@peac/cli 0.13.4 → 0.14.1

package/dist/commands/emit-lifecycle.d.ts

@@ -0,0 +1,140 @@
+/**
+ * `peac emit lifecycle` subcommand.
+ *
+ * Issues a Wire 0.2 compact JWS lifecycle observation record from
+ * caller-supplied flags. The caller observed the lifecycle event (an
+ * external approval, evaluation, experiment, workflow transition, or
+ * mode tag); the CLI is the issuance path; the caller's issuer is the
+ * signer-of-record. PEAC provides the record format, validation, and
+ * signing path. PEAC does not capture, observe, decide, evaluate,
+ * score, transition, orchestrate, schedule, or vouch for the truth of
+ * the event.
+ *
+ * Signing UX uses the existing PEAC issuer-key reference convention
+ * (mirrors `peac record command`):
+ *
+ *   --issuer-key <env:VAR | file:/path>
+ *   --issuer-id  <url>
+ *   --unsafe-ephemeral-key
+ *
+ * `--observed-at` is REQUIRED. The wrapper does not silently default the
+ * external event time to the wrapper-invocation time; that would
+ * misrepresent when the external system observed the event.
+ *
+ * Stable error codes:
+ *   lifecycle.missing_required_field      (missing flag for required field)
+ *   lifecycle.event_kind_unknown          (--event-kind not in the 9 enum)
+ *   lifecycle.invalid_observed_at         (--observed-at not RFC 3339)
+ *   lifecycle.opaque_ref_grammar_violation
+ *   lifecycle.approver_ref_pii_blocked
+ *   lifecycle.ref_must_be_string
+ *   lifecycle.inline_value_blocked
+ *   cli.issuer_key_required               (no signing input supplied)
+ *   cli.issuer_id_required
+ *   cli.issuer_id_invalid
+ *   cli.unsafe_ephemeral_key_mutex        (--issuer-key and --unsafe-ephemeral-key both supplied)
+ *   cli.issuer_key_load_failed            (from the shared issuer-key loader)
+ *   cli.issuer_key_invalid                (from the shared issuer-key loader)
+ *   cli.signing_failed
+ *   cli.output_write_failed
+ */
+import { Command } from 'commander';
+import { type LifecycleEventKind } from '@peac/schema';
+/**
+ * Discriminator literal -> canonical record-type URI. The two arrays move
+ * together; this is a defense-in-depth check.
+ */
+declare const EVENT_KINDS: readonly LifecycleEventKind[];
+declare const TYPE_URI_BY_EVENT_KIND: Readonly<Record<LifecycleEventKind, string>>;
+declare const OBSERVED_MODES: readonly ["deterministic_script", "templated_flow", "agent_loop", "human_step", "hybrid"];
+type ObservedMode = (typeof OBSERVED_MODES)[number];
+export declare const EMIT_LIFECYCLE_ERROR_CODES: {
+    readonly missingRequiredField: "lifecycle.missing_required_field";
+    readonly eventKindUnknown: "lifecycle.event_kind_unknown";
+    readonly invalidObservedAt: "lifecycle.invalid_observed_at";
+    readonly invalidObservedMode: "lifecycle.invalid_observed_mode";
+    readonly invalidState: "lifecycle.invalid_state";
+    readonly issuerKeyRequired: "cli.issuer_key_required";
+    readonly issuerIdRequired: "cli.issuer_id_required";
+    readonly issuerIdInvalid: "cli.issuer_id_invalid";
+    readonly unsafeEphemeralKeyMutex: "cli.unsafe_ephemeral_key_mutex";
+    readonly issuerKeyLoadFailed: "cli.issuer_key_load_failed";
+    readonly issuerKeyInvalid: "cli.issuer_key_invalid";
+    readonly signingFailed: "cli.signing_failed";
+    readonly outputWriteFailed: "cli.output_write_failed";
+};
+export interface EmitLifecycleOptions {
+    eventKind?: string;
+    subjectRef?: string;
+    parentRef?: string;
+    upstreamArtifactRef?: string;
+    upstreamArtifactDigest?: string;
+    policyRef?: string;
+    policyDigest?: string;
+    rubricRef?: string;
+    approvalRef?: string;
+    approverRef?: string;
+    experimentRef?: string;
+    cohortRef?: string;
+    variantRef?: string;
+    observedMode?: string;
+    resultRef?: string;
+    resultDigest?: string;
+    scoreRef?: string;
+    fromState?: string;
+    toState?: string;
+    observedAt?: string;
+    issuerKey?: string;
+    issuerId?: string;
+    unsafeEphemeralKey: boolean;
+    output: string;
+}
+export interface EmitLifecycleIO {
+    writeStdout: (chunk: string) => void;
+    writeStderr: (chunk: string) => void;
+    /**
+     * Environment used to resolve `env:VAR` issuer-key references.
+     * Defaults to `process.env`. Tests inject custom env.
+     */
+    issuerKeyEnv: NodeJS.ProcessEnv;
+}
+export interface EmitLifecycleResult {
+    exitCode: number;
+}
+interface ValidationFailure {
+    code: string;
+    message: string;
+}
+/**
+ * Validate flag combinations BEFORE building the observation, loading
+ * the key, or signing. Surfaces stable codes that match the schema's
+ * lifecycle.* codes for schema-domain failures.
+ */
+export declare function validateEmitLifecycleOptions(opts: EmitLifecycleOptions): ValidationFailure[];
+/**
+ * Build the lifecycle observation object from validated CLI options.
+ * Only fields populated by flags are included; the schema validator
+ * accepts the discriminated-union shape per event_kind.
+ */
+export declare function buildLifecycleObservation(opts: EmitLifecycleOptions): Record<string, unknown>;
+/**
+ * Pure handler: validates flags, preflights output and key, builds the
+ * observation, validates against the schema, signs as Wire 0.2 JWS, emits.
+ * Tests drive this directly without going through commander.
+ */
+export declare function runEmitLifecycle(options: Partial<EmitLifecycleOptions>, io?: Partial<EmitLifecycleIO>): Promise<EmitLifecycleResult>;
+/**
+ * Commander factory for the `lifecycle` subcommand under the `emit`
+ * parent group. Wires --flag parsing and delegates to the pure handler.
+ */
+export declare function emitLifecycleSubcommand(): Command;
+/**
+ * Commander factory for the public `peac emit` parent group. Adds the
+ * `lifecycle` subcommand. Additional `emit` subcommands can be
+ * registered by their own profiles.
+ */
+export declare function emitCommand(): Command;
+/** Re-exports for tests. */
+export { TYPE_URI_BY_EVENT_KIND, EVENT_KINDS, OBSERVED_MODES };
+export type { ObservedMode };
+//# sourceMappingURL=emit-lifecycle.d.ts.map

package/dist/commands/emit-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-lifecycle.d.ts","sourceRoot":"","sources":["../../src/commands/emit-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAKL,KAAK,kBAAkB,EAExB,MAAM,cAAc,CAAC;AAWtB;;;GAGG;AACH,QAAA,MAAM,WAAW,EAAE,SAAS,kBAAkB,EAUpC,CAAC;AAEX,QAAA,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAarE,CAAC;AAEL,QAAA,MAAM,cAAc,2FAMV,CAAC;AACX,KAAK,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;CAc7B,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,EAAE,CAmL5F;AA0CD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmD7F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,EACtC,EAAE,GAAE,OAAO,CAAC,eAAe,CAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC,CA8E9B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAwGjD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,OAAO,CAMrC;AAED,4BAA4B;AAC5B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/commands/observe-command.d.ts

@@ -0,0 +1,135 @@
+/**
+ * `peac observe command` subcommand.
+ *
+ * Wraps a child process and emits an unsigned CLI execution observation
+ * record to stdout (or `--output <file>`). Hard security defaults:
+ *   - argv hashed
+ *   - stdout/stderr length + sha256 + truncated only (no sample without
+ *     double-opt-in raw mode)
+ *   - stdin closed (none)
+ *   - env capture deny-by-default
+ *   - cwd hashed; binary path hashed
+ *   - secret-scan on
+ *   - shell binary detected without --shell-mode hard-fails
+ *
+ * The wrapper is an OBSERVER, not a sandbox / permission system / shell
+ * orchestrator / process supervisor / job scheduler. It does not
+ * synthesize shell syntax; the command after `--` is spawned exactly as
+ * supplied with `shell: false`.
+ */
+import { Command } from 'commander';
+import { preflightOutputWritable, resolveProgramPath, runObservationCore, type CoreObservationOptions, type CoreObservationIO } from '../lib/observation-pipeline.js';
+import { type ValidationFailure } from '../lib/command-option-validation.js';
+import type { ArgvMode, CwdMode, BinaryPathMode, EnvMode, StdinMode, ExitCodeMode, ExecutionMode } from '../lib/observation-builder.js';
+export { preflightOutputWritable, resolveProgramPath, runObservationCore };
+export type { CoreObservationOptions, CoreObservationIO };
+/**
+ * Stable error codes surfaced to the user via stderr + non-zero exit.
+ * Mirrors the shared `COMMAND_OPTION_ERROR_CODES` set plus a few
+ * subcommand-specific codes (spawn-failed, schema-rejection,
+ * output-write-failed) that originate inside `runObservationCore` or
+ * the emit step rather than the option-validation layer.
+ */
+export declare const OBSERVE_COMMAND_ERROR_CODES: {
+    readonly envModeInconsistent: "cli.env_mode_inconsistent";
+    readonly schemaRejection: "cli.schema_rejection";
+    readonly unsupportedFlag: "cli.unsupported_flag";
+    readonly spawnFailed: "cli.spawn_failed";
+    readonly outputWriteFailed: "cli.output_write_failed";
+    readonly programRequired: "cli.program_required";
+    readonly unsafeFlagRequired: "cli.unsafe_flag_required";
+    readonly secretScanDisableRequiresUnsafeFlag: "cli.secret_scan_disable_requires_unsafe_flag";
+    readonly shellModeRequired: "cli.shell_mode_required";
+    readonly argvTokenTooLong: "cli.argv_token_too_long";
+    readonly outOfRange: "cli.out_of_range";
+    readonly invalidPolicyDigest: "cli.invalid_policy_digest";
+    readonly invalidConfigDigest: "cli.invalid_config_digest";
+    readonly invalidApprovalRef: "cli.invalid_approval_ref";
+    readonly invalidEnvKey: "cli.invalid_env_key";
+    readonly signingInputRequired: "cli.signing_input_required";
+    readonly signingInputConflict: "cli.signing_input_conflict";
+    readonly issuerIdRequired: "cli.issuer_id_required";
+    readonly issuerIdInvalid: "cli.issuer_id_invalid";
+};
+export interface ObserveCommandOptions {
+    /** Resolved CLI flag values; tests construct this directly. */
+    captureMode: ArgvMode;
+    unsafeAllowRawCapture: boolean;
+    captureStdinMode: StdinMode;
+    captureStdoutBytes: number;
+    captureStderrBytes: number;
+    captureArgvBytes: number;
+    envAllow: string[];
+    envMode: EnvMode;
+    unsafeAllowRawEnv: boolean;
+    captureCwdMode: CwdMode;
+    captureBinaryPath: BinaryPathMode;
+    secretScan: boolean;
+    unsafeDisableSecretScan: boolean;
+    policyDigest?: string;
+    configDigest?: string;
+    approvalRef?: string;
+    executionMode: ExecutionMode;
+    shellMode: boolean;
+    output: string;
+    timeoutMs: number;
+    killGraceMs: number;
+    exitCodeMode: ExitCodeMode;
+}
+export interface ObserveCommandIO {
+    /** Defaults to process.stdout.write. */
+    writeStdout: (chunk: string) => void;
+    /** Defaults to process.stderr.write. */
+    writeStderr: (chunk: string) => void;
+    /**
+     * Environment passed to the child process. Defaults to process.env.
+     * Distinct from `captureEnv` so env-capture policy (what PEAC RECORDS)
+     * stays decoupled from execution env (what the child RECEIVES).
+     */
+    childEnv: NodeJS.ProcessEnv;
+    /**
+     * Environment inspected by --env-allow for record entries. Defaults
+     * to process.env. Tests override either side independently.
+     */
+    captureEnv: NodeJS.ProcessEnv;
+    /** Defaults to process.cwd(). */
+    cwd: string;
+    /** Defaults to a tiny version constant. */
+    peacCliVersion: string;
+}
+export interface ObserveCommandResult {
+    exitCode: number;
+}
+/**
+ * Commander integer flag parser that surfaces NaN / non-integer input
+ * as `Number.NaN` instead of silently coercing. The shared option
+ * validator rejects NaN via `isValidIntInRange` and emits
+ * `cli.out_of_range`.
+ */
+export declare function parseIntegerFlag(raw: string): number;
+/**
+ * Validate flag combinations BEFORE spawning the child. Delegates to
+ * `validateCoreCommandOptions` so observe command and record command
+ * share one source of truth for option validation.
+ */
+export declare function validateObserveOptions(opts: ObserveCommandOptions, childArgv: string[]): ValidationFailure[];
+/**
+ * Pure handler: validates flags, runs the child, builds the
+ * observation, validates against the schema, emits JSON. Tests drive
+ * this directly without going through commander.
+ */
+export declare function runObserveCommand(options: Partial<ObserveCommandOptions>, childArgv: string[], io?: Partial<ObserveCommandIO>): Promise<ObserveCommandResult>;
+/**
+ * Commander factory for the inner `command` subcommand of the
+ * `peac observe` group. Wires --flag parsing and delegates to the pure
+ * handler. Public invocation: `peac observe command -- <program> [args...]`.
+ */
+export declare function observeCommandSubcommand(): Command;
+/**
+ * Commander factory for the public `peac observe` parent group. Adds
+ * the `command` subcommand. Future observation surfaces (e.g.,
+ * `peac observe mcp`, `peac observe http`) attach here without
+ * widening the verb namespace.
+ */
+export declare function observeCommand(): Command;
+//# sourceMappingURL=observe-command.d.ts.map

package/dist/commands/observe-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observe-command.d.ts","sourceRoot":"","sources":["../../src/commands/observe-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAG5C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,QAAQ,EACR,OAAO,EACP,cAAc,EACd,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAC3E,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,CAAC;AAgB1D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;CAO9B,CAAC;AAEX,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,WAAW,EAAE,QAAQ,CAAC;IACtB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,gBAAgB,EAAE,SAAS,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,iBAAiB,EAAE,cAAc,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,wCAAwC;IACxC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;IAC5B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAwBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,qBAAqB,EAC3B,SAAS,EAAE,MAAM,EAAE,GAClB,iBAAiB,EAAE,CAErB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,EACvC,SAAS,EAAE,MAAM,EAAE,EACnB,EAAE,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA4D/B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CA4JlD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAMxC"}

package/dist/commands/record-command.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `peac record command` subcommand.
+ *
+ * Wraps a child process and emits a Wire 0.2 compact JWS containing
+ * the same `org.peacprotocol/cli-execution` observation as
+ * `observe command`, signed by the supplied issuer key. Reuses the
+ * shared capture / build / validate pipeline from
+ * `lib/observation-pipeline.ts` so a record produced by record command
+ * is identical to one from observe command (modulo the outer signing
+ * envelope).
+ *
+ * Signing UX uses the existing PEAC issuer-key reference convention:
+ *
+ *   --issuer-key <env:VAR | file:/path>
+ *   --issuer-id  <url>
+ *   --unsafe-ephemeral-key
+ *
+ * The wrapper is an OBSERVER, not a sandbox / permission system /
+ * shell orchestrator / process supervisor / job scheduler. PEAC does
+ * NOT publish or distribute the issuer key; --unsafe-ephemeral-key
+ * produces a structurally valid record whose public key is not
+ * published through normal issuer-key discovery (use only for local
+ * development and tests).
+ */
+import { Command } from 'commander';
+import { type ObserveCommandOptions } from './observe-command.js';
+import { type ValidationFailure } from '../lib/command-option-validation.js';
+/**
+ * Stable error codes surfaced before the child runs OR after signing
+ * fails. Inherits the shared option-validation set so observe command
+ * and record command never disagree on validation-layer codes.
+ */
+export declare const RECORD_COMMAND_ERROR_CODES: {
+    readonly outputWriteFailed: "cli.output_write_failed";
+    readonly issuerKeyLoadFailed: "cli.issuer_key_load_failed";
+    readonly issuerKeyInvalid: "cli.issuer_key_invalid";
+    readonly signingFailed: "cli.signing_failed";
+    readonly programRequired: "cli.program_required";
+    readonly unsafeFlagRequired: "cli.unsafe_flag_required";
+    readonly secretScanDisableRequiresUnsafeFlag: "cli.secret_scan_disable_requires_unsafe_flag";
+    readonly shellModeRequired: "cli.shell_mode_required";
+    readonly argvTokenTooLong: "cli.argv_token_too_long";
+    readonly outOfRange: "cli.out_of_range";
+    readonly invalidPolicyDigest: "cli.invalid_policy_digest";
+    readonly invalidConfigDigest: "cli.invalid_config_digest";
+    readonly invalidApprovalRef: "cli.invalid_approval_ref";
+    readonly invalidEnvKey: "cli.invalid_env_key";
+    readonly signingInputRequired: "cli.signing_input_required";
+    readonly signingInputConflict: "cli.signing_input_conflict";
+    readonly issuerIdRequired: "cli.issuer_id_required";
+    readonly issuerIdInvalid: "cli.issuer_id_invalid";
+};
+/** Record-command options = observe command options + signing inputs. */
+export interface RecordCommandOptions extends ObserveCommandOptions {
+    issuerKey?: string;
+    issuerId?: string;
+    unsafeEphemeralKey: boolean;
+}
+export interface RecordCommandIO {
+    writeStdout: (chunk: string) => void;
+    writeStderr: (chunk: string) => void;
+    childEnv: NodeJS.ProcessEnv;
+    captureEnv: NodeJS.ProcessEnv;
+    /**
+     * Environment used to resolve `env:VAR` issuer-key references.
+     * Defaults to `process.env`. Distinct from `childEnv` and `captureEnv`
+     * because issuer-key access policy is independent of capture policy.
+     */
+    issuerKeyEnv: NodeJS.ProcessEnv;
+    cwd: string;
+    peacCliVersion: string;
+}
+export interface RecordCommandResult {
+    exitCode: number;
+}
+/**
+ * Validate flag combinations (observe + signing) BEFORE spawning the
+ * child or loading the issuer key. Delegates to the shared
+ * `validateCoreCommandOptions` for observe-style checks and
+ * `validateSigningOptions` for the signing-input mutex and canonical
+ * issuer URL preflight.
+ */
+export declare function validateRecordOptions(opts: RecordCommandOptions, childArgv: string[]): ValidationFailure[];
+/**
+ * Pure handler: validates flags, preflights output and key, runs the
+ * child, builds the observation, signs as Wire 0.2 JWS, emits.
+ */
+export declare function runRecordCommand(options: Partial<RecordCommandOptions>, childArgv: string[], io?: Partial<RecordCommandIO>): Promise<RecordCommandResult>;
+/**
+ * Commander factory for the `command` subcommand under the `record`
+ * parent group. Mirrors `observeCommandSubcommand()` flag set + adds
+ * the three signing inputs.
+ */
+export declare function recordCommandSubcommand(): Command;
+/**
+ * Commander factory for the public `peac record` parent group. Adds
+ * the `command` subcommand. Future signed-record surfaces (e.g.,
+ * `peac record mcp`, `peac record http`) attach here without widening
+ * the verb namespace.
+ */
+export declare function recordCommand(): Command;
+//# sourceMappingURL=record-command.d.ts.map

package/dist/commands/record-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-command.d.ts","sourceRoot":"","sources":["../../src/commands/record-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAO5C,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,qCAAqC,CAAC;AA+B7C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;CAO7B,CAAC;AAEX,yEAAyE;AACzE,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAyBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,oBAAoB,EAC1B,SAAS,EAAE,MAAM,EAAE,GAClB,iBAAiB,EAAE,CAQrB;AAqCD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,EACtC,SAAS,EAAE,MAAM,EAAE,EACnB,EAAE,GAAE,OAAO,CAAC,eAAe,CAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAyF9B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CA4JjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAMvC"}