@sun-asterisk/sungen 3.2.34-beta.1 → 3.3.0-alpha.1

package/dist/decisions/exclusive-file-create.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFileExclusive = createFileExclusive;
+/**
+ * Create a file only if its name is free, and never leave it half-written (red-team #13).
+ *
+ * The bytes go to a private tmp file opened with O_EXCL, are fsynced, then hard-linked to the final
+ * name. `link` fails with EEXIST when the name is taken, so the final file appears complete or not at
+ * all. On a filesystem without hard links an O_EXCL create of the final name keeps the exclusivity.
+ * Used for decision entries (same content → same name → "already recorded") and for the migration
+ * sentinel (two migrations of one unit cannot both believe they hold it).
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const NO_HARD_LINKS = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV']);
+/** true = created, false = the name was already taken. Any other failure throws. */
+function createFileExclusive(file, text) {
+    const tmp = `${file}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`;
+    const fd = fs.openSync(tmp, 'wx');
+    try {
+        fs.writeFileSync(fd, text);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.linkSync(tmp, file);
+        return true;
+    }
+    catch (err) {
+        const code = err.code ?? '';
+        if (code === 'EEXIST')
+            return false;
+        if (!NO_HARD_LINKS.has(code))
+            throw err;
+        try {
+            fs.writeFileSync(file, text, { flag: 'wx' });
+            return true;
+        }
+        catch (e) {
+            if (e.code === 'EEXIST')
+                return false;
+            throw e;
+        }
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+//# sourceMappingURL=exclusive-file-create.js.map

package/dist/decisions/exclusive-file-create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-file-create.js","sourceRoot":"","sources":["../../src/decisions/exclusive-file-create.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,kDA0BC;AAzCD;;;;;;;;GAQG;AACH,mCAAqC;AACrC,uCAAyB;AAEzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAErF,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/decisions/git-head-trust.d.ts

@@ -0,0 +1,7 @@
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+export declare function gitOutput(cwd: string, args: string[]): string | null;
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+export declare function committedText(projectRoot: string, abs: string): string | null;
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+export declare function committedJson(projectRoot: string, abs: string): unknown;
+//# sourceMappingURL=git-head-trust.d.ts.map

package/dist/decisions/git-head-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.d.ts","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":"AAUA,wGAAwG;AACxG,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7E;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIvE"}

package/dist/decisions/git-head-trust.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitOutput = gitOutput;
+exports.committedText = committedText;
+exports.committedJson = committedJson;
+/**
+ * What git HEAD says — the trust anchor for agent-writable state (red-team #3, review H1).
+ *
+ * `.sungen/` files are written by the CLI and, without the guard, by any agent. A record in them is
+ * trusted only where it equals its committed version: a commit went through review, a local edit
+ * did not. Outside git, or for a file git does not track, nothing is trusted. Never throws.
+ */
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+function gitOutput(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024, timeout: 30000 }).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+function committedText(projectRoot, abs) {
+    const rel = path.relative(projectRoot, abs).split(path.sep).join('/');
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return gitOutput(projectRoot, ['show', `HEAD:./${rel}`]);
+}
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+function committedJson(projectRoot, abs) {
+    const text = committedText(projectRoot, abs);
+    if (text === null)
+        return null;
+    try {
+        return JSON.parse(text.replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git-head-trust.js.map

package/dist/decisions/git-head-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.js","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,8BAMC;AAGD,sCAIC;AAGD,sCAIC;AA/BD;;;;;;GAMG;AACH,iDAA6C;AAC7C,2CAA6B;AAE7B,wGAAwG;AACxG,SAAgB,SAAS,CAAC,GAAW,EAAE,IAAc;IACnD,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3E,CAAC"}

package/dist/decisions/human-confirmation.d.ts

@@ -0,0 +1,33 @@
+export interface ConfirmationIO {
+    input: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    output: NodeJS.WritableStream;
+    /** The CLI's real terminal: prompt on `/dev/tty` (opened only when a confirmation is asked). */
+    controllingTerminal?: boolean;
+}
+export declare class HumanConfirmationRefused extends Error {
+    readonly command?: string;
+    constructor(message: string, command?: string);
+}
+/** The CLI's streams: stdin decides whether a human is there; the prompt itself uses /dev/tty. */
+export declare const processIO: () => ConfirmationIO;
+export declare const isInteractive: (io: ConfirmationIO) => boolean;
+export declare function shellQuote(arg: string): string;
+export declare const formatCommand: (argv: string[]) => string;
+/** A fresh, hard-to-guess suffix for one prompt. */
+export declare const confirmationNonce: () => string;
+export declare function requireTypedConfirmation(opts: {
+    what: string;
+    phrase: string;
+    command: string;
+    summary: string[];
+    io: ConfirmationIO;
+}): Promise<void>;
+/** A leftover write-ahead sentinel: the human answers REVERT or KEEP. Never answered for them. */
+export declare function askMigrationChoice(opts: {
+    detail: string;
+    command: string;
+    io: ConfirmationIO;
+}): Promise<'REVERT' | 'KEEP'>;
+//# sourceMappingURL=human-confirmation.d.ts.map

package/dist/decisions/human-confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-confirmation.d.ts","sourceRoot":"","sources":["../../src/decisions/human-confirmation.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aACJ,OAAO,CAAC,EAAE,MAAM;gBAAjD,OAAO,EAAE,MAAM,EAAkB,OAAO,CAAC,EAAE,MAAM;CAI9D;AAED,kGAAkG;AAClG,eAAO,MAAM,SAAS,QAAO,cAA+F,CAAC;AAC7H,eAAO,MAAM,aAAa,GAAI,IAAI,cAAc,KAAG,OAAkC,CAAC;AAEtF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AACD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,KAAG,MAAwC,CAAC;AAyCxF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,QAAO,MAAsD,CAAC;AAE5F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,cAAc,CAAC;CACtF,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAWlI"}

package/dist/decisions/human-confirmation.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmationNonce = exports.formatCommand = exports.isInteractive = exports.processIO = exports.HumanConfirmationRefused = void 0;
+exports.shellQuote = shellQuote;
+exports.requireTypedConfirmation = requireTypedConfirmation;
+exports.askMigrationChoice = askMigrationChoice;
+/**
+ * Typed human confirmation (DOS-13.4, red-team #3; review phase 03 M5).
+ *
+ * `journey --waive`, `journey --decide`, `delivery --accept-in-run` record or accept decisions that
+ * relax a gate, so a person must type a confirmation on a terminal:
+ *   - no TTY (an agent's shell, a pipe, CI) → refuse and print the exact command for a human to run;
+ *     piped stdin is not a TTY, so piping the phrase in never counts
+ *   - the prompt and the answer go through the controlling terminal (`/dev/tty`), not stdin/stderr,
+ *     so a redirected or wrapped stream neither sees nor answers it
+ *   - the phrase carries a NONCE drawn per prompt, so an answer cannot be scripted from the refusal
+ *     message: the printed command never contains it (it does not exist until the prompt is shown)
+ * This is a hard floor under Claude Code (the PreToolUse guard also denies agent writes to
+ * qa/**\/decisions/**) and a soft barrier elsewhere; git-HEAD comparison and the in-run rule remain.
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const readline = __importStar(require("readline"));
+const tty = __importStar(require("tty"));
+class HumanConfirmationRefused extends Error {
+    constructor(message, command) {
+        super(message);
+        this.command = command;
+        this.name = 'HumanConfirmationRefused';
+    }
+}
+exports.HumanConfirmationRefused = HumanConfirmationRefused;
+/** The CLI's streams: stdin decides whether a human is there; the prompt itself uses /dev/tty. */
+const processIO = () => ({ input: process.stdin, output: process.stderr, controllingTerminal: true });
+exports.processIO = processIO;
+const isInteractive = (io) => io.input.isTTY === true;
+exports.isInteractive = isInteractive;
+function shellQuote(arg) {
+    return /^[A-Za-z0-9_./:=@%+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+const formatCommand = (argv) => argv.map(shellQuote).join(' ');
+exports.formatCommand = formatCommand;
+/** The terminal to talk to a human on, or null when there is none. */
+function openTerminal(io) {
+    if (!(0, exports.isInteractive)(io))
+        return null;
+    if (!io.controllingTerminal || process.platform === 'win32')
+        return { input: io.input, output: io.output, close: () => undefined };
+    let rfd = -1;
+    let wfd = -1;
+    try {
+        rfd = fs.openSync('/dev/tty', 'r');
+        wfd = fs.openSync('/dev/tty', 'w');
+        const input = new tty.ReadStream(rfd);
+        const output = new tty.WriteStream(wfd);
+        return { input, output, close: () => { input.destroy(); output.destroy(); } };
+    }
+    catch {
+        for (const fd of [rfd, wfd])
+            if (fd >= 0) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* already closed */ }
+            }
+        return null; // no controlling terminal: not a human at a keyboard
+    }
+}
+/** One line from the human, or null on EOF. */
+function askLine(t, prompt) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: t.input, output: t.output, terminal: false });
+        let settled = false;
+        const done = (v) => { if (!settled) {
+            settled = true;
+            resolve(v);
+            rl.close();
+        } };
+        rl.on('close', () => done(null));
+        rl.question(prompt, (answer) => done(answer));
+    });
+}
+function refuseWithoutTty(what, command) {
+    return new HumanConfirmationRefused(`Refused: ${what} needs a human at a terminal to type a confirmation, and this run has no TTY.\n`
+        + `  Nothing was recorded. Run this yourself in a terminal:\n    ${command}`, command);
+}
+/** A fresh, hard-to-guess suffix for one prompt. */
+const confirmationNonce = () => (0, crypto_1.randomBytes)(3).toString('hex').toUpperCase();
+exports.confirmationNonce = confirmationNonce;
+async function requireTypedConfirmation(opts) {
+    const t = openTerminal(opts.io);
+    if (!t)
+        throw refuseWithoutTty(opts.what, opts.command);
+    try {
+        const expected = `${opts.phrase} ${(0, exports.confirmationNonce)()}`;
+        t.output.write(`\nAbout to ${opts.what}:\n${opts.summary.map((l) => `  ${l}`).join('\n')}\n`);
+        const answer = await askLine(t, `Type "${expected}" to confirm (anything else cancels): `);
+        if ((answer ?? '').trim() !== expected) {
+            throw new HumanConfirmationRefused(`Cancelled: the confirmation did not match the phrase shown. Nothing was recorded.`, opts.command);
+        }
+    }
+    finally {
+        t.close();
+    }
+}
+/** A leftover write-ahead sentinel: the human answers REVERT or KEEP. Never answered for them. */
+async function askMigrationChoice(opts) {
+    const t = openTerminal(opts.io);
+    if (!t)
+        throw refuseWithoutTty('answering an interrupted migration (REVERT or KEEP)', opts.command);
+    try {
+        t.output.write(`\n${opts.detail}\n`);
+        const answer = ((await askLine(t, 'Type REVERT (restore every file it lists) or KEEP (keep the new files): ')) ?? '').trim().toUpperCase();
+        if (answer === 'REVERT' || answer === 'KEEP')
+            return answer;
+        throw new HumanConfirmationRefused('Cancelled: answer REVERT or KEEP. Nothing was changed.', opts.command);
+    }
+    finally {
+        t.close();
+    }
+}
+//# sourceMappingURL=human-confirmation.js.map

package/dist/decisions/human-confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-confirmation.js","sourceRoot":"","sources":["../../src/decisions/human-confirmation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,gCAEC;AA6CD,4DAeC;AAGD,gDAWC;AAjHD;;;;;;;;;;;;;GAaG;AACH,mCAAqC;AACrC,uCAAyB;AACzB,mDAAqC;AACrC,yCAA2B;AAS3B,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe,EAAkB,OAAgB;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,YAAO,GAAP,OAAO,CAAS;QAE3D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,kGAAkG;AAC3F,MAAM,SAAS,GAAG,GAAmB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;AAAhH,QAAA,SAAS,aAAuG;AACtH,MAAM,aAAa,GAAG,CAAC,EAAkB,EAAW,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;AAAzE,QAAA,aAAa,iBAA4D;AAEtF,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACvF,CAAC;AACM,MAAM,aAAa,GAAG,CAAC,IAAc,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAA3E,QAAA,aAAa,iBAA8D;AAIxF,sEAAsE;AACtE,SAAS,YAAY,CAAC,EAAkB;IACtC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,mBAAmB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACnI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnC,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;QACtG,OAAO,IAAI,CAAC,CAAG,qDAAqD;IACtE,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,OAAO,CAAC,CAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACvG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,wBAAwB,CACjC,YAAY,IAAI,iFAAiF;UAC/F,iEAAiE,OAAO,EAAE,EAC5E,OAAO,CACR,CAAC;AACJ,CAAC;AAED,oDAAoD;AAC7C,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAA/E,QAAA,iBAAiB,qBAA8D;AAErF,KAAK,UAAU,wBAAwB,CAAC,IAE9C;IACC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAA,yBAAiB,GAAE,EAAE,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,QAAQ,wCAAwC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,wBAAwB,CAAC,mFAAmF,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kGAAkG;AAC3F,KAAK,UAAU,kBAAkB,CAAC,IAA6D;IACpG,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,qDAAqD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,0EAA0E,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3I,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5D,MAAM,IAAI,wBAAwB,CAAC,wDAAwD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/decisions/legacy-waiver-migration.d.ts

@@ -0,0 +1,31 @@
+import { AppendResult } from './append-decision';
+import { DecisionDraft } from './decision-schema';
+import { LegacyWaiver } from './waiver-decisions';
+export interface UntrustedWaiver {
+    obligation: string;
+    waiver: LegacyWaiver;
+}
+export interface WaiverSyncPlan {
+    scope: string | null;
+    /** obligation → waiver in force (legacy shape): what the board counts. */
+    waivers: Record<string, LegacyWaiver>;
+    untrusted: UntrustedWaiver[];
+    /** What the dual-write puts back in the legacy file: legacy key order, unknown records kept verbatim. */
+    stateWaivers: Record<string, unknown>;
+    imports: DecisionDraft[];
+    /** Write the import marker on commit: nothing untrusted is left to decide. */
+    markDone: boolean;
+}
+export declare const importMarkerPath: (projectRoot: string, slug: string) => string;
+export declare function planWaiverSync(projectRoot: string, unit: string, slug: string, statePath: string, legacy: unknown): WaiverSyncPlan;
+/** The needs-you line for a waiver that is not in git HEAD: not counted, and how a human confirms it. */
+export declare function untrustedWaiverText(unit: string, slug: string, title: string, u: UntrustedWaiver): string;
+/**
+ * Persist a plan: imports, the dual-written legacy file, the import marker. Returns false when the
+ * checkout cannot be written (read-only, full disk); any other failure — a decision that does not
+ * verify, a migration in progress or interrupted — is raised, never swallowed.
+ */
+export declare function commitWaiverSync(projectRoot: string, unit: string, slug: string, plan: WaiverSyncPlan, statePath: string, stateText: string): boolean;
+/** Record a waiver given now on the CLI; supersedes the waiver in force for that obligation, if any. */
+export declare function recordWaiver(projectRoot: string, unit: string, obligation: string, w: LegacyWaiver): AppendResult;
+//# sourceMappingURL=legacy-waiver-migration.d.ts.map

package/dist/decisions/legacy-waiver-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-waiver-migration.d.ts","sourceRoot":"","sources":["../../src/decisions/legacy-waiver-migration.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAkB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKlD,OAAO,EAA0D,YAAY,EAA2B,MAAM,oBAAoB,CAAC;AAEnI,MAAM,WAAW,eAAe;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE;AAE7E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,yGAAyG;IACzG,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,EAAE,MAAM,MAAM,KAAG,MACa,CAAC;AAQnF,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CA0BlI;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAIzG;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAwBrJ;AAED,wGAAwG;AACxG,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CAMjH"}

package/dist/decisions/legacy-waiver-migration.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importMarkerPath = void 0;
+exports.planWaiverSync = planWaiverSync;
+exports.untrustedWaiverText = untrustedWaiverText;
+exports.commitWaiverSync = commitWaiverSync;
+exports.recordWaiver = recordWaiver;
+/**
+ * Waivers move from `.sungen/journey/<slug>.state.json` into the decision layer (DOS-13.5, red-team
+ * #2) — without laundering an agent-forged waiver into a hash-valid decision (review H1).
+ *
+ * The state file is agent-writable, so a legacy waiver is TRUSTED only when its record equals the
+ * one committed in git HEAD (a commit went through review; a local edit did not). Per obligation,
+ * with L = the legacy waiver and D = the decision in force:
+ *   L same as D                 → nothing to do (same reason against the same evidence)
+ *   L untrusted                 → not imported, not counted; needs-you says UNTRUSTED and how to confirm it
+ *   L trusted, no D             → import L (`where: migrated`, idempotent by content id)
+ *   L trusted, newer than D     → import L superseding D — an `at` in the future never counts as newer
+ *   L trusted, not newer than D → D wins; the dual-write corrects the legacy file
+ * The import runs ONCE per unit: when nothing untrusted remains, a marker is written and from then on
+ * the legacy file is only a dual-write target (so the previous CLI still reads the waivers), never a source.
+ *
+ * plan is read-only, so the board is the same whether or not the writes succeed. commit writes under
+ * the write-ahead sentinel; only an unwritable checkout is tolerated silently — a conflict is raised.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const migration_sentinel_1 = require("../basis/migration-sentinel");
+const append_decision_1 = require("./append-decision");
+const decision_identity_1 = require("./decision-identity");
+const decision_file_1 = require("./decision-file");
+const decision_source_1 = require("./decision-source");
+const git_head_trust_1 = require("./git-head-trust");
+const human_confirmation_1 = require("./human-confirmation");
+const read_decisions_1 = require("./read-decisions");
+const waiver_decisions_1 = require("./waiver-decisions");
+const importMarkerPath = (projectRoot, slug) => path.join(projectRoot, '.sungen', 'migrations', `${slug}.waivers-imported.json`);
+exports.importMarkerPath = importMarkerPath;
+const asRecord = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+const newer = (w, validFrom) => {
+    const at = Date.parse(w.at);
+    return at > Date.parse(validFrom) && at <= Date.now();
+};
+function planWaiverSync(projectRoot, unit, slug, statePath, legacy) {
+    const legacyWaivers = asRecord(legacy);
+    const scope = (0, decision_file_1.unitDecisionScope)(projectRoot, unit);
+    const inForce = scope ? (0, waiver_decisions_1.effectiveWaiverEntries)((0, read_decisions_1.readDecisions)(projectRoot, scope, { kind: 'waiver' }).entries) : new Map();
+    const stateWaivers = { ...legacyWaivers };
+    const waivers = {};
+    const untrusted = [];
+    const imports = [];
+    if (scope && fs.existsSync((0, exports.importMarkerPath)(projectRoot, slug))) {
+        for (const [ob, d] of inForce)
+            stateWaivers[ob] = waivers[ob] = (0, waiver_decisions_1.asLegacyWaiver)(d);
+        return { scope, waivers, untrusted, stateWaivers, imports, markDone: false };
+    }
+    const head = asRecord(asRecord((0, git_head_trust_1.committedJson)(projectRoot, statePath)).waivers);
+    for (const [ob, w] of Object.entries(legacyWaivers)) {
+        if (!(0, waiver_decisions_1.isLegacyWaiver)(w))
+            continue; // unreadable record: kept in the file, never counted
+        const d = inForce.get(ob);
+        if (d && (0, waiver_decisions_1.sameWaiver)((0, waiver_decisions_1.asLegacyWaiver)(d), w)) {
+            waivers[ob] = w;
+            continue;
+        }
+        if (!(ob in head) || (0, decision_identity_1.canonicalJson)(head[ob]) !== (0, decision_identity_1.canonicalJson)(w)) {
+            untrusted.push({ obligation: ob, waiver: w });
+            continue;
+        }
+        if (d && !newer(w, d.valid_from)) {
+            stateWaivers[ob] = waivers[ob] = (0, waiver_decisions_1.asLegacyWaiver)(d);
+            continue;
+        }
+        if (scope)
+            imports.push((0, waiver_decisions_1.waiverDraft)(ob, w, { by: 'unknown', where: 'migrated' }, d?.id));
+        waivers[ob] = w;
+    }
+    for (const [ob, d] of inForce)
+        if (!(ob in waivers))
+            stateWaivers[ob] = waivers[ob] = (0, waiver_decisions_1.asLegacyWaiver)(d);
+    return { scope, waivers, untrusted, stateWaivers, imports, markDone: !!scope && untrusted.length === 0 };
+}
+/** The needs-you line for a waiver that is not in git HEAD: not counted, and how a human confirms it. */
+function untrustedWaiverText(unit, slug, title, u) {
+    const confirm = (0, human_confirmation_1.formatCommand)(['sungen', 'journey', '--screen', unit, '--waive', u.obligation, '--reason', u.waiver.reason]);
+    return `⚠️ Waiver on "${title}" is UNTRUSTED — not counted (decision.in-run: it is in .sungen/journey/${slug}.state.json `
+        + `but not in git HEAD). If it is yours, confirm it on a terminal: ${confirm}`;
+}
+const UNWRITABLE = new Set(['EACCES', 'EROFS', 'ENOSPC', 'EPERM']);
+function writeFile(file, text) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, text, 'utf-8');
+}
+/**
+ * Persist a plan: imports, the dual-written legacy file, the import marker. Returns false when the
+ * checkout cannot be written (read-only, full disk); any other failure — a decision that does not
+ * verify, a migration in progress or interrupted — is raised, never swallowed.
+ */
+function commitWaiverSync(projectRoot, unit, slug, plan, statePath, stateText) {
+    const marker = (0, exports.importMarkerPath)(projectRoot, slug);
+    const writeMarker = plan.markDone && !fs.existsSync(marker);
+    const markerText = (ids) => `${JSON.stringify({ schema: 1, unit, importedAt: new Date().toISOString(), imported: ids }, null, 2)}\n`;
+    try {
+        if (!plan.scope || plan.imports.length === 0) {
+            writeFile(statePath, stateText);
+            if (writeMarker)
+                writeFile(marker, markerText([]));
+            return true;
+        }
+        const scope = plan.scope;
+        const dir = (0, decision_file_1.decisionsDirFor)(projectRoot, scope);
+        const targets = plan.imports.map((d) => path.join(dir, `${(0, decision_identity_1.computeDecisionId)(d, scope)}.yaml`));
+        (0, migration_sentinel_1.withMigrationSentinel)(projectRoot, unit, slug, `import ${plan.imports.length} legacy waiver(s) into the decision layer`, [statePath, ...(writeMarker ? [marker] : []), ...targets], () => {
+            const ids = plan.imports.map((d) => (0, append_decision_1.appendDecision)(projectRoot, scope, d).entry.id);
+            writeFile(statePath, stateText);
+            if (writeMarker)
+                writeFile(marker, markerText(ids));
+        });
+        return true;
+    }
+    catch (err) {
+        if (UNWRITABLE.has(err?.code ?? ''))
+            return false;
+        throw err;
+    }
+}
+/** Record a waiver given now on the CLI; supersedes the waiver in force for that obligation, if any. */
+function recordWaiver(projectRoot, unit, obligation, w) {
+    const scope = (0, decision_file_1.unitDecisionScope)(projectRoot, unit);
+    if (!scope)
+        throw new Error(`Cannot record a waiver: "${unit}" does not name exactly one unit under qa/screens, qa/flows or qa/api.`);
+    const current = (0, waiver_decisions_1.effectiveWaiverEntries)((0, read_decisions_1.readDecisions)(projectRoot, scope, { kind: 'waiver' }).entries).get(obligation);
+    if (current && (0, waiver_decisions_1.sameWaiver)((0, waiver_decisions_1.asLegacyWaiver)(current), w))
+        return { status: 'already-recorded', entry: current, path: current.path };
+    return (0, append_decision_1.appendDecision)(projectRoot, scope, (0, waiver_decisions_1.waiverDraft)(obligation, w, { by: (0, decision_source_1.gitUserName)(projectRoot), where: 'cli' }, current?.id));
+}
+//# sourceMappingURL=legacy-waiver-migration.js.map

package/dist/decisions/legacy-waiver-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-waiver-migration.js","sourceRoot":"","sources":["../../src/decisions/legacy-waiver-migration.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,wCA0BC;AAGD,kDAIC;AAcD,4CAwBC;AAGD,oCAMC;AAtID;;;;;;;;;;;;;;;;;GAiBG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,oEAAoE;AACpE,uDAAiE;AACjE,2DAAuE;AACvE,mDAAqE;AAErE,uDAAgD;AAChD,qDAAiD;AACjD,6DAAqD;AACrD,qDAAiD;AACjD,yDAAmI;AAgB5H,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,IAAY,EAAU,EAAE,CAC5E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;AADtE,QAAA,gBAAgB,oBACsD;AAEnF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAChJ,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,SAAiB,EAAW,EAAE;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACxD,CAAC,CAAC;AAEF,SAAgB,cAAc,CAAC,WAAmB,EAAE,IAAY,EAAE,IAAY,EAAE,SAAiB,EAAE,MAAe;IAChH,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,yCAAsB,EAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAC1H,MAAM,YAAY,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAC;IACnE,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,IAAA,wBAAgB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,IAAA,iCAAc,EAAC,CAAC,CAAC,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,IAAA,iCAAc,EAAC,CAAC,CAAC;YAAE,SAAS,CAAiC,qDAAqD;QACvH,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAA,6BAAU,EAAC,IAAA,iCAAc,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACzE,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAA,iCAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,IAAA,iCAAa,EAAC,CAAC,CAAC,EAAE,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/H,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YAAC,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,IAAA,iCAAc,EAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACnG,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAA,8BAAW,EAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC;YAAE,YAAY,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,IAAA,iCAAc,EAAC,CAAC,CAAC,CAAC;IACxG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,yGAAyG;AACzG,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa,EAAE,CAAkB;IAC/F,MAAM,OAAO,GAAG,IAAA,kCAAa,EAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7H,OAAO,iBAAiB,KAAK,2EAA2E,IAAI,cAAc;UACtH,mEAAmE,OAAO,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnE,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,IAAY,EAAE,IAAY,EAAE,IAAoB,EAAE,SAAiB,EAAE,SAAiB;IAC1I,MAAM,MAAM,GAAG,IAAA,wBAAgB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC/I,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAChC,IAAI,WAAW;gBAAE,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,IAAA,+BAAe,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,qCAAiB,EAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/F,IAAA,0CAAqB,EAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,2CAA2C,EACrH,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,EAAE;YAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gCAAc,EAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAChC,IAAI,WAAW;gBAAE,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAE,GAA6B,EAAE,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,SAAgB,YAAY,CAAC,WAAmB,EAAE,IAAY,EAAE,UAAkB,EAAE,CAAe;IACjG,MAAM,KAAK,GAAG,IAAA,iCAAiB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,wEAAwE,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtH,IAAI,OAAO,IAAI,IAAA,6BAAU,EAAC,IAAA,iCAAc,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACjI,OAAO,IAAA,gCAAc,EAAC,WAAW,EAAE,KAAK,EAAE,IAAA,8BAAW,EAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAA,6BAAW,EAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACrI,CAAC"}

package/dist/decisions/read-decisions.d.ts

@@ -0,0 +1,19 @@
+import { DecisionEntry, DecisionKind } from './decision-schema';
+import { DecisionProblem } from './decision-file';
+export interface ReadDecision extends DecisionEntry {
+    scope: string;
+    path: string;
+    superseded_by?: string;
+    stale?: boolean;
+}
+export interface ReadDecisionsOptions {
+    asOf?: string;
+    auditHash?: string;
+    kind?: DecisionKind;
+}
+export interface ReadDecisionsResult {
+    entries: ReadDecision[];
+    problems: DecisionProblem[];
+}
+export declare function readDecisions(projectRoot: string, scope: string, opts?: ReadDecisionsOptions): ReadDecisionsResult;
+//# sourceMappingURL=read-decisions.d.ts.map

package/dist/decisions/read-decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-decisions.d.ts","sourceRoot":"","sources":["../../src/decisions/read-decisions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAuC,MAAM,iBAAiB,CAAC;AAEvF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE;AAChG,MAAM,WAAW,mBAAmB;IAAG,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE;AAK7F,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,mBAAmB,CA+BtH"}