@praxis.guard/auditor-cli 0.0.62 → 0.0.63

package/dist/approval/mcp-flow-create.d.ts

@@ -0,0 +1,3 @@
+import type { CreateMutateApprovalInput, McpApprovalOutcome } from "./mcp-flow.types.js";
+export declare function createMutateApproval(input: CreateMutateApprovalInput): Promise<McpApprovalOutcome>;
+//# sourceMappingURL=mcp-flow-create.d.ts.map

package/dist/approval/mcp-flow-create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-create.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAmCzF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAgD7B"}

package/dist/approval/mcp-flow-create.js

@@ -0,0 +1,76 @@
+import { isReliableWorkspaceRoot, resolveGuardStorageRoot, } from "../bridge/guard-storage-root.js";
+import { recordRequestBinding } from "../bridge/request-binding-write.js";
+import { writePendingApprovalIndex } from "../bridge/pending-approval-index.js";
+import { resolveShellApprovalHash } from "./argv-fingerprint.js";
+import { createApprovalRequest } from "./client.js";
+import { redeemAfterApprovalWait } from "./mcp-flow-redeem.js";
+async function stagePendingApproval(input, created, storageRoot) {
+    const hash = resolveShellApprovalHash({
+        kind: input.proposalKind,
+        argv: input.argv,
+        approval_fingerprint: input.approval_fingerprint,
+    });
+    await writePendingApprovalIndex({
+        request_id: created.request_id,
+        argv_sha256: hash,
+        argv: [...input.argv],
+        install_id: input.installId,
+        open_url: created.open_url,
+        expires_at: created.expires_at,
+        event_id: input.eventId,
+        tool_input_sha256: input.tool_input_sha256 ?? null,
+        kind: input.proposalKind,
+        created_at: new Date().toISOString(),
+    }, { storageRoot });
+    return {
+        kind: "require_approval",
+        request_id: created.request_id,
+        open_url: created.open_url,
+        expires_at: created.expires_at,
+    };
+}
+export async function createMutateApproval(input) {
+    const storageRoot = resolveGuardStorageRoot(input.storageRoot);
+    if (!isReliableWorkspaceRoot(storageRoot)) {
+        return {
+            kind: "backend_unavailable",
+            message: "Cannot bind approval to a workspace root. Set proposal.cwd or context.workspace_root to the repo root where hooks run (must contain .git, .praxis, or .cursor/hooks.json).",
+        };
+    }
+    const created = await createApprovalRequest({
+        kind: input.proposalKind,
+        tier: "MUTATE",
+        argv: [...input.argv],
+        install_id: input.installId,
+        session_id: input.sessionId ?? null,
+        environment: input.environment ?? null,
+        raw_display: input.rawDisplay ?? input.argv.join(" "),
+        event_id: input.eventId,
+        policy_revision: input.policyRevision,
+        reasons: input.reasons,
+        tool_input_sha256: input.tool_input_sha256 ?? null,
+        approval_scope: "exact",
+    });
+    recordRequestBinding({
+        request_id: created.request_id,
+        storage_root: storageRoot,
+        argv: input.argv,
+        kind: input.proposalKind,
+        expires_at: created.expires_at,
+        approval_fingerprint: input.approval_fingerprint,
+    });
+    if (input.waitMs && input.waitMs > 0) {
+        return redeemAfterApprovalWait({
+            requestId: created.request_id,
+            argv: input.argv,
+            proposalKind: input.proposalKind,
+            storageRoot,
+            waitMs: input.waitMs,
+            sessionId: input.sessionId,
+            environment: input.environment,
+            approval_fingerprint: input.approval_fingerprint,
+        });
+    }
+    return stagePendingApproval(input, created, storageRoot);
+}
+//# sourceMappingURL=mcp-flow-create.js.map

package/dist/approval/mcp-flow-create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-create.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-create.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,KAAK,UAAU,oBAAoB,CACjC,KAAgC,EAChC,OAA0D,EAC1D,WAAmB;IAEnB,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,MAAM,yBAAyB,CAC7B;QACE,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,EACD,EAAE,WAAW,EAAE,CAChB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/D,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EACL,4KAA4K;SAC/K,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;IAEH,oBAAoB,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,uBAAuB,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC"}

package/dist/approval/mcp-flow-existing.d.ts

@@ -0,0 +1,14 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+import type { McpApprovalOutcome } from "./mcp-flow.types.js";
+export declare function resolveExistingMutateApproval(input: {
+    requestId: string;
+    grant: string | null;
+    argv: string[];
+    proposalKind: "shell" | "mcp";
+    storageRoot: string;
+    sessionId?: string | null;
+    environment?: string | null;
+    waitMs?: number | null;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): Promise<McpApprovalOutcome>;
+//# sourceMappingURL=mcp-flow-existing.d.ts.map

package/dist/approval/mcp-flow-existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-existing.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-existing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AASnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuC9B"}

package/dist/approval/mcp-flow-existing.js

@@ -0,0 +1,43 @@
+import { redeemApprovalAndRecordBridge } from "./redeem.js";
+import { verifyApprovalGrant } from "./grant.js";
+import { allowOutcomeFromRedeem, credentialNotRecordedOutcome, } from "./mcp-flow-outcome.js";
+import { pendingExistingApprovalOutcome } from "./mcp-flow-pending.js";
+import { redeemAfterApprovalWait } from "./mcp-flow-redeem.js";
+export async function resolveExistingMutateApproval(input) {
+    if (input.grant) {
+        const claims = verifyApprovalGrant(input.grant);
+        if (!claims || claims.request_id !== input.requestId) {
+            return { kind: "backend_unavailable", message: "invalid_grant" };
+        }
+    }
+    const pending = await pendingExistingApprovalOutcome(input);
+    if (pending)
+        return pending;
+    if (input.waitMs && input.waitMs > 0) {
+        return redeemAfterApprovalWait({
+            requestId: input.requestId,
+            argv: input.argv,
+            proposalKind: input.proposalKind,
+            storageRoot: input.storageRoot,
+            waitMs: input.waitMs,
+            sessionId: input.sessionId,
+            environment: input.environment,
+            approval_fingerprint: input.approval_fingerprint,
+        });
+    }
+    const redeem = await redeemApprovalAndRecordBridge({
+        request_id: input.requestId,
+        argv: input.argv,
+        kind: input.proposalKind,
+        storageRoot: input.storageRoot,
+        grant: input.grant,
+        environment: input.environment,
+        session_id: input.sessionId,
+        approval_fingerprint: input.approval_fingerprint,
+    });
+    if (!redeem.ticketRecorded) {
+        return credentialNotRecordedOutcome(input.requestId);
+    }
+    return allowOutcomeFromRedeem(redeem, input.requestId);
+}
+//# sourceMappingURL=mcp-flow-existing.js.map

package/dist/approval/mcp-flow-existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-existing.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-existing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,uBAAuB,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/approval/mcp-flow-outcome.d.ts

@@ -0,0 +1,5 @@
+import type { redeemApprovalAndRecordBridge } from "./redeem.js";
+import type { McpApprovalOutcome } from "./mcp-flow.types.js";
+export declare function allowOutcomeFromRedeem(redeem: Awaited<ReturnType<typeof redeemApprovalAndRecordBridge>>, requestId: string): McpApprovalOutcome;
+export declare function credentialNotRecordedOutcome(requestId: string): McpApprovalOutcome;
+//# sourceMappingURL=mcp-flow-outcome.d.ts.map

package/dist/approval/mcp-flow-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-outcome.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAK9D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAC,EACjE,SAAS,EAAE,MAAM,GAChB,kBAAkB,CASpB;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAMlF"}

package/dist/approval/mcp-flow-outcome.js

@@ -0,0 +1,19 @@
+const CREDENTIAL_NOT_RECORDED_MSG = "Approval redeemed but no execution ticket was written for hooks. Check workspace permissions under .praxis/guard/tickets.";
+export function allowOutcomeFromRedeem(redeem, requestId) {
+    return {
+        kind: "allow",
+        redeemed: redeem.redeemed,
+        approved_by: redeem.approved_by,
+        bridgeRecorded: false,
+        ticketRecorded: redeem.ticketRecorded,
+        request_id: requestId,
+    };
+}
+export function credentialNotRecordedOutcome(requestId) {
+    return {
+        kind: "credential_not_recorded",
+        request_id: requestId,
+        message: CREDENTIAL_NOT_RECORDED_MSG,
+    };
+}
+//# sourceMappingURL=mcp-flow-outcome.js.map

package/dist/approval/mcp-flow-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-outcome.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-outcome.ts"],"names":[],"mappings":"AAGA,MAAM,2BAA2B,GAC/B,2HAA2H,CAAC;AAE9H,MAAM,UAAU,sBAAsB,CACpC,MAAiE,EACjE,SAAiB;IAEjB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,2BAA2B;KACrC,CAAC;AACJ,CAAC"}

package/dist/approval/mcp-flow-pending.d.ts

@@ -0,0 +1,7 @@
+import type { McpApprovalOutcome } from "./mcp-flow.types.js";
+export declare function pendingExistingApprovalOutcome(input: {
+    requestId: string;
+    grant: string | null;
+    waitMs?: number | null;
+}): Promise<McpApprovalOutcome | null>;
+//# sourceMappingURL=mcp-flow-pending.d.ts.map

package/dist/approval/mcp-flow-pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-pending.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-pending.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAM9D,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAmBrC"}

package/dist/approval/mcp-flow-pending.js

@@ -0,0 +1,25 @@
+import { DEFAULT_APP_URL } from "../config/default-endpoints.js";
+import { getApprovalRequest } from "./client.js";
+function defaultAppUrl() {
+    return process.env.PRAXIS_APP_URL?.trim() || DEFAULT_APP_URL;
+}
+export async function pendingExistingApprovalOutcome(input) {
+    const row = input.grant ? null : await getApprovalRequest(input.requestId);
+    const status = input.grant ? "approved" : row?.status;
+    if (status === "pending" && input.waitMs && input.waitMs > 0) {
+        return null;
+    }
+    if (status === "pending") {
+        return {
+            kind: "require_approval",
+            request_id: input.requestId,
+            open_url: row?.open_url ?? `${defaultAppUrl().replace(/\/$/, "")}/app/approvals/${input.requestId}`,
+            expires_at: row?.expires_at ?? new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+        };
+    }
+    if (status === "denied") {
+        return { kind: "backend_unavailable", message: "approval_denied" };
+    }
+    return null;
+}
+//# sourceMappingURL=mcp-flow-pending.js.map

package/dist/approval/mcp-flow-pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-pending.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAIpD;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC;IAEtD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,KAAK,CAAC,SAAS,EAAE;YACnG,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/approval/mcp-flow-redeem.d.ts

@@ -0,0 +1,13 @@
+import type { McpApprovalOutcome } from "./mcp-flow.types.js";
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export declare function redeemAfterApprovalWait(input: {
+    requestId: string;
+    argv: string[];
+    proposalKind: "shell" | "mcp";
+    storageRoot: string;
+    waitMs: number;
+    sessionId?: string | null;
+    environment?: string | null;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): Promise<McpApprovalOutcome>;
+//# sourceMappingURL=mcp-flow-redeem.d.ts.map

package/dist/approval/mcp-flow-redeem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-redeem.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow-redeem.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAEnF,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAe9B"}

package/dist/approval/mcp-flow-redeem.js

@@ -0,0 +1,20 @@
+import { pollUntilApproved } from "./client.js";
+import { redeemApprovalAndRecordBridge } from "./redeem.js";
+import { allowOutcomeFromRedeem, credentialNotRecordedOutcome, } from "./mcp-flow-outcome.js";
+export async function redeemAfterApprovalWait(input) {
+    await pollUntilApproved(input.requestId, { timeoutMs: input.waitMs });
+    const redeem = await redeemApprovalAndRecordBridge({
+        request_id: input.requestId,
+        argv: input.argv,
+        kind: input.proposalKind,
+        storageRoot: input.storageRoot,
+        environment: input.environment,
+        session_id: input.sessionId,
+        approval_fingerprint: input.approval_fingerprint,
+    });
+    if (!redeem.ticketRecorded) {
+        return credentialNotRecordedOutcome(input.requestId);
+    }
+    return allowOutcomeFromRedeem(redeem, input.requestId);
+}
+//# sourceMappingURL=mcp-flow-redeem.js.map

package/dist/approval/mcp-flow-redeem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow-redeem.js","sourceRoot":"","sources":["../../src/approval/mcp-flow-redeem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAI/B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC"}

package/dist/approval/mcp-flow.d.ts

@@ -1,33 +1,10 @@
-import { resolveShellApprovalHash } from "./argv-fingerprint.js";
 import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
-export type McpApprovalContext = {
-    request_id?: string | null;
-    grant?: string | null;
-};
-export type McpApprovalOutcome = {
-    kind: "require_approval";
-    request_id: string;
-    open_url: string;
-    expires_at: string;
-} | {
-    kind: "allow";
-    redeemed: boolean;
-    approved_by: string | null;
-    bridgeRecorded: boolean;
-    ticketRecorded: boolean;
-    request_id: string;
-} | {
-    kind: "credential_not_recorded";
-    request_id: string;
-    message: string;
-} | {
-    kind: "backend_unavailable";
-    message: string;
-};
-export declare function resolveMutateApproval(input: {
+import { resolveShellApprovalHash } from "./argv-fingerprint.js";
+import type { McpApprovalContext, McpApprovalOutcome } from "./mcp-flow.types.js";
+export type { McpApprovalContext, McpApprovalOutcome } from "./mcp-flow.types.js";
+type MutateApprovalInput = {
     argv: string[];
     proposalKind: "shell" | "mcp";
-    /** Workspace root for hook credentials (resolved if omitted). */
     storageRoot?: string;
     rawDisplay?: string;
     eventId: string;
@@ -39,7 +16,8 @@ export declare function resolveMutateApproval(input: {
     waitMs?: number | null;
     tool_input_sha256?: string | null;
     approval_fingerprint?: ShellApprovalFingerprintPayload | null;
-}): Promise<McpApprovalOutcome>;
+};
+export declare function resolveMutateApproval(input: MutateApprovalInput): Promise<McpApprovalOutcome>;
 export declare function argvFingerprint(argv: readonly string[]): string;
 export { resolveShellApprovalHash };
 //# sourceMappingURL=mcp-flow.d.ts.map

package/dist/approval/mcp-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-flow.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AASnF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,yBAAyB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAMrD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4J9B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE/D;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"mcp-flow.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAElF,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAElF,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoCnG;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE/D;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/approval/mcp-flow.js

@@ -1,152 +1,44 @@
-import { DEFAULT_APP_URL } from "../config/default-endpoints.js";
 import { getInstallId } from "../cli/install-id.js";
-import { isReliableWorkspaceRoot, resolveGuardStorageRoot, } from "../bridge/guard-storage-root.js";
-import { recordRequestBinding } from "../bridge/request-binding-write.js";
-import { writePendingApprovalIndex } from "../bridge/pending-approval-index.js";
+import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
 import { resolveShellApprovalHash } from "./argv-fingerprint.js";
-import { createApprovalRequest, getApprovalRequest, pollUntilApproved, } from "./client.js";
-import { redeemApprovalAndRecordBridge } from "./redeem.js";
-import { verifyApprovalGrant } from "./grant.js";
-function defaultAppUrl() {
-    return process.env.PRAXIS_APP_URL?.trim() || DEFAULT_APP_URL;
-}
+import { createMutateApproval } from "./mcp-flow-create.js";
+import { resolveExistingMutateApproval } from "./mcp-flow-existing.js";
 export async function resolveMutateApproval(input) {
-    const installId = getInstallId();
     const storageRoot = resolveGuardStorageRoot(input.storageRoot);
     const requestId = input.approval?.request_id?.trim() || null;
     const grant = input.approval?.grant?.trim() || null;
     try {
         if (requestId) {
-            if (grant) {
-                const claims = verifyApprovalGrant(grant);
-                if (!claims || claims.request_id !== requestId) {
-                    return { kind: "backend_unavailable", message: "invalid_grant" };
-                }
-            }
-            const row = grant ? null : await getApprovalRequest(requestId);
-            const status = grant ? "approved" : row?.status;
-            if (status === "pending" && input.waitMs && input.waitMs > 0) {
-                await pollUntilApproved(requestId, { timeoutMs: input.waitMs });
-            }
-            else if (status === "pending") {
-                return {
-                    kind: "require_approval",
-                    request_id: requestId,
-                    open_url: row?.open_url ?? `${defaultAppUrl().replace(/\/$/, "")}/app/approvals/${requestId}`,
-                    expires_at: row?.expires_at ?? new Date(Date.now() + 30 * 60 * 1000).toISOString(),
-                };
-            }
-            if (status === "denied") {
-                return { kind: "backend_unavailable", message: "approval_denied" };
-            }
-            const redeem = await redeemApprovalAndRecordBridge({
-                request_id: requestId,
-                argv: input.argv,
-                kind: input.proposalKind,
-                storageRoot,
+            return resolveExistingMutateApproval({
+                requestId,
                 grant,
-                environment: input.environment,
-                session_id: input.sessionId,
-                approval_fingerprint: input.approval_fingerprint,
-            });
-            if (!redeem.ticketRecorded) {
-                return {
-                    kind: "credential_not_recorded",
-                    request_id: requestId,
-                    message: "Approval redeemed but no execution ticket was written for hooks. Check workspace permissions under .praxis/guard/tickets.",
-                };
-            }
-            return {
-                kind: "allow",
-                redeemed: redeem.redeemed,
-                approved_by: redeem.approved_by,
-                bridgeRecorded: false,
-                ticketRecorded: redeem.ticketRecorded,
-                request_id: requestId,
-            };
-        }
-        if (!isReliableWorkspaceRoot(storageRoot)) {
-            return {
-                kind: "backend_unavailable",
-                message: "Cannot bind approval to a workspace root. Set proposal.cwd or context.workspace_root to the repo root where hooks run (must contain .git, .praxis, or .cursor/hooks.json).",
-            };
-        }
-        const created = await createApprovalRequest({
-            kind: input.proposalKind,
-            tier: "MUTATE",
-            argv: [...input.argv],
-            install_id: installId,
-            session_id: input.sessionId ?? null,
-            environment: input.environment ?? null,
-            raw_display: input.rawDisplay ?? input.argv.join(" "),
-            event_id: input.eventId,
-            policy_revision: input.policyRevision,
-            reasons: input.reasons,
-            tool_input_sha256: input.tool_input_sha256 ?? null,
-            approval_scope: "exact",
-        });
-        recordRequestBinding({
-            request_id: created.request_id,
-            storage_root: storageRoot,
-            argv: input.argv,
-            kind: input.proposalKind,
-            expires_at: created.expires_at,
-            approval_fingerprint: input.approval_fingerprint,
-        });
-        if (input.waitMs && input.waitMs > 0) {
-            await pollUntilApproved(created.request_id, { timeoutMs: input.waitMs });
-            const redeem = await redeemApprovalAndRecordBridge({
-                request_id: created.request_id,
                 argv: input.argv,
-                kind: input.proposalKind,
+                proposalKind: input.proposalKind,
                 storageRoot,
+                sessionId: input.sessionId,
                 environment: input.environment,
-                session_id: input.sessionId,
+                waitMs: input.waitMs,
                 approval_fingerprint: input.approval_fingerprint,
             });
-            if (!redeem.ticketRecorded) {
-                return {
-                    kind: "credential_not_recorded",
-                    request_id: created.request_id,
-                    message: "Approval redeemed but no execution ticket was written for hooks. Check workspace permissions under .praxis/guard/tickets.",
-                };
-            }
-            return {
-                kind: "allow",
-                redeemed: redeem.redeemed,
-                approved_by: redeem.approved_by,
-                bridgeRecorded: false,
-                ticketRecorded: redeem.ticketRecorded,
-                request_id: created.request_id,
-            };
         }
-        const hash = resolveShellApprovalHash({
-            kind: input.proposalKind,
+        return createMutateApproval({
             argv: input.argv,
+            proposalKind: input.proposalKind,
+            storageRoot,
+            installId: getInstallId(),
+            rawDisplay: input.rawDisplay,
+            eventId: input.eventId,
+            policyRevision: input.policyRevision,
+            reasons: input.reasons,
+            sessionId: input.sessionId,
+            environment: input.environment,
+            waitMs: input.waitMs,
+            tool_input_sha256: input.tool_input_sha256,
             approval_fingerprint: input.approval_fingerprint,
         });
-        await writePendingApprovalIndex({
-            request_id: created.request_id,
-            argv_sha256: hash,
-            argv: [...input.argv],
-            install_id: installId,
-            open_url: created.open_url,
-            expires_at: created.expires_at,
-            event_id: input.eventId,
-            tool_input_sha256: input.tool_input_sha256 ?? null,
-            kind: input.proposalKind,
-            created_at: new Date().toISOString(),
-        }, { storageRoot });
-        return {
-            kind: "require_approval",
-            request_id: created.request_id,
-            open_url: created.open_url,
-            expires_at: created.expires_at,
-        };
     }
     catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        return { kind: "backend_unavailable", message: msg };
+        return { kind: "backend_unavailable", message: e instanceof Error ? e.message : String(e) };
     }
 }
 export function argvFingerprint(argv) {

package/dist/approval/mcp-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-flow.js","sourceRoot":"","sources":["../../src/approval/mcp-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA6BjD,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAe3C;IACC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAEpD,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC/C,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;gBACnE,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,iBAAiB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;oBACL,IAAI,EAAE,kBAAkB;oBACxB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,SAAS,EAAE;oBAC7F,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;iBACnF,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;YACrE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;gBACjD,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,YAAY;gBACxB,WAAW;gBACX,KAAK;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,UAAU,EAAE,SAAS;oBACrB,OAAO,EACL,2HAA2H;iBAC9H,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,KAAK;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,UAAU,EAAE,SAAS;aACtB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,4KAA4K;aAC/K,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACrB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACrD,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QAEH,oBAAoB,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;gBACjD,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,YAAY;gBACxB,WAAW;gBACX,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EACL,2HAA2H;iBAC9H,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,KAAK;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;QACH,MAAM,yBAAyB,CAC7B;YACE,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,IAAI;YACjB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACrB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,IAAI,EAAE,KAAK,CAAC,YAAY;YACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,EACD,EAAE,WAAW,EAAE,CAChB,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"mcp-flow.js","sourceRoot":"","sources":["../../src/approval/mcp-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAqBvE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA0B;IACpE,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,6BAA6B,CAAC;gBACnC,SAAS;gBACT,KAAK;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,oBAAoB,CAAC;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW;YACX,SAAS,EAAE,YAAY,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/approval/mcp-flow.types.d.ts

@@ -0,0 +1,42 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export type McpApprovalContext = {
+    request_id?: string | null;
+    grant?: string | null;
+};
+export type McpApprovalOutcome = {
+    kind: "require_approval";
+    request_id: string;
+    open_url: string;
+    expires_at: string;
+} | {
+    kind: "allow";
+    redeemed: boolean;
+    approved_by: string | null;
+    bridgeRecorded: boolean;
+    ticketRecorded: boolean;
+    request_id: string;
+} | {
+    kind: "credential_not_recorded";
+    request_id: string;
+    message: string;
+} | {
+    kind: "backend_unavailable";
+    message: string;
+};
+export type CreateMutateApprovalInput = {
+    argv: string[];
+    proposalKind: "shell" | "mcp";
+    storageRoot: string;
+    installId: string;
+    rawDisplay?: string;
+    eventId: string;
+    policyRevision: number | null;
+    reasons: unknown[];
+    sessionId?: string | null;
+    environment?: string | null;
+    waitMs?: number | null;
+    tool_input_sha256?: string | null;
+    approval?: McpApprovalContext | null;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+};
+//# sourceMappingURL=mcp-flow.types.d.ts.map

package/dist/approval/mcp-flow.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow.types.d.ts","sourceRoot":"","sources":["../../src/approval/mcp-flow.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAEnF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,yBAAyB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,CAAC"}

package/dist/approval/mcp-flow.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-flow.types.js.map

package/dist/approval/mcp-flow.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-flow.types.js","sourceRoot":"","sources":["../../src/approval/mcp-flow.types.ts"],"names":[],"mappings":""}

package/dist/cli/doctor-adapter-lines.d.ts

@@ -0,0 +1,4 @@
+import type { AgentAdapter, AgentStatus } from "../adapters/types.js";
+export declare function adapterReady(adapter: AgentAdapter, status: AgentStatus): boolean;
+export declare function pushAdapterLines(lines: string[], adapter: AgentAdapter, status: AgentStatus): void;
+//# sourceMappingURL=doctor-adapter-lines.d.ts.map

package/dist/cli/doctor-adapter-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-adapter-lines.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-adapter-lines.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA+BtE,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAShF;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,WAAW,GAClB,IAAI,CAiBN"}