@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/event-input.js

@@ -1,73 +0,0 @@
-// Shared tool-event input handling for the Risk Gate verbs that take a
-// tool-event JSON file: `harness explain-action`, `harness test-risk`,
-// `harness resolve-env`, and `harness explain-policy`.
-//
-// Each applies the same not-found / malformed / non-object guards,
-// resolves the same ambient `EnvelopeContext` (git, host, user, now),
-// and builds the Action Envelope. This module is that shared front end
-// so every verb stays byte-identical in how it reads and normalizes
-// its input.
-import * as fs from "node:fs";
-import * as os from "node:os";
-import { buildActionEnvelope, resolveGitContext, } from "../runtime/index.js";
-import { EX_NOINPUT, HarnessExitError } from "./exit-codes.js";
-function safeUser() {
-    try {
-        return os.userInfo().username;
-    }
-    catch {
-        return "";
-    }
-}
-function safeHost() {
-    try {
-        return os.hostname();
-    }
-    catch {
-        return "";
-    }
-}
-/**
- * Read a tool-event JSON file and build its Action Envelope.
- *
- * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
- * valid JSON, or does not decode to a JSON object. A well-formed but
- * sparse event (e.g. `{}`) is accepted: the envelope builder fills
- * absent fields with empty values rather than throwing. `verb` only
- * prefixes the error messages so the operator sees which command failed.
- */
-export function loadEventEnvelope(eventPath, seams = {}, verb = "explain-action") {
-    let raw;
-    try {
-        raw = fs.readFileSync(eventPath, "utf8");
-    }
-    catch {
-        throw new HarnessExitError(`${verb}: event file not found or unreadable: ${eventPath}`, EX_NOINPUT);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (err) {
-        throw new HarnessExitError(`${verb}: malformed event JSON in ${eventPath}: ${err.message}`, EX_NOINPUT);
-    }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        const got = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
-        throw new HarnessExitError(`${verb}: event JSON must be an object, got ${got}`, EX_NOINPUT);
-    }
-    const event = parsed;
-    const fallbackCwd = seams.cwdFallback ?? process.cwd();
-    const cwd = typeof event.cwd === "string" && event.cwd.length > 0
-        ? event.cwd
-        : fallbackCwd;
-    const resolveGit = seams.resolveGit ?? resolveGitContext;
-    const envelope = buildActionEnvelope(event, {
-        cwd,
-        git: resolveGit(cwd),
-        user: seams.user ?? safeUser(),
-        host: seams.host ?? safeHost(),
-        now: seams.now ?? new Date(),
-    });
-    return { event, envelope };
-}
-//# sourceMappingURL=event-input.js.map

package/dist/cli/event-input.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-input.js","sourceRoot":"","sources":["../../src/cli/event-input.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,aAAa;AAEb,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAIlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAqB/D,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,QAAyB,EAAE,EAC3B,IAAI,GAAG,gBAAgB;IAEvB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,yCAAyC,SAAS,EAAE,EAC3D,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,6BAA6B,SAAS,KAAM,GAAa,CAAC,OAAO,EAAE,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC;QAC7E,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,uCAAuC,GAAG,EAAE,EACnD,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAmB,CAAC;IAElC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,CAAC,KAAK,CAAC,GAAG;QACX,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAEzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC1C,GAAG;QACH,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,EAAE;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;KAC7B,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/cli/explain-action.d.ts

@@ -1,25 +0,0 @@
-import type { ActionEnvelope } from "../runtime/index.js";
-import { type Manifest } from "../schema/index.js";
-import { type EnrichmentSeams } from "./enriched-event.js";
-import { type EventInputSeams } from "./event-input.js";
-import { type LoaderOptions } from "./loader.js";
-export interface ExplainActionOptions extends EventInputSeams, EnrichmentSeams, LoaderOptions {
-    /** Inject the resolved manifest (tests); bypasses `loadManifest`. */
-    manifest?: Manifest;
-    /** Path to the tool-event JSON file. */
-    eventPath: string;
-    /** Emit JSON instead of YAML. */
-    json?: boolean;
-}
-export interface ExplainActionResult {
-    output: string;
-    envelope: ActionEnvelope;
-}
-/**
- * Build and render the Action Envelope for a tool-event JSON file.
- *
- * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
- * valid JSON, or does not decode to a JSON object (see
- * `loadEventEnvelope`). A well-formed but sparse event is accepted.
- */
-export declare function explainAction(opts: ExplainActionOptions): ExplainActionResult;

package/dist/cli/explain-action.js

@@ -1,57 +0,0 @@
-// Phase 7 #2 — `harness explain-action` CLI entrypoint.
-//
-// Debug verb for the Risk Gate. Reads a tool-event JSON file (the
-// Claude Code PreToolUse hook payload shape), builds the Action
-// Envelope, and prints it. This is the inspection surface for the
-// envelope normalization that Phase 7 #3-#5 build the classifier,
-// resolver, and policy evaluator on top of.
-//
-// File read, JSON guards, and envelope build live in the shared
-// `event-input` front end; this module only renders the result.
-import * as fs from "node:fs";
-import { stringify as stringifyYaml } from "yaml";
-import { parseBashPrefix } from "../runtime/bash-prefix-parse.js";
-import { parseManifest } from "../schema/index.js";
-import { enrichLoadedEvent } from "./enriched-event.js";
-import { loadEventEnvelope } from "./event-input.js";
-import { loadManifest, resolvePaths } from "./loader.js";
-import { readBashCommand } from "./policy/risk-envelope-enrichment.js";
-function manifestFor(event, opts) {
-    if (opts.manifest)
-        return opts.manifest;
-    const command = event.tool_name === "Bash" ? readBashCommand(event.tool_input) : null;
-    const branchTarget = command === null ? null : parseBashPrefix(command).branchTarget;
-    if (branchTarget === null)
-        return parseManifest({ version: 1 });
-    // With no `--config` and no manifest at the default location there are no
-    // resolvers, so the branch-switch upgrade is a no-op: use the empty
-    // manifest, as for any other command. An explicit `--config` that is
-    // missing, and a manifest that is invalid, still fail loudly.
-    if (opts.configPath === undefined && !fs.existsSync(resolvePaths(opts).base)) {
-        return parseManifest({ version: 1 });
-    }
-    return loadManifest(opts).manifest;
-}
-/**
- * Build and render the Action Envelope for a tool-event JSON file.
- *
- * Throws `HarnessExitError(EX_NOINPUT)` when the file is missing, is not
- * valid JSON, or does not decode to a JSON object (see
- * `loadEventEnvelope`). A well-formed but sparse event is accepted.
- */
-export function explainAction(opts) {
-    const loaded = loadEventEnvelope(opts.eventPath, opts, "explain-action");
-    // Print the envelope the hook builds: after its Bash-prefix enrichment
-    // (leading `cd`, `git switch|checkout`; task 8b891e83). The manifest is
-    // consulted only by the branch-switch upgrade (it compares what the
-    // resolvers say for the two branches), so it is loaded only for a
-    // command with a leading `git switch|checkout`; every other event, and a
-    // machine with no manifest at the default location, keeps working with
-    // the empty manifest, as before.
-    const { envelope } = enrichLoadedEvent(loaded, manifestFor(loaded.event, opts), opts);
-    const output = opts.json
-        ? `${JSON.stringify(envelope, null, 2)}\n`
-        : stringifyYaml(envelope, { lineWidth: 0 });
-    return { output, envelope };
-}
-//# sourceMappingURL=explain-action.js.map

package/dist/cli/explain-action.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"explain-action.js","sourceRoot":"","sources":["../../src/cli/explain-action.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,kEAAkE;AAClE,gEAAgE;AAChE,kEAAkE;AAClE,kEAAkE;AAClE,4CAA4C;AAC5C,EAAE;AACF,gEAAgE;AAChE,gEAAgE;AAEhE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAiB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAsB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAgBvE,SAAS,WAAW,CAAC,KAAgB,EAAE,IAA0B;IAC/D,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,YAAY,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC;IACrF,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,yEAAyE;IACzE,uEAAuE;IACvE,iCAAiC;IACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC1C,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/cli/explain-policy.d.ts

@@ -1,147 +0,0 @@
-import { type DeletionTargetVerdict, type EnvironmentResolution, type RiskProfile, type WhenClauseResult } from "../runtime/index.js";
-import type { Manifest } from "../schema/index.js";
-import { type EventInputSeams } from "./event-input.js";
-import { type LoaderOptions } from "./loader.js";
-export interface ExplainPolicyOptions extends EventInputSeams, LoaderOptions {
-    /** Path to the tool-event JSON file (the `--event` argument). */
-    eventPath: string;
-    /** Emit JSON instead of YAML. */
-    json?: boolean;
-    /** Inject the resolved manifest (tests); bypasses `loadManifest`. */
-    manifest?: Manifest;
-    /** Inject env vars for `env_var_patterns` (tests); defaults to `process.env`. */
-    env?: Record<string, string | undefined>;
-    /** Inject the kube context (tests); bypasses `~/.kube/config`. */
-    kubeContext?: string;
-    /** Inject the kube namespace (tests); bypasses `~/.kube/config`. */
-    kubeNamespace?: string;
-    /**
-     * cwd `session_start_preflight.setup`'s per-repo project layer is
-     * derived from when `opts.project` is absent (task c88461c1, review
-     * round 2, decision D-021b): the same `deriveProjectName` helper
-     * `harness session-start preflight` and `harness doctor` also feed
-     * their own `loadManifest` call from, so all three consumers agree on
-     * which project layer applies to a given cwd instead of `explain-
-     * policy` silently reporting the base/machine value for a repo whose
-     * producer is actually reading a project layer. Defaults to
-     * `process.cwd()`; tests inject a fixture repo dir to stay hermetic
-     * against the real cwd.
-     */
-    cwd?: string;
-}
-/**
- * Which resolved layer decided `session_start_preflight.setup` (task
- * c88461c1): "project" when the resolved project-override layer
- * itself declares the key, "machine" when a resolved machine-override
- * layer declares it (and no project layer does), "base" otherwise
- * (the base manifest, or the schema default when nothing declares the
- * key at all). Mirrors the loader's own last-wins precedence
- * (`applyLayers(baseRaw, ...machineLayers, projectLayer)`,
- * `src/overrides/merge.ts`): the project layer is checked first since
- * it is the highest-precedence layer, then machine layers from the
- * last-applied (highest-precedence) one back to the first.
- *
- * "unresolvable" (task c88461c1, review round 3 residual; task
- * `1c4eb3ea` of the batch-44 follow-up run): the cwd-derived project-scoped SECOND
- * load itself threw (a malformed project layer, an unreadable file).
- * Deliberately NOT "base": the base/machine values were never actually
- * re-read on this path (the plain load above them; see the round-3
- * comment this residual corrected), so attributing the result to
- * "base" would claim a value the base layer may not carry. `setup`
- * degrades to `false` alongside it, matching the producer's own
- * `setupEnabled` catch (`src/cli/session-start/index.ts`), so the two
- * agree on a scoped-load failure instead of only on a healthy load.
- */
-export type SessionStartPreflightLayerSource = "base" | "machine" | "project" | "unresolvable";
-interface ExplainPolicyProjection {
-    policy: string;
-    description: string;
-    trigger: {
-        event: string;
-        match?: string;
-        path_match?: string;
-        bash_match?: string;
-        matched: boolean;
-    };
-    classifier: RiskProfile;
-    environment: EnvironmentResolution;
-    /**
-     * Which parts of the hook's evaluation this verb mirrors and which it
-     * deliberately does not (task 7c3919a2). `envelope_enrichment` lists the
-     * Bash-prefix merges shared with `harness policy intercept`;
-     * `not_evaluated` lists what the hook does that this hypothetical,
-     * read-free verb does not.
-     */
-    parity: {
-        envelope_enrichment: string[];
-        not_evaluated: string[];
-        /**
-         * Per-event (task 8b891e83): true when the Bash prefix remainder
-         * (what follows a leading `cd`/`VAR=value`/`git switch` prefix) is a
-         * `kubectl` command carrying an explicit `--context`/`--namespace`/
-         * `-n`. The hook merges that target into its environment resolution
-         * upgrade-only; this verb never does (`not_evaluated` lists
-         * `kubectl_target` statically), so `true` tells the operator the
-         * `applies` verdict below was computed WITHOUT a merge the hook
-         * would perform for this very event. `false` means no such target
-         * was found, i.e. the skipped merge would have been a no-op.
-         */
-        kubectl_target_present: boolean;
-    };
-    /** Static deletion-target verdict (task d03af8f6); null when the
-     *  event's command is not a recognized deletion verb. */
-    deletion_target: DeletionTargetVerdict | null;
-    /**
-     * Resolved `session_start_preflight` config (task 30183330), shown
-     * only when the explained policy is one of the init-generated
-     * `preflight-before-*` gates (name starts with `preflight-before-`):
-     * this is the knob that decides whether the `harness session-start
-     * preflight` / `harness preflight` producer passes `--setup` to the
-     * `preflight run` invocation whose `ready:true` result these policies
-     * gate on. Omitted for every other policy; it has no bearing on
-     * their evaluation (review round 3 residual; task `1c4eb3ea`: the
-     * scoped SECOND load below this field's assignment site runs ONLY
-     * when this condition is already true, so a policy this block is
-     * never rendered for never pays for that extra load either).
-     * `source` (task c88461c1) names which resolved layer decided the
-     * value: `"base"` (also covers an injected `opts.manifest`, which
-     * carries no per-layer provenance to attribute), `"machine"`,
-     * `"project"` (the cwd-derived per-repo layer), or `"unresolvable"`
-     * (review round 3 residual; task `1c4eb3ea`: the scoped load itself
-     * threw, `setup` degrades to `false` alongside it). This function
-     * derives that project name itself, from `opts.cwd`, via the SAME
-     * `deriveProjectName` helper `harness session-start preflight` feeds
-     * through `LoaderOptions.project` (review round 2, decision D-021b:
-     * without this, an operator running `explain-policy` with no
-     * `--project` in a repo that DOES have a project layer would see the
-     * base/machine value while the producer itself reads the project
-     * layer, see src/cli/session-start/index.ts).
-     */
-    session_start_preflight?: {
-        setup: boolean;
-        source: SessionStartPreflightLayerSource;
-    };
-    when: {
-        declared: false;
-    } | {
-        declared: true;
-        matched: boolean;
-        clauses: WhenClauseResult[];
-        unclassifiedFallback: boolean;
-    };
-    /** trigger AND when — would this policy fire on this event? */
-    applies: boolean;
-}
-export interface ExplainPolicyResult {
-    output: string;
-    projection: ExplainPolicyProjection;
-}
-/**
- * Explain whether `policyName` applies to the event at `opts.eventPath`.
- *
- * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
- * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
- * `loadEventEnvelope`) when the event file is missing or malformed.
- */
-export declare function explainPolicy(policyName: string, opts: ExplainPolicyOptions): ExplainPolicyResult;
-export {};

package/dist/cli/explain-policy.js

@@ -1,248 +0,0 @@
-// Phase 7 #5 — `harness explain-policy` CLI entrypoint.
-//
-// Risk Gate debug verb: given a policy name and a tool-event JSON file,
-// explain whether the policy would APPLY to that event, and why. A
-// policy applies only when its `trigger:` matches AND — when declared —
-// every `when:` clause holds against the enriched Action Envelope. This
-// verb shows both verdicts side by side: the trigger match, the Risk
-// Classifier profile, the resolved environment, and a per-clause `when:`
-// breakdown, so an operator authoring a risk policy sees exactly which
-// clause admitted an action or held it back.
-//
-// Distinct from `harness explain <policy> --trace`: that replays the
-// LAST recorded decision from the evidence ledger; `explain-policy`
-// evaluates a hypothetical event live and reads nothing from the ledger.
-import * as fs from "node:fs";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import { classifyRisk, deriveProjectName, evaluateWhen, policyMatchesEvent, resolveDeletionTarget, resolveEnvironment, } from "../runtime/index.js";
-import { parseKubectlTarget } from "../runtime/kubectl-target-parse.js";
-import { extractShellCommand } from "../runtime/tool-name-aliases.js";
-import { DEFAULT_SAFE_DELETION_ROOTS } from "../schema/risk.js";
-import { enrichLoadedEvent } from "./enriched-event.js";
-import { loadEventEnvelope } from "./event-input.js";
-import { EX_USAGE, HarnessExitError } from "./exit-codes.js";
-import { loadManifest } from "./loader.js";
-/**
- * Does `filePath`'s raw YAML explicitly declare `session_start_preflight.setup`?
- *
- * "Declare" means KEY PRESENCE, not "holds a boolean" (review round 2,
- * finding: a tombstone, `session_start_preflight: null` or `{setup:
- * null}`, both honoured by `mergeValue` in src/overrides/merge.ts as
- * "delete whatever a lower layer set, falling back to the schema
- * default", is exactly as much a deliberate declaration by THIS layer
- * as `setup: true`/`false` is; it just resolves to a different final
- * value. Attributing a tombstoned layer's decision to whichever lower
- * layer happens to also declare the key (or to "base" when none does)
- * would name the WRONG layer as the one that decided the merged
- * result.
- */
-function layerDeclaresSetup(filePath) {
-    try {
-        const raw = fs.readFileSync(filePath, "utf8");
-        const parsed = parseYaml(raw);
-        if (parsed === null || typeof parsed !== "object")
-            return false;
-        if (!("session_start_preflight" in parsed))
-            return false;
-        const block = parsed.session_start_preflight;
-        if (block === null)
-            return true; // whole-block tombstone
-        if (typeof block !== "object" || Array.isArray(block))
-            return false;
-        return "setup" in block;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Re-reads the resolved layer files (independent of the already-merged
- * `manifest` object, which no longer carries per-layer provenance once
- * `applyLayers` has folded them together) to attribute the decided
- * `session_start_preflight.setup` value to the layer that set it.
- */
-function resolveSessionStartPreflightSource(resolved) {
-    if (resolved.projectLayer !== null && layerDeclaresSetup(resolved.projectLayer)) {
-        return "project";
-    }
-    for (let i = resolved.machineLayers.length - 1; i >= 0; i--) {
-        if (layerDeclaresSetup(resolved.machineLayers[i]))
-            return "machine";
-    }
-    return "base";
-}
-/**
- * Explain whether `policyName` applies to the event at `opts.eventPath`.
- *
- * Throws `HarnessExitError(EX_USAGE)` when the named policy is not
- * declared in the manifest, and `HarnessExitError(EX_NOINPUT)` (via
- * `loadEventEnvelope`) when the event file is missing or malformed.
- */
-export function explainPolicy(policyName, opts) {
-    // `resolved` is only available on the real `loadManifest(opts)` path:
-    // an injected `opts.manifest` already IS the merged result and
-    // carries no per-layer provenance, so `session_start_preflight.source`
-    // falls back to "base" in that case (see the field's doc comment).
-    //
-    // PLAIN load (task c88461c1, review round 3, decision D-028): every
-    // check this verb performs against `manifest` below -- finding the
-    // named policy, trigger matching, the Risk Classifier, environment
-    // resolution, deletion-target resolution, and the `when:` evaluation
-    // -- reads the base/machine/explicit-`--project` manifest only, an
-    // explicit `opts.project` still wins outright but NOTHING is derived
-    // from cwd here. This mirrors `harness policy intercept`
-    // (src/cli/policy/intercept.ts) and `harness dry-run`
-    // (src/cli/dry-run.ts), the two enforcement-facing verbs that decide
-    // a policy's real trigger verdict: neither ever consults a derived
-    // project layer, so this manifest must not either, or an operator's
-    // "would this apply" answer could disagree with what actually
-    // enforces. Only `session_start_preflight.setup` (and its `source`
-    // attribution) below get a project-scoped SECOND load: routing a
-    // derived layer through THIS one, unrelated load would let it
-    // silently reach the policy engine this verb evaluates, for zero
-    // benefit to the one key that needs it.
-    let manifest;
-    let resolvedPaths;
-    if (opts.manifest) {
-        manifest = opts.manifest;
-    }
-    else {
-        const loaded = loadManifest(opts);
-        manifest = loaded.manifest;
-        resolvedPaths = loaded.resolved;
-    }
-    const policy = manifest.policies.find((p) => p.name === policyName);
-    if (!policy) {
-        const available = manifest.policies.map((p) => p.name).join(", ") || "(none)";
-        throw new HarnessExitError(`no policy named "${policyName}" declared; available: ${available}`, EX_USAGE);
-    }
-    // `session_start_preflight.setup` / `source` (task c88461c1, review
-    // round 2 decision D-021b; scope narrowed to this one key, review
-    // round 3 decision D-028; gated on the name-prefix check below,
-    // review round 3 residual, task `1c4eb3ea`): an explicit
-    // `opts.project` still wins outright; otherwise derive the project
-    // name from `opts.cwd` (defaulting to `process.cwd()`) via the SAME
-    // `deriveProjectName` the two other producers reach through
-    // `resolveScopedProjectName` (src/runtime/git-context.ts; this verb keeps
-    // its own copy with an `undefined` fallback, task f1eb1c5c), so this
-    // verb's `setup`/`source` reflect the layer the producer would read for
-    // this cwd, WITHOUT letting that derived layer reach the policy evaluation above. An injected
-    // `opts.manifest` carries no per-layer provenance to re-derive from
-    // and always reports "base" (unchanged from before this task).
-    //
-    // ONLY COMPUTED FOR `preflight-before-*` POLICIES (moved behind this
-    // check, review round 3 residual, task `1c4eb3ea`): the block below
-    // is rendered into the projection ONLY for those policies (see
-    // `ExplainPolicyProjection.session_start_preflight`'s doc comment),
-    // so a caller explaining any OTHER policy no longer pays for a
-    // second manifest load whose result it can never see.
-    let sessionStartPreflightSetup = false;
-    let sessionStartPreflightSource = "base";
-    if (policy.name.startsWith("preflight-before-")) {
-        sessionStartPreflightSetup = manifest.session_start_preflight.setup;
-        sessionStartPreflightSource = resolvedPaths
-            ? resolveSessionStartPreflightSource(resolvedPaths)
-            : "base";
-        if (!opts.manifest) {
-            try {
-                const scoped = loadManifest({
-                    ...opts,
-                    project: opts.project ?? deriveProjectName(opts.cwd ?? process.cwd()) ?? undefined,
-                });
-                sessionStartPreflightSetup = scoped.manifest.session_start_preflight.setup;
-                sessionStartPreflightSource = resolveSessionStartPreflightSource(scoped.resolved);
-            }
-            catch {
-                // Review round 3 residual, task `1c4eb3ea`: degrade to
-                // setup:false / source:"unresolvable" rather than keeping the
-                // plain load's values, matching the producer's own
-                // `setupEnabled` catch (`src/cli/session-start/index.ts`),
-                // which degrades to `setup: false` on the identical failure
-                // instead of falling back to a base/machine value it never
-                // actually re-read on this path. "base" would misattribute
-                // the result to a layer this function never consulted here.
-                sessionStartPreflightSetup = false;
-                sessionStartPreflightSource = "unresolvable";
-            }
-        }
-    }
-    const loaded = loadEventEnvelope(opts.eventPath, opts, "explain-policy");
-    const { event } = loaded;
-    // Envelope enrichment shared with `harness policy intercept` (task
-    // 7c3919a2): the leading Bash prefix (inline `VAR=value`, `cd <path>
-    // &&`, `git switch|checkout <branch> &&`) is parsed and merged into
-    // the resolver inputs by the SAME helper the hook uses (through
-    // `enrichLoadedEvent`, shared with `resolve-env`, `test-risk` and
-    // `explain-action`, task 8b891e83), so this verb cannot report
-    // `unknown` for a command the hook resolves to `production`. Only the
-    // envelope enrichment is shared; this verb still reads no ledger or
-    // evidence.
-    const { envelope, enrichment, kube } = enrichLoadedEvent(loaded, manifest, opts);
-    const classifier = classifyRisk(envelope, manifest.risk.classifiers);
-    const environment = resolveEnvironment(envelope, manifest.environments.resolvers, {
-        env: enrichment.env,
-        kubeContext: kube.context,
-        kubeNamespace: kube.namespace,
-    });
-    // Static deletion-target resolution (task d03af8f6) — same "raw
-    // command only, no ambient cwd/env" contract as the runtime's own
-    // `enrichEnvelope`. See `deletion-target-resolve.ts`.
-    const explainShellCommand = extractShellCommand({ raw_input: envelope.raw_input });
-    const deletionTarget = explainShellCommand === null
-        ? null
-        : resolveDeletionTarget(explainShellCommand, manifest.risk.safe_deletion_roots ?? DEFAULT_SAFE_DELETION_ROOTS);
-    const triggerMatched = policyMatchesEvent(policy, event);
-    const whenEval = policy.when !== undefined
-        ? evaluateWhen(policy.when, { risk: classifier, environment, deletionTarget })
-        : undefined;
-    // Same remainder the hook feeds `parseKubectlTarget` (after the
-    // prefix consumed `cd`/`VAR=value`/`git switch`); flag only, no merge.
-    const kubectlSubject = enrichment.riskBashCommand === null
-        ? null
-        : enrichment.riskBashCommand.slice(enrichment.bashPrefix?.remainderStart ?? 0);
-    const kubectlTarget = kubectlSubject === null ? null : parseKubectlTarget(kubectlSubject);
-    const kubectlTargetPresent = kubectlTarget !== null && (kubectlTarget.context !== null || kubectlTarget.namespace !== null);
-    const projection = {
-        policy: policy.name,
-        description: policy.description,
-        trigger: {
-            event: policy.trigger.event,
-            ...(policy.trigger.match !== undefined && { match: policy.trigger.match }),
-            ...(policy.trigger.path_match !== undefined && {
-                path_match: policy.trigger.path_match,
-            }),
-            ...(policy.trigger.bash_match !== undefined && {
-                bash_match: policy.trigger.bash_match,
-            }),
-            matched: triggerMatched,
-        },
-        classifier,
-        environment,
-        parity: {
-            envelope_enrichment: ["inline_env", "cd_git_context", "branch_switch_upgrade"],
-            not_evaluated: ["ledger_requires", "kubectl_target"],
-            kubectl_target_present: kubectlTargetPresent,
-        },
-        deletion_target: deletionTarget,
-        ...(policy.name.startsWith("preflight-before-") && {
-            session_start_preflight: {
-                setup: sessionStartPreflightSetup,
-                source: sessionStartPreflightSource,
-            },
-        }),
-        when: whenEval
-            ? {
-                declared: true,
-                matched: whenEval.matched,
-                clauses: whenEval.clauses,
-                unclassifiedFallback: whenEval.unclassifiedFallback,
-            }
-            : { declared: false },
-        applies: triggerMatched && (whenEval ? whenEval.matched : true),
-    };
-    const output = opts.json
-        ? `${JSON.stringify(projection, null, 2)}\n`
-        : stringifyYaml(projection, { lineWidth: 0 });
-    return { output, projection };
-}
-//# sourceMappingURL=explain-policy.js.map

package/dist/cli/explain-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"explain-policy.js","sourceRoot":"","sources":["../../src/cli/explain-policy.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,6CAA6C;AAC7C,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAA0C,MAAM,aAAa,CAAC;AAuDnF;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAiD,CAAC;QAC9E,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,CAAC,CAAC,yBAAyB,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,OAAO,IAAK,KAAiC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,QAAuB;IAEvB,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5D,IAAI,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAoFD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAA0B;IAE1B,sEAAsE;IACtE,+DAA+D;IAC/D,uEAAuE;IACvE,mEAAmE;IACnE,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,yDAAyD;IACzD,sDAAsD;IACtD,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,8DAA8D;IAC9D,mEAAmE;IACnE,iEAAiE;IACjE,8DAA8D;IAC9D,iEAAiE;IACjE,wCAAwC;IACxC,IAAI,QAAkB,CAAC;IACvB,IAAI,aAAwC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CACxB,oBAAoB,UAAU,0BAA0B,SAAS,EAAE,EACnE,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,kEAAkE;IAClE,gEAAgE;IAChE,yDAAyD;IACzD,mEAAmE;IACnE,oEAAoE;IACpE,4DAA4D;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,wEAAwE;IACxE,8FAA8F;IAC9F,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,+DAA+D;IAC/D,sDAAsD;IACtD,IAAI,0BAA0B,GAAG,KAAK,CAAC;IACvC,IAAI,2BAA2B,GAAqC,MAAM,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,0BAA0B,GAAG,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACpE,2BAA2B,GAAG,aAAa;YACzC,CAAC,CAAC,kCAAkC,CAAC,aAAa,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,GAAG,IAAI;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,SAAS;iBACnF,CAAC,CAAC;gBACH,0BAA0B,GAAG,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBAC3E,2BAA2B,GAAG,kCAAkC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,8DAA8D;gBAC9D,mDAAmD;gBACnD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0BAA0B,GAAG,KAAK,CAAC;gBACnC,2BAA2B,GAAG,cAAc,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEzB,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,YAAY;IACZ,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjF,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,QAAQ,CAAC,YAAY,CAAC,SAAS,EAC/B;QACE,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;KAC9B,CACF,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,MAAM,cAAc,GAClB,mBAAmB,KAAK,IAAI;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qBAAqB,CACnB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,2BAA2B,CACjE,CAAC;IAER,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,uEAAuE;IACvE,MAAM,cAAc,GAClB,UAAU,CAAC,eAAe,KAAK,IAAI;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GACxB,aAAa,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;IAEjG,MAAM,UAAU,GAA4B;QAC1C,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;YAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC7C,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACtC,CAAC;YACF,OAAO,EAAE,cAAc;SACxB;QACD,UAAU;QACV,WAAW;QACX,MAAM,EAAE;YACN,mBAAmB,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;YAC9E,aAAa,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACpD,sBAAsB,EAAE,oBAAoB;SAC7C;QACD,eAAe,EAAE,cAAc;QAC/B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI;YACjD,uBAAuB,EAAE;gBACvB,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,2BAA2B;aACpC;SACF,CAAC;QACF,IAAI,EAAE,QAAQ;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD;YACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACvB,OAAO,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;KAChE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/cli/explain.d.ts

@@ -1,31 +0,0 @@
-import { type LedgerQueryResult } from "../policies/index.js";
-import { type PolicyDecisionPayload } from "../io/ledger-record.js";
-import { type ResolveReadSessionOptions } from "../runtime/session-id.js";
-import { type LoaderOptions } from "./loader.js";
-export type ExplainDecisionFilter = PolicyDecisionPayload["outcome"];
-export interface ExplainOptions extends LoaderOptions {
-    json?: boolean;
-    trace?: boolean;
-    /** Session whose audit log to inspect for `--trace`. */
-    sessionId?: string;
-    /**
-     * Read-path session resolution overrides (tests). When `sessionId` is
-     * not given, `resolveReadSessionId` discovers the live session from
-     * the newest Claude Code transcript; this seam lets tests stub that
-     * scan so they stay hermetic.
-     */
-    sessionDiscovery?: ResolveReadSessionOptions;
-    /**
-     * When true, ignore the policy-name argument and trace the most recent
-     * decision recorded in the ledger (any policy). Implies --trace.
-     */
-    last?: boolean;
-    /** When `last` is set, only consider decisions of this outcome. */
-    decisionFilter?: ExplainDecisionFilter;
-    /** Override the ledger fetcher (tests). */
-    fetchLedger?: (sessionId: string) => Promise<LedgerQueryResult>;
-}
-export interface ExplainResult {
-    output: string;
-}
-export declare function explain(policyName: string | undefined, opts?: ExplainOptions): Promise<ExplainResult>;