,QACE;AAAA,QACA,UAAU,OAAO,KAAK,YAAY,GAAG,KAAK;AAAA,QAC1C;AAAA,QACA,GAAI,KAAK,SAAS,EAAE,eAAe,OAAO,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,IACP;AACA,QAAI,KAAK,MAAM;AACb,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,IAC9C,WAAW,QAAQ,WAAW;AAC5B,cAAQ;AAAA,QACN,OAAO,QAAQ,YAAY,MAAM,uBAAkB,QAAQ,YAAY,KAAK,IAAI,CAAC;AAAA,MACnF;AAAA,IACF,OAAO;AACL,cAAQ,MAAM,YAAY,QAAQ,eAAe,6BAA6B,GAAG;AAAA,IACnF;AACA,QAAI,CAAC,QAAQ,UAAW,SAAQ,WAAW;AAAA,EAC7C,CAAC;AAEH,SAAO;AACT;","names":[]}

package/dist/approval-chain-GWJKZHVU.js

@@ -0,0 +1,118 @@
+import {
+  __require
+} from "./chunk-DGUM43GV.js";
+
+// src/commands/approval-chain.ts
+import { promises as fs } from "fs";
+import path from "path";
+import { Command } from "commander";
+import { approvalChain } from "@ddt-tools/core";
+function approvalChainCommand() {
+  const cmd = new Command("approval-chain");
+  cmd.description("Signed M-of-N approval workflow (DSR.8).");
+  cmd.addCommand(keygenCommand());
+  cmd.addCommand(signCommand());
+  cmd.addCommand(verifyCommand());
+  return cmd;
+}
+function keygenCommand() {
+  const c = new Command("keygen");
+  c.description("Generate an Ed25519 keypair for an approver.").requiredOption("--id <approver>", "Approver id (used as the filename stem).").requiredOption("--out <dir>", "Output directory for the keypair.").action(async (opts) => {
+    const dir = path.resolve(opts.out);
+    await fs.mkdir(dir, { recursive: true });
+    const pair = approvalChain.generateApproverKeyPair();
+    const priv = path.join(dir, `${opts.id}.pem`);
+    const pub = path.join(dir, `${opts.id}.pub.pem`);
+    await fs.writeFile(priv, pair.privateKeyPem, { mode: 384 });
+    await fs.writeFile(pub, pair.publicKeyPem);
+    process.stdout.write(`Wrote ${priv} and ${pub} (kid=${pair.kid}).
+`);
+  });
+  return c;
+}
+function signCommand() {
+  const c = new Command("sign");
+  c.description("Produce a signed approval record.").requiredOption("--deploy-id <id>", "Stable deploy id.").requiredOption("--env <env>", "Target environment (matches a key in approval.json).").requiredOption("--approver <id>", "Approver id (must appear in the env's approvers list).").requiredOption("--decision <decision>", "approve | reject", "approve").requiredOption("--key <path>", "Path to the approver's private key (PEM).").option("--digest <hex>", "Optional compare+safety digest the approver reviewed.").option("--out <path>", "Write the signed record JSON to this path (default stdout).").action(
+    async (opts) => {
+      const decision = opts.decision === "reject" ? "reject" : "approve";
+      const privateKeyPem = await fs.readFile(path.resolve(opts.key), "utf8");
+      const kid = approvalChain.publicKeyKid(
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        __require("crypto").createPublicKey(privateKeyPem).export({ format: "pem", type: "spki" }).toString()
+      );
+      const record = approvalChain.signApprovalRecord(
+        {
+          deployId: opts.deployId,
+          env: opts.env,
+          approver: opts.approver,
+          decision,
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          digest: opts.digest
+        },
+        privateKeyPem,
+        { kid }
+      );
+      const payload = JSON.stringify(record, null, 2) + "\n";
+      if (opts.out) {
+        await fs.mkdir(path.dirname(path.resolve(opts.out)), { recursive: true });
+        await fs.writeFile(path.resolve(opts.out), payload);
+        process.stderr.write(`Wrote ${opts.out}
+`);
+      } else {
+        process.stdout.write(payload);
+      }
+    }
+  );
+  return c;
+}
+function verifyCommand() {
+  const c = new Command("verify");
+  c.description("Evaluate the signed chain against the env policy.").requiredOption("--deploy-id <id>", "Stable deploy id.").requiredOption("--env <env>", "Target environment.").requiredOption("--config <path>", "Path to approval.json.").requiredOption("--records <path>", "Path to JSON file containing a SignedApprovalRecord[].").option("--digest <hex>", "Optional live compare+safety digest.").option("--format <fmt>", "text | json. Default text.", "text").action(
+    async (opts) => {
+      const configPath = path.resolve(opts.config);
+      const config = await approvalChain.loadApprovalChainConfig(configPath);
+      if (!config) {
+        process.stderr.write(`Config file not found: ${configPath}
+`);
+        process.exitCode = 1;
+        return;
+      }
+      const records = JSON.parse(
+        await fs.readFile(path.resolve(opts.records), "utf8")
+      );
+      const registry = approvalChain.resolveRegistry(config, configPath);
+      const outcome = await approvalChain.evaluateApprovalChain({
+        deployId: opts.deployId,
+        env: opts.env,
+        currentDigest: opts.digest,
+        records,
+        config,
+        registry
+      });
+      if ((opts.format ?? "text").toLowerCase() === "json") {
+        process.stdout.write(JSON.stringify(outcome, null, 2) + "\n");
+      } else {
+        process.stdout.write(
+          `${outcome.satisfied ? "OK" : "BLOCKED"}: ${outcome.satisfiedBy.length} valid / ${outcome.missingCount} missing
+`
+        );
+        if (outcome.satisfiedBy.length > 0)
+          process.stdout.write(`  approvers: ${outcome.satisfiedBy.join(", ")}
+`);
+        if (outcome.ignored.length > 0)
+          process.stdout.write(
+            `  ignored: ${outcome.ignored.map((i) => `${i.approver}=${i.reason}`).join(", ")}
+`
+          );
+        if (outcome.blockReason) process.stdout.write(`  ${outcome.blockReason}
+`);
+      }
+      if (!outcome.satisfied) process.exitCode = 1;
+    }
+  );
+  return c;
+}
+export {
+  approvalChainCommand
+};
+//# sourceMappingURL=approval-chain-GWJKZHVU.js.map

package/dist/approval-chain-GWJKZHVU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/approval-chain.ts"],"sourcesContent":["/**\n * `ddt approval-chain` — M-of-N signed approval workflow (DSR.8).\n *\n * Subcommands: keygen / sign / verify. Mirrors `sdt approval-chain`.\n */\nimport { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport type * as nodeCrypto from 'node:crypto';\nimport { Command } from 'commander';\nimport { approvalChain } from '@ddt-tools/core';\n\nexport function approvalChainCommand(): Command {\n  const cmd = new Command('approval-chain');\n  cmd.description('Signed M-of-N approval workflow (DSR.8).');\n  cmd.addCommand(keygenCommand());\n  cmd.addCommand(signCommand());\n  cmd.addCommand(verifyCommand());\n  return cmd;\n}\n\nfunction keygenCommand(): Command {\n  const c = new Command('keygen');\n  c.description('Generate an Ed25519 keypair for an approver.')\n    .requiredOption('--id <approver>', 'Approver id (used as the filename stem).')\n    .requiredOption('--out <dir>', 'Output directory for the keypair.')\n    .action(async (opts: { id: string; out: string }) => {\n      const dir = path.resolve(opts.out);\n      await fs.mkdir(dir, { recursive: true });\n      const pair = approvalChain.generateApproverKeyPair();\n      const priv = path.join(dir, `${opts.id}.pem`);\n      const pub = path.join(dir, `${opts.id}.pub.pem`);\n      await fs.writeFile(priv, pair.privateKeyPem, { mode: 0o600 });\n      await fs.writeFile(pub, pair.publicKeyPem);\n      process.stdout.write(`Wrote ${priv} and ${pub} (kid=${pair.kid}).\\n`);\n    });\n  return c;\n}\n\nfunction signCommand(): Command {\n  const c = new Command('sign');\n  c.description('Produce a signed approval record.')\n    .requiredOption('--deploy-id <id>', 'Stable deploy id.')\n    .requiredOption('--env <env>', 'Target environment (matches a key in approval.json).')\n    .requiredOption('--approver <id>', \"Approver id (must appear in the env's approvers list).\")\n    .requiredOption('--decision <decision>', 'approve | reject', 'approve')\n    .requiredOption('--key <path>', \"Path to the approver's private key (PEM).\")\n    .option('--digest <hex>', 'Optional compare+safety digest the approver reviewed.')\n    .option('--out <path>', 'Write the signed record JSON to this path (default stdout).')\n    .action(\n      async (opts: {\n        deployId: string;\n        env: string;\n        approver: string;\n        decision: string;\n        key: string;\n        digest?: string;\n        out?: string;\n      }) => {\n        const decision = (opts.decision === 'reject' ? 'reject' : 'approve') as\n          | 'approve'\n          | 'reject';\n        const privateKeyPem = await fs.readFile(path.resolve(opts.key), 'utf8');\n        const kid = approvalChain.publicKeyKid(\n          // eslint-disable-next-line @typescript-eslint/no-require-imports\n          (require('node:crypto') as typeof nodeCrypto)\n            .createPublicKey(privateKeyPem)\n            .export({ format: 'pem', type: 'spki' })\n            .toString(),\n        );\n        const record = approvalChain.signApprovalRecord(\n          {\n            deployId: opts.deployId,\n            env: opts.env,\n            approver: opts.approver,\n            decision,\n            ts: new Date().toISOString(),\n            digest: opts.digest,\n          },\n          privateKeyPem,\n          { kid },\n        );\n        const payload = JSON.stringify(record, null, 2) + '\\n';\n        if (opts.out) {\n          await fs.mkdir(path.dirname(path.resolve(opts.out)), { recursive: true });\n          await fs.writeFile(path.resolve(opts.out), payload);\n          process.stderr.write(`Wrote ${opts.out}\\n`);\n        } else {\n          process.stdout.write(payload);\n        }\n      },\n    );\n  return c;\n}\n\nfunction verifyCommand(): Command {\n  const c = new Command('verify');\n  c.description('Evaluate the signed chain against the env policy.')\n    .requiredOption('--deploy-id <id>', 'Stable deploy id.')\n    .requiredOption('--env <env>', 'Target environment.')\n    .requiredOption('--config <path>', 'Path to approval.json.')\n    .requiredOption('--records <path>', 'Path to JSON file containing a SignedApprovalRecord[].')\n    .option('--digest <hex>', 'Optional live compare+safety digest.')\n    .option('--format <fmt>', 'text | json. Default text.', 'text')\n    .action(\n      async (opts: {\n        deployId: string;\n        env: string;\n        config: string;\n        records: string;\n        digest?: string;\n        format?: string;\n      }) => {\n        const configPath = path.resolve(opts.config);\n        const config = await approvalChain.loadApprovalChainConfig(configPath);\n        if (!config) {\n          process.stderr.write(`Config file not found: ${configPath}\\n`);\n          process.exitCode = 1;\n          return;\n        }\n        const records = JSON.parse(\n          await fs.readFile(path.resolve(opts.records), 'utf8'),\n        ) as approvalChain.SignedApprovalRecord[];\n        const registry = approvalChain.resolveRegistry(config, configPath);\n        const outcome = await approvalChain.evaluateApprovalChain({\n          deployId: opts.deployId,\n          env: opts.env,\n          currentDigest: opts.digest,\n          records,\n          config,\n          registry,\n        });\n        if ((opts.format ?? 'text').toLowerCase() === 'json') {\n          process.stdout.write(JSON.stringify(outcome, null, 2) + '\\n');\n        } else {\n          process.stdout.write(\n            `${outcome.satisfied ? 'OK' : 'BLOCKED'}: ${outcome.satisfiedBy.length} valid / ${outcome.missingCount} missing\\n`,\n          );\n          if (outcome.satisfiedBy.length > 0)\n            process.stdout.write(`  approvers: ${outcome.satisfiedBy.join(', ')}\\n`);\n          if (outcome.ignored.length > 0)\n            process.stdout.write(\n              `  ignored: ${outcome.ignored.map((i) => `${i.approver}=${i.reason}`).join(', ')}\\n`,\n            );\n          if (outcome.blockReason) process.stdout.write(`  ${outcome.blockReason}\\n`);\n        }\n        if (!outcome.satisfied) process.exitCode = 1;\n      },\n    );\n  return c;\n}\n"],"mappings":";;;;;AAKA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAEjB,SAAS,eAAe;AACxB,SAAS,qBAAqB;AAEvB,SAAS,uBAAgC;AAC9C,QAAM,MAAM,IAAI,QAAQ,gBAAgB;AACxC,MAAI,YAAY,0CAA0C;AAC1D,MAAI,WAAW,cAAc,CAAC;AAC9B,MAAI,WAAW,YAAY,CAAC;AAC5B,MAAI,WAAW,cAAc,CAAC;AAC9B,SAAO;AACT;AAEA,SAAS,gBAAyB;AAChC,QAAM,IAAI,IAAI,QAAQ,QAAQ;AAC9B,IAAE,YAAY,8CAA8C,EACzD,eAAe,mBAAmB,0CAA0C,EAC5E,eAAe,eAAe,mCAAmC,EACjE,OAAO,OAAO,SAAsC;AACnD,UAAM,MAAM,KAAK,QAAQ,KAAK,GAAG;AACjC,UAAM,GAAG,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC,UAAM,OAAO,cAAc,wBAAwB;AACnD,UAAM,OAAO,KAAK,KAAK,KAAK,GAAG,KAAK,EAAE,MAAM;AAC5C,UAAM,MAAM,KAAK,KAAK,KAAK,GAAG,KAAK,EAAE,UAAU;AAC/C,UAAM,GAAG,UAAU,MAAM,KAAK,eAAe,EAAE,MAAM,IAAM,CAAC;AAC5D,UAAM,GAAG,UAAU,KAAK,KAAK,YAAY;AACzC,YAAQ,OAAO,MAAM,SAAS,IAAI,QAAQ,GAAG,SAAS,KAAK,GAAG;AAAA,CAAM;AAAA,EACtE,CAAC;AACH,SAAO;AACT;AAEA,SAAS,cAAuB;AAC9B,QAAM,IAAI,IAAI,QAAQ,MAAM;AAC5B,IAAE,YAAY,mCAAmC,EAC9C,eAAe,oBAAoB,mBAAmB,EACtD,eAAe,eAAe,sDAAsD,EACpF,eAAe,mBAAmB,wDAAwD,EAC1F,eAAe,yBAAyB,oBAAoB,SAAS,EACrE,eAAe,gBAAgB,2CAA2C,EAC1E,OAAO,kBAAkB,uDAAuD,EAChF,OAAO,gBAAgB,6DAA6D,EACpF;AAAA,IACC,OAAO,SAQD;AACJ,YAAM,WAAY,KAAK,aAAa,WAAW,WAAW;AAG1D,YAAM,gBAAgB,MAAM,GAAG,SAAS,KAAK,QAAQ,KAAK,GAAG,GAAG,MAAM;AACtE,YAAM,MAAM,cAAc;AAAA;AAAA,QAEvB,UAAQ,QAAa,EACnB,gBAAgB,aAAa,EAC7B,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC,EACtC,SAAS;AAAA,MACd;AACA,YAAM,SAAS,cAAc;AAAA,QAC3B;AAAA,UACE,UAAU,KAAK;AAAA,UACf,KAAK,KAAK;AAAA,UACV,UAAU,KAAK;AAAA,UACf;AAAA,UACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,UAC3B,QAAQ,KAAK;AAAA,QACf;AAAA,QACA;AAAA,QACA,EAAE,IAAI;AAAA,MACR;AACA,YAAM,UAAU,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI;AAClD,UAAI,KAAK,KAAK;AACZ,cAAM,GAAG,MAAM,KAAK,QAAQ,KAAK,QAAQ,KAAK,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACxE,cAAM,GAAG,UAAU,KAAK,QAAQ,KAAK,GAAG,GAAG,OAAO;AAClD,gBAAQ,OAAO,MAAM,SAAS,KAAK,GAAG;AAAA,CAAI;AAAA,MAC5C,OAAO;AACL,gBAAQ,OAAO,MAAM,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF,SAAO;AACT;AAEA,SAAS,gBAAyB;AAChC,QAAM,IAAI,IAAI,QAAQ,QAAQ;AAC9B,IAAE,YAAY,mDAAmD,EAC9D,eAAe,oBAAoB,mBAAmB,EACtD,eAAe,eAAe,qBAAqB,EACnD,eAAe,mBAAmB,wBAAwB,EAC1D,eAAe,oBAAoB,wDAAwD,EAC3F,OAAO,kBAAkB,sCAAsC,EAC/D,OAAO,kBAAkB,8BAA8B,MAAM,EAC7D;AAAA,IACC,OAAO,SAOD;AACJ,YAAM,aAAa,KAAK,QAAQ,KAAK,MAAM;AAC3C,YAAM,SAAS,MAAM,cAAc,wBAAwB,UAAU;AACrE,UAAI,CAAC,QAAQ;AACX,gBAAQ,OAAO,MAAM,0BAA0B,UAAU;AAAA,CAAI;AAC7D,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,YAAM,UAAU,KAAK;AAAA,QACnB,MAAM,GAAG,SAAS,KAAK,QAAQ,KAAK,OAAO,GAAG,MAAM;AAAA,MACtD;AACA,YAAM,WAAW,cAAc,gBAAgB,QAAQ,UAAU;AACjE,YAAM,UAAU,MAAM,cAAc,sBAAsB;AAAA,QACxD,UAAU,KAAK;AAAA,QACf,KAAK,KAAK;AAAA,QACV,eAAe,KAAK;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,WAAK,KAAK,UAAU,QAAQ,YAAY,MAAM,QAAQ;AACpD,gBAAQ,OAAO,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,IAAI;AAAA,MAC9D,OAAO;AACL,gBAAQ,OAAO;AAAA,UACb,GAAG,QAAQ,YAAY,OAAO,SAAS,KAAK,QAAQ,YAAY,MAAM,YAAY,QAAQ,YAAY;AAAA;AAAA,QACxG;AACA,YAAI,QAAQ,YAAY,SAAS;AAC/B,kBAAQ,OAAO,MAAM,gBAAgB,QAAQ,YAAY,KAAK,IAAI,CAAC;AAAA,CAAI;AACzE,YAAI,QAAQ,QAAQ,SAAS;AAC3B,kBAAQ,OAAO;AAAA,YACb,cAAc,QAAQ,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,UAClF;AACF,YAAI,QAAQ,YAAa,SAAQ,OAAO,MAAM,KAAK,QAAQ,WAAW;AAAA,CAAI;AAAA,MAC5E;AACA,UAAI,CAAC,QAAQ,UAAW,SAAQ,WAAW;AAAA,IAC7C;AAAA,EACF;AACF,SAAO;AACT;","names":[]}