@envseal/cli 0.1.0

package/dist/commands/verify.js

@@ -0,0 +1,52 @@
+import { projectPaths } from '@envseal/core';
+import { emit, fail } from '../output.js';
+import { EXIT } from '../exit-codes.js';
+import { createBroker } from '../cli-utils.js';
+import { finish } from '../exit.js';
+import { makeProbeApprover } from '../probe-approval.js';
+export async function verify(root, keys, json) {
+    try {
+        const paths = projectPaths(root);
+        const broker = await createBroker(root, {
+            onApprovalNeeded: makeProbeApprover(paths.approvals),
+        });
+        const status = await broker.describe();
+        // Verify specified keys, or all if none specified
+        const keysToVerify = keys.length > 0
+            ? keys
+            : status.entries.map((e) => e.key);
+        const results = await broker.verify({
+            keys: keysToVerify,
+        });
+        let allOk = true;
+        for (const result of results) {
+            if (result.result !== 'ok') {
+                allOk = false;
+            }
+        }
+        if (!json) {
+            for (const result of results) {
+                const status_str = result.result === 'ok' ? '✓' : '✗';
+                console.log(`${status_str} ${result.key}: ${result.result}`);
+            }
+        }
+        else {
+            emit(json, '', {
+                results: results.map((r) => ({
+                    key: r.key,
+                    result: r.result,
+                    message: r.message,
+                })),
+                allOk,
+            });
+        }
+        if (!allOk) {
+            finish(EXIT.VERIFY_FAILED);
+            return;
+        }
+    }
+    catch (error) {
+        fail(json, error);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/exit-codes.d.ts

@@ -0,0 +1,24 @@
+import { type TicketKeyOutcome } from '@envseal/protocol';
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly UNSATISFIED: 1;
+    readonly USAGE: 2;
+    readonly CANCELLED: 3;
+    readonly NO_SURFACE: 4;
+    readonly SINK_FAILURE: 5;
+    readonly VERIFY_FAILED: 6;
+};
+export declare function exitCodeForError(e: unknown): number;
+/**
+ * Exit code for a per-key ticket outcome, per docs/cli-contract.md.
+ *
+ * `set` and `ensure` previously exited 0 for every outcome including
+ * `cancelled`, `invalid_format` and `timeout`, so a shell caller could not tell
+ * a stored key from a refused one.
+ *
+ * `timeout` maps to CANCELLED rather than UNSATISFIED so it agrees with
+ * exitCodeForError, which already maps SEP_TICKET_EXPIRED to CANCELLED. The
+ * same event reaching a caller by two routes must not produce two codes.
+ */
+export declare function exitCodeForOutcome(outcome: TicketKeyOutcome): number;
+//# sourceMappingURL=exit-codes.d.ts.map

package/dist/exit-codes.js

@@ -0,0 +1,73 @@
+import { isSepError } from '@envseal/protocol';
+export const EXIT = {
+    OK: 0,
+    UNSATISFIED: 1,
+    USAGE: 2,
+    CANCELLED: 3,
+    NO_SURFACE: 4,
+    SINK_FAILURE: 5,
+    VERIFY_FAILED: 6,
+};
+export function exitCodeForError(e) {
+    if (!isSepError(e)) {
+        // Anything that is not a SepError is still a failure. Returning OK here
+        // meant a generic thrown Error could exit 0 — a success code on a path that
+        // only runs because something went wrong.
+        return EXIT.UNSATISFIED;
+    }
+    const code = e.code;
+    switch (code) {
+        case 'SEP_UNKNOWN_KEY':
+        case 'SEP_NOT_DECLARED':
+        case 'SEP_GITIGNORE_UNSAFE':
+        case 'SEP_PROBE_NOT_APPROVED':
+        case 'SEP_VALUE_IN_REQUEST':
+            return EXIT.USAGE;
+        case 'SEP_NO_INTERACTIVE_SURFACE':
+            return EXIT.NO_SURFACE;
+        case 'SEP_USER_CANCELLED':
+        case 'SEP_TICKET_EXPIRED':
+            return EXIT.CANCELLED;
+        case 'SEP_SINK_UNAVAILABLE':
+        case 'SEP_SINK_WRITE_FAILED':
+            return EXIT.SINK_FAILURE;
+        case 'SEP_FORMAT_INVALID':
+        case 'SEP_RATE_LIMITED':
+        case 'SEP_TICKET_UNKNOWN':
+        case 'SEP_CONFIRMATION_DENIED':
+            return EXIT.UNSATISFIED;
+        default: {
+            const _exhaustive = code;
+            return _exhaustive;
+        }
+    }
+}
+/**
+ * Exit code for a per-key ticket outcome, per docs/cli-contract.md.
+ *
+ * `set` and `ensure` previously exited 0 for every outcome including
+ * `cancelled`, `invalid_format` and `timeout`, so a shell caller could not tell
+ * a stored key from a refused one.
+ *
+ * `timeout` maps to CANCELLED rather than UNSATISFIED so it agrees with
+ * exitCodeForError, which already maps SEP_TICKET_EXPIRED to CANCELLED. The
+ * same event reaching a caller by two routes must not produce two codes.
+ */
+export function exitCodeForOutcome(outcome) {
+    switch (outcome) {
+        case 'stored':
+            return EXIT.OK;
+        case 'cancelled':
+        case 'timeout':
+            return EXIT.CANCELLED;
+        case 'skipped':
+        case 'invalid_format':
+        case 'verify_failed':
+            return EXIT.UNSATISFIED;
+        default: {
+            const _exhaustive = outcome;
+            return _exhaustive;
+        }
+    }
+}
+//# sourceMappingURL=exit-codes.js.map

package/dist/exit.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Process termination for the CLI.
+ *
+ * `process.exit()` is the wrong tool here and was the cause of launch blocker
+ * B4. Two independent problems:
+ *
+ * 1. On Windows, calling `process.exit()` while undici is tearing down the
+ *    sockets a completed `fetch()` left behind trips a libuv assertion —
+ *    `!(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 76` —
+ *    and the process dies with 0xC0000409 (3221226505). An agent branching on
+ *    the exit code sees a crash instead of the documented 6. Reproduced 4/5
+ *    runs before this change; see scripts/probe-b4-repro.mjs. Flushing stdout
+ *    first does NOT help: the assertion is about the fetch handles, not stdout.
+ * 2. `process.exit()` truncates a pending stdout write to a pipe, which is
+ *    exactly what a shell-only caller reads from.
+ *
+ * So the normal path never calls `process.exit()`. It releases everything the
+ * CLI owns, sets `process.exitCode`, and lets the event loop drain — which is
+ * also the only way Node guarantees stdout is flushed. An *unref'd* watchdog
+ * covers the case where a handle we do not own keeps the loop alive: being
+ * unref'd it cannot delay the normal path, and it only fires if the process
+ * would otherwise hang.
+ */
+/**
+ * Register a teardown callback to run before the process finishes.
+ * Every broker the CLI creates registers its `dispose()` here, which clears the
+ * ticket store's sweep interval and drops its waiters.
+ */
+export declare function registerDisposable(dispose: () => void): void;
+/**
+ * Finish the process with `code`.
+ *
+ * Returns normally — it is NOT `never`. Callers must `return` after calling it,
+ * because execution continues until the current call stack unwinds.
+ */
+export declare function finish(code: number): void;
+//# sourceMappingURL=exit.d.ts.map

package/dist/exit.js

@@ -0,0 +1,66 @@
+/**
+ * Process termination for the CLI.
+ *
+ * `process.exit()` is the wrong tool here and was the cause of launch blocker
+ * B4. Two independent problems:
+ *
+ * 1. On Windows, calling `process.exit()` while undici is tearing down the
+ *    sockets a completed `fetch()` left behind trips a libuv assertion —
+ *    `!(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 76` —
+ *    and the process dies with 0xC0000409 (3221226505). An agent branching on
+ *    the exit code sees a crash instead of the documented 6. Reproduced 4/5
+ *    runs before this change; see scripts/probe-b4-repro.mjs. Flushing stdout
+ *    first does NOT help: the assertion is about the fetch handles, not stdout.
+ * 2. `process.exit()` truncates a pending stdout write to a pipe, which is
+ *    exactly what a shell-only caller reads from.
+ *
+ * So the normal path never calls `process.exit()`. It releases everything the
+ * CLI owns, sets `process.exitCode`, and lets the event loop drain — which is
+ * also the only way Node guarantees stdout is flushed. An *unref'd* watchdog
+ * covers the case where a handle we do not own keeps the loop alive: being
+ * unref'd it cannot delay the normal path, and it only fires if the process
+ * would otherwise hang.
+ */
+/** How long the loop may stay alive after we are done before we force the issue. */
+const HANG_GRACE_MS = 1500;
+/** How long a forced exit waits for stdout to reach the pipe. */
+const FLUSH_GRACE_MS = 250;
+const disposables = new Set();
+/**
+ * Register a teardown callback to run before the process finishes.
+ * Every broker the CLI creates registers its `dispose()` here, which clears the
+ * ticket store's sweep interval and drops its waiters.
+ */
+export function registerDisposable(dispose) {
+    disposables.add(dispose);
+}
+function disposeAll() {
+    for (const dispose of disposables) {
+        try {
+            dispose();
+        }
+        catch {
+            // Teardown must never mask or change the outcome we are reporting.
+        }
+    }
+    disposables.clear();
+}
+/**
+ * Finish the process with `code`.
+ *
+ * Returns normally — it is NOT `never`. Callers must `return` after calling it,
+ * because execution continues until the current call stack unwinds.
+ */
+export function finish(code) {
+    disposeAll();
+    process.exitCode = code;
+    const watchdog = setTimeout(() => {
+        // Something outside the CLI's ownership is still holding the event loop
+        // open. Forcing the exit is the lesser evil against a command that never
+        // returns, but give the pending stdout write a chance to land first.
+        process.stdout.write('', () => process.exit(code));
+        setTimeout(() => process.exit(code), FLUSH_GRACE_MS).unref();
+    }, HANG_GRACE_MS);
+    watchdog.unref();
+}
+//# sourceMappingURL=exit.js.map

package/dist/host.d.ts

@@ -0,0 +1,10 @@
+export type ProtectionTier = 'A' | 'B' | 'C';
+export interface HostInfo {
+    id: string;
+    name: string;
+    tier: ProtectionTier;
+    reason: string;
+    recommendation: string;
+}
+export declare function detectHost(root: string): HostInfo;
+//# sourceMappingURL=host.d.ts.map

package/dist/host.js

@@ -0,0 +1,286 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Detect the host environment from marker files and env vars.
+ * Tier A: protocol + interception hooks (Claude Code)
+ * Tier B: protocol + advisory guardrails (Cursor, Continue, Windsurf, Cline,
+ *   Zed, Codex, JetBrains, Copilot, generic)
+ * Tier C: protocol only (Aider, Goose, unknown)
+ */
+/**
+ * Are envseal's interception hooks actually wired into Claude Code?
+ *
+ * Deliberately evidence-based rather than optimistic. We look for envseal named
+ * in a settings file's hook configuration, or an installed plugin directory. If
+ * we cannot see the wiring we do not claim it — an unfounded tier A tells the
+ * user that `cat .env` is blocked when it is not, and they will act accordingly.
+ */
+function envsealHooksInstalled(root) {
+    const candidates = [
+        join(root, '.claude', 'settings.json'),
+        join(root, '.claude', 'settings.local.json'),
+        join(homedir(), '.claude', 'settings.json'),
+    ];
+    for (const file of candidates) {
+        try {
+            const text = readFileSync(file, 'utf8');
+            // The hook commands reference the plugin by name whichever way it was
+            // installed (marketplace, path, or a hand-written hooks block).
+            if (/envseal/i.test(text) && /hooks/i.test(text))
+                return true;
+        }
+        catch {
+            // Unreadable or absent: absence of evidence is not evidence of protection.
+        }
+    }
+    // A locally installed plugin directory also counts.
+    for (const dir of [
+        join(root, '.claude', 'plugins', 'envseal'),
+        join(homedir(), '.claude', 'plugins', 'envseal'),
+    ]) {
+        if (existsSync(dir))
+            return true;
+    }
+    return false;
+}
+/**
+ * Detection runs in TWO passes with a hard precedence rule:
+ *
+ *   Pass 1 — PROJECT-LOCAL evidence only (.claude/, .cursor/, aider.conf.yml, ...).
+ *   Pass 2 — ENVIRONMENT and GLOBAL-HOME evidence (CLAUDECODE, ~/.codex,
+ *            ~/.cline, ~/.config/zed, ...) runs ONLY when pass 1 found nothing.
+ *
+ * A machine where the developer happens to have Codex installed globally
+ * (~/.codex exists) used to make EVERY bare directory report "Codex CLI, tier
+ * B" — advice about interception and sinks for a project that has nothing to
+ * do with that tool. A marker inside the project says something about THIS
+ * project; a marker in $HOME only says something about the MACHINE, so it must
+ * never outrank or substitute for project evidence.
+ */
+const TIER_B_ADVICE = 'Tier B host with protocol + advisory guardrails only. Shell-command leaks are possible; prefer the keychain sink so .env holds only references.';
+const TIER_C_ADVICE = 'Tier C host with protocol only. No interception hooks available; prefer the keychain sink so .env holds only references.';
+export function detectHost(root) {
+    /* ---------------- Pass 1: project-local evidence ---------------- */
+    // Claude Code. Detecting the HOST is not the same as detecting the PROTECTION:
+    // tier A is earned by envseal's interception hooks actually being installed, and
+    // `CLAUDECODE` being set only says which harness is running. Claiming "secrets
+    // are maximally protected" on the strength of an environment variable is the
+    // precise dishonesty this tier system exists to prevent — a user who believes
+    // the hooks are guarding them behaves as if `cat .env` is blocked when it is not.
+    if (existsSync(join(root, '.claude'))) {
+        if (envsealHooksInstalled(root)) {
+            return {
+                id: 'claude-code',
+                name: 'Claude Code',
+                tier: 'A',
+                reason: 'Claude Code detected and envseal interception hooks are installed',
+                recommendation: 'Tier A: the protocol plus interception hooks. Reads of .env and env-dumping commands are blocked, and pasted keys are redacted before the model sees them.',
+            };
+        }
+        return {
+            id: 'claude-code',
+            name: 'Claude Code',
+            tier: 'B',
+            reason: 'Claude Code detected, but envseal interception hooks were not found in .claude/settings.json or ~/.claude/settings.json',
+            recommendation: 'Tier B until the plugin is installed: the protocol works, but nothing blocks a shell command from reading .env. Install the plugin in plugins/claude-code for tier A, or prefer the keychain sink so .env holds only references.',
+        };
+    }
+    if (existsSync(join(root, '.cursor'))) {
+        return {
+            id: 'cursor',
+            name: 'Cursor',
+            tier: 'B',
+            reason: 'Found .cursor/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (existsSync(join(root, '.continue'))) {
+        return {
+            id: 'continue',
+            name: 'Continue',
+            tier: 'B',
+            reason: 'Found .continue/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    // Tier C: Aider (project-local config forms).
+    const aiderConfPatterns = ['aider', '.aider'];
+    const aiderMarkerExists = aiderConfPatterns.some((pattern) => existsSync(join(root, `${pattern}.conf.yml`)) ||
+        existsSync(join(root, `${pattern}.conf.yaml`)) ||
+        existsSync(join(root, `${pattern}.conf.json`)));
+    if (aiderMarkerExists) {
+        return {
+            id: 'aider',
+            name: 'Aider',
+            tier: 'C',
+            reason: 'Found .aider configuration file',
+            recommendation: TIER_C_ADVICE,
+        };
+    }
+    if (existsSync(join(root, '.windsurf'))) {
+        return {
+            id: 'windsurf',
+            name: 'Windsurf',
+            tier: 'B',
+            reason: 'Found .windsurf/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (existsSync(join(root, '.cline'))) {
+        return {
+            id: 'cline',
+            name: 'Cline',
+            tier: 'B',
+            reason: 'Found .cline/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (existsSync(join(root, '.zed'))) {
+        return {
+            id: 'zed',
+            name: 'Zed',
+            tier: 'B',
+            reason: 'Found .zed/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (existsSync(join(root, '.codex'))) {
+        return {
+            id: 'codex',
+            name: 'Codex CLI',
+            tier: 'B',
+            reason: 'Found .codex/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    // Tier B: JetBrains IDEs (IntelliJ, PyCharm, ...).
+    if (existsSync(join(root, '.idea'))) {
+        return {
+            id: 'jetbrains',
+            name: 'JetBrains IDE',
+            tier: 'B',
+            reason: 'Found .idea/ directory',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    // Tier C: Goose (project-local forms).
+    if (existsSync(join(root, 'goose.config.yaml')) || existsSync(join(root, '.goose'))) {
+        return {
+            id: 'goose',
+            name: 'Goose',
+            tier: 'C',
+            reason: 'Found goose.config.yaml or .goose/ directory',
+            recommendation: TIER_C_ADVICE,
+        };
+    }
+    // Tier B: GitHub Copilot agent. VS Code Copilot has no unique project
+    // directory, so the honest marker is Copilot settings inside
+    // .vscode/settings.json — a bare .vscode/ proves nothing, every VS Code
+    // project has one.
+    const vscodeSettings = join(root, '.vscode', 'settings.json');
+    let copilotSettings = false;
+    try {
+        copilotSettings =
+            existsSync(vscodeSettings) && /copilot/i.test(readFileSync(vscodeSettings, 'utf8'));
+    }
+    catch {
+        // Unreadable settings are not evidence of Copilot.
+    }
+    if (copilotSettings) {
+        return {
+            id: 'copilot',
+            name: 'GitHub Copilot',
+            tier: 'B',
+            reason: 'Found .vscode/settings.json referencing Copilot',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    // Tier B: Generic (AGENTS.md alone).
+    if (existsSync(join(root, 'AGENTS.md'))) {
+        return {
+            id: 'generic',
+            name: 'Generic Agent',
+            tier: 'B',
+            reason: 'Found AGENTS.md file',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    /* ------------- Pass 2: environment / global-home evidence -------------
+     * Reached ONLY when the project carries no marker of its own.             */
+    if (process.env.CLAUDECODE) {
+        return {
+            id: 'claude-code',
+            name: 'Claude Code',
+            tier: 'B',
+            reason: 'CLAUDECODE is set (running under Claude Code), no project markers found',
+            recommendation: 'Tier B until the plugin is installed: the protocol works, but nothing blocks a shell command from reading .env. Install the plugin in plugins/claude-code for tier A, or prefer the keychain sink so .env holds only references.',
+        };
+    }
+    if (process.env.CURSOR_WORKSPACE || process.env.CURSOR_VERSION) {
+        return {
+            id: 'cursor',
+            name: 'Cursor',
+            tier: 'B',
+            reason: 'CURSOR_* environment variable set, no project markers found',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (process.env.CLINE_ROOT) {
+        return {
+            id: 'cline',
+            name: 'Cline',
+            tier: 'B',
+            reason: 'CLINE_ROOT is set, no project markers found',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (process.env.ZED_EDITOR) {
+        return {
+            id: 'zed',
+            name: 'Zed',
+            tier: 'B',
+            reason: 'ZED_EDITOR is set, no project markers found',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (process.env.CODEX_ROOT) {
+        return {
+            id: 'codex',
+            name: 'Codex CLI',
+            tier: 'B',
+            reason: 'CODEX_ROOT is set, no project markers found',
+            recommendation: TIER_B_ADVICE,
+        };
+    }
+    if (existsSync(join(homedir(), '.codeium', 'windsurf')) ||
+        existsSync(join(homedir(), '.cline')) ||
+        existsSync(join(homedir(), '.config', 'zed')) ||
+        existsSync(join(homedir(), '.zed'))) {
+        return {
+            id: 'generic',
+            name: 'Generic Agent',
+            tier: 'B',
+            reason: 'No project markers found; a globally installed coding agent (Windsurf/Cline/Zed config in $HOME) is present',
+            recommendation: 'Advisory tier: the global install suggests an agent MAY act here, but nothing ties it to this project. The protocol still works; prefer the keychain sink so .env holds only references.',
+        };
+    }
+    if (process.env.GOOSE_ROOT || existsSync(join(homedir(), '.config', 'goose'))) {
+        return {
+            id: 'goose',
+            name: 'Goose',
+            tier: 'C',
+            reason: 'GOOSE_ROOT is set or global Goose config exists, no project markers found',
+            recommendation: TIER_C_ADVICE,
+        };
+    }
+    // Unknown.
+    return {
+        id: 'unknown',
+        name: 'Unknown Host',
+        tier: 'C',
+        reason: 'Could not detect a known host environment',
+        recommendation: TIER_C_ADVICE,
+    };
+}
+//# sourceMappingURL=host.js.map

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { EXIT, exitCodeForError, exitCodeForOutcome } from './exit-codes.js';
+export { emit, fail } from './output.js';
+export { finish, registerDisposable } from './exit.js';
+export type { ProtectionTier, HostInfo } from './host.js';
+export { detectHost } from './host.js';
+export { parseArgs, createBroker, outcomeForKey, hasInteractiveSurface } from './cli-utils.js';
+export { makeProbeApprover } from './probe-approval.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,7 @@
+export { EXIT, exitCodeForError, exitCodeForOutcome } from './exit-codes.js';
+export { emit, fail } from './output.js';
+export { finish, registerDisposable } from './exit.js';
+export { detectHost } from './host.js';
+export { parseArgs, createBroker, outcomeForKey, hasInteractiveSurface } from './cli-utils.js';
+export { makeProbeApprover } from './probe-approval.js';
+//# sourceMappingURL=index.js.map

package/dist/output.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Emit output in JSON or human-readable format.
+ * When json is true, prints ONLY a single JSON object to stdout.
+ * When false, prints the human string.
+ */
+export declare function emit(json: boolean, human: string, data: unknown): void;
+/**
+ * Print an error and set the appropriate exit code.
+ * Never prints a stack trace or a secret value.
+ *
+ * This does NOT return `never` any more: termination is deferred so the event
+ * loop can drain (see exit.ts). Every caller must be the last statement in its
+ * catch block, or must `return` immediately after.
+ */
+export declare function fail(json: boolean, error: unknown): void;
+//# sourceMappingURL=output.d.ts.map

package/dist/output.js

@@ -0,0 +1,57 @@
+import { isSepError } from '@envseal/protocol';
+import { EXIT, exitCodeForError } from './exit-codes.js';
+import { finish } from './exit.js';
+/**
+ * Emit output in JSON or human-readable format.
+ * When json is true, prints ONLY a single JSON object to stdout.
+ * When false, prints the human string.
+ */
+export function emit(json, human, data) {
+    if (json) {
+        console.log(JSON.stringify(data, null, 0));
+    }
+    else {
+        console.log(human);
+    }
+}
+/**
+ * Print an error and set the appropriate exit code.
+ * Never prints a stack trace or a secret value.
+ *
+ * This does NOT return `never` any more: termination is deferred so the event
+ * loop can drain (see exit.ts). Every caller must be the last statement in its
+ * catch block, or must `return` immediately after.
+ */
+export function fail(json, error) {
+    // A failure path must never default to "OK". The previous initialiser was 0,
+    // so throwing anything that was not a SepError, an Error, or a string exited
+    // the process successfully while printing an error message.
+    let code = EXIT.UNSATISFIED;
+    let userMessage = 'An unexpected error occurred.';
+    let retriable = false;
+    let errorCode;
+    if (isSepError(error)) {
+        code = exitCodeForError(error);
+        userMessage = error.userMessage;
+        retriable = error.retriable;
+        errorCode = error.code;
+    }
+    else if (error instanceof Error) {
+        userMessage = error.message;
+    }
+    else if (typeof error === 'string') {
+        userMessage = error;
+    }
+    if (json) {
+        console.log(JSON.stringify({
+            code: errorCode ?? 'UNKNOWN',
+            userMessage,
+            retriable,
+        }, null, 0));
+    }
+    else {
+        console.error(`Error: ${userMessage}`);
+    }
+    finish(code);
+}
+//# sourceMappingURL=output.js.map

package/dist/probe-approval.d.ts

@@ -0,0 +1,10 @@
+import type { ManifestEntry } from '@envseal/protocol';
+/**
+ * Build the `onApprovalNeeded` callback for the broker.
+ *
+ * Fails closed: with no interactive surface it returns false rather than
+ * hanging on a read nobody will answer, and rather than approving silently.
+ * Core turns that false into `probe_not_approved`, so `verify` still exits 6.
+ */
+export declare function makeProbeApprover(approvalsPath: string): (entry: ManifestEntry) => Promise<boolean>;
+//# sourceMappingURL=probe-approval.d.ts.map