@sun-asterisk/sungen 3.2.35 → 3.3.0-alpha.10

package/dist/decisions/decision-schema.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Decision entry schema (DOS-13.2).
+ *
+ * `{id, kind, anchors[], text, reason, payload?, source:{by, where}, valid_from, supersedes?,
+ *   visibility: internal|client, evidence_hash?, entry_hash}`
+ *
+ * Validation is strict both ways: a draft is checked before it is written, and a stored entry is
+ * checked when read — an unknown key (a stored `superseded_by`, say) makes the entry invalid, because
+ * a field outside the id's content could carry meaning the id does not vouch for.
+ */
+/** `triage-classification`: a red classified by hand, `sungen triage --case --as` (#928, graph/manual-triage-decisions.ts). */
+export declare const DECISION_KINDS: readonly ["waiver", "gate-override", "contract-approval", "viewpoint-acceptance", "clarification", "triage-classification"];
+export type DecisionKind = typeof DECISION_KINDS[number];
+export type DecisionVisibility = 'internal' | 'client';
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export interface DecisionSource {
+    by: string;
+    where: string;
+}
+export interface DecisionDraft {
+    kind: DecisionKind;
+    anchors: string[];
+    text: string;
+    reason: string;
+    payload?: Record<string, JsonValue>;
+    source: DecisionSource;
+    valid_from: string;
+    supersedes?: string;
+    visibility: DecisionVisibility;
+    evidence_hash?: string;
+}
+export interface DecisionEntry extends DecisionDraft {
+    id: string;
+    entry_hash: string;
+}
+export declare const DECISION_ID_RE: RegExp;
+/** Errors in a draft (empty = valid). Shared by the write boundary and the stored-entry check. */
+export declare function draftErrors(d: Record<string, unknown>): string[];
+/** A stored entry: the draft rules plus id, entry_hash and no unknown keys. */
+export declare function storedEntryErrors(raw: unknown): string[];
+//# sourceMappingURL=decision-schema.d.ts.map

package/dist/decisions/decision-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-schema.d.ts","sourceRoot":"","sources":["../../src/decisions/decision-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,+HAA+H;AAC/H,eAAO,MAAM,cAAc,6HAA8H,CAAC;AAC1J,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtG,MAAM,WAAW,cAAc;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAE7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAEvF,eAAO,MAAM,cAAc,QAAqB,CAAC;AAgBjD,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAgBhE;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAOxD"}

package/dist/decisions/decision-schema.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DECISION_ID_RE = exports.DECISION_KINDS = void 0;
+exports.draftErrors = draftErrors;
+exports.storedEntryErrors = storedEntryErrors;
+/**
+ * Decision entry schema (DOS-13.2).
+ *
+ * `{id, kind, anchors[], text, reason, payload?, source:{by, where}, valid_from, supersedes?,
+ *   visibility: internal|client, evidence_hash?, entry_hash}`
+ *
+ * Validation is strict both ways: a draft is checked before it is written, and a stored entry is
+ * checked when read — an unknown key (a stored `superseded_by`, say) makes the entry invalid, because
+ * a field outside the id's content could carry meaning the id does not vouch for.
+ */
+/** `triage-classification`: a red classified by hand, `sungen triage --case --as` (#928, graph/manual-triage-decisions.ts). */
+exports.DECISION_KINDS = ['waiver', 'gate-override', 'contract-approval', 'viewpoint-acceptance', 'clarification', 'triage-classification'];
+exports.DECISION_ID_RE = /^D-[0-9a-f]{16}$/;
+const ENTRY_HASH_RE = /^[0-9a-f]{64}$/;
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
+const STORED_KEYS = new Set(['id', 'kind', 'anchors', 'text', 'reason', 'payload', 'source', 'valid_from', 'supersedes', 'visibility', 'evidence_hash', 'entry_hash']);
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const nonEmpty = (v) => typeof v === 'string' && v.trim().length > 0;
+function isJson(v, depth = 0) {
+    if (depth > 20)
+        return false;
+    if (v === null || typeof v === 'string' || typeof v === 'boolean')
+        return true;
+    if (typeof v === 'number')
+        return Number.isFinite(v);
+    if (Array.isArray(v))
+        return v.every((x) => isJson(x, depth + 1));
+    return isObject(v) && Object.values(v).every((x) => isJson(x, depth + 1));
+}
+/** Errors in a draft (empty = valid). Shared by the write boundary and the stored-entry check. */
+function draftErrors(d) {
+    const e = [];
+    if (!exports.DECISION_KINDS.includes(d.kind))
+        e.push(`kind must be one of ${exports.DECISION_KINDS.join('|')}`);
+    if (!Array.isArray(d.anchors) || !d.anchors.every(nonEmpty))
+        e.push('anchors must be a list of non-empty strings');
+    if (!nonEmpty(d.text))
+        e.push('text is required');
+    if (!nonEmpty(d.reason))
+        e.push('reason is required');
+    if (d.payload !== undefined && !(isObject(d.payload) && isJson(d.payload)))
+        e.push('payload must be a JSON object');
+    const src = d.source;
+    if (!isObject(src) || typeof src.by !== 'string' || !nonEmpty(src.where) || Object.keys(src).some((k) => k !== 'by' && k !== 'where')) {
+        e.push('source must be {by, where}');
+    }
+    if (typeof d.valid_from !== 'string' || !ISO_RE.test(d.valid_from) || Number.isNaN(Date.parse(d.valid_from)))
+        e.push('valid_from must be an ISO-8601 timestamp');
+    if (d.supersedes !== undefined && (typeof d.supersedes !== 'string' || !exports.DECISION_ID_RE.test(d.supersedes)))
+        e.push('supersedes must be a decision id D-<16 hex>');
+    if (d.visibility !== 'internal' && d.visibility !== 'client')
+        e.push('visibility must be internal|client');
+    if (d.evidence_hash !== undefined && typeof d.evidence_hash !== 'string')
+        e.push('evidence_hash must be a string');
+    return e;
+}
+/** A stored entry: the draft rules plus id, entry_hash and no unknown keys. */
+function storedEntryErrors(raw) {
+    if (!isObject(raw))
+        return ['not a mapping'];
+    const e = draftErrors(raw);
+    for (const k of Object.keys(raw))
+        if (!STORED_KEYS.has(k))
+            e.push(`unknown key "${k}"`);
+    if (typeof raw.id !== 'string' || !exports.DECISION_ID_RE.test(raw.id))
+        e.push('id must be D-<16 hex>');
+    if (typeof raw.entry_hash !== 'string' || !ENTRY_HASH_RE.test(raw.entry_hash))
+        e.push('entry_hash must be 64 hex');
+    return e;
+}
+//# sourceMappingURL=decision-schema.js.map

package/dist/decisions/decision-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-schema.js","sourceRoot":"","sources":["../../src/decisions/decision-schema.ts"],"names":[],"mappings":";;;AAkDA,kCAgBC;AAGD,8CAOC;AA5ED;;;;;;;;;GASG;AACH,+HAA+H;AAClH,QAAA,cAAc,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,eAAe,EAAE,uBAAuB,CAAU,CAAC;AAsB7I,QAAA,cAAc,GAAG,kBAAkB,CAAC;AACjD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,MAAM,GAAG,qEAAqE,CAAC;AACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvK,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAEvF,SAAS,MAAM,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC;IACnC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,kGAAkG;AAClG,SAAgB,WAAW,CAAC,CAA0B;IACpD,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,IAAI,CAAC,sBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAoB,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,sBAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACnH,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC;QACtI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACjK,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,sBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAClK,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC3G,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,sBAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/decisions/decision-source.d.ts

@@ -0,0 +1,2 @@
+export declare function gitUserName(cwd: string): string;
+//# sourceMappingURL=decision-source.d.ts.map

package/dist/decisions/decision-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-source.d.ts","sourceRoot":"","sources":["../../src/decisions/decision-source.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO/C"}

package/dist/decisions/decision-source.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitUserName = gitUserName;
+/**
+ * Who recorded a decision: `git config user.name` — a name, never the email (DOS-13.2, security
+ * considerations). Best-effort: no git, no name → 'unknown'.
+ */
+const child_process_1 = require("child_process");
+function gitUserName(cwd) {
+    try {
+        const name = (0, child_process_1.execFileSync)('git', ['config', 'user.name'], { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString('utf8').trim();
+        return name || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=decision-source.js.map

package/dist/decisions/decision-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-source.js","sourceRoot":"","sources":["../../src/decisions/decision-source.ts"],"names":[],"mappings":";;AAMA,kCAOC;AAbD;;;GAGG;AACH,iDAA6C;AAE7C,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/I,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/decisions/exclusive-file-create.d.ts

@@ -0,0 +1,3 @@
+/** true = created, false = the name was already taken. Any other failure throws. */
+export declare function createFileExclusive(file: string, text: string): boolean;
+//# sourceMappingURL=exclusive-file-create.d.ts.map

package/dist/decisions/exclusive-file-create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-file-create.d.ts","sourceRoot":"","sources":["../../src/decisions/exclusive-file-create.ts"],"names":[],"mappings":"AAcA,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BvE"}

package/dist/decisions/exclusive-file-create.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFileExclusive = createFileExclusive;
+/**
+ * Create a file only if its name is free, and never leave it half-written (red-team #13).
+ *
+ * The bytes go to a private tmp file opened with O_EXCL, are fsynced, then hard-linked to the final
+ * name. `link` fails with EEXIST when the name is taken, so the final file appears complete or not at
+ * all. On a filesystem without hard links an O_EXCL create of the final name keeps the exclusivity.
+ * Used for decision entries (same content → same name → "already recorded") and for the migration
+ * sentinel (two migrations of one unit cannot both believe they hold it).
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const NO_HARD_LINKS = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV']);
+/** true = created, false = the name was already taken. Any other failure throws. */
+function createFileExclusive(file, text) {
+    const tmp = `${file}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`;
+    const fd = fs.openSync(tmp, 'wx');
+    try {
+        fs.writeFileSync(fd, text);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.linkSync(tmp, file);
+        return true;
+    }
+    catch (err) {
+        const code = err.code ?? '';
+        if (code === 'EEXIST')
+            return false;
+        if (!NO_HARD_LINKS.has(code))
+            throw err;
+        try {
+            fs.writeFileSync(file, text, { flag: 'wx' });
+            return true;
+        }
+        catch (e) {
+            if (e.code === 'EEXIST')
+                return false;
+            throw e;
+        }
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+//# sourceMappingURL=exclusive-file-create.js.map

package/dist/decisions/exclusive-file-create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-file-create.js","sourceRoot":"","sources":["../../src/decisions/exclusive-file-create.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,kDA0BC;AAzCD;;;;;;;;GAQG;AACH,mCAAqC;AACrC,uCAAyB;AAEzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAErF,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/decisions/git-head-trust.d.ts

@@ -0,0 +1,19 @@
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+export declare function gitOutput(cwd: string, args: string[]): string | null;
+/**
+ * The text of each `<rev>:<path>` spec, read by ONE `git cat-file --batch` in `cwd` (`./path` is relative
+ * to it): null where git holds no such file; null for the whole call when git fails.
+ */
+export declare function gitFileTexts(cwd: string, specs: string[]): Array<string | null> | null;
+/**
+ * Whether `cwd` is in a shallow clone. git < 2.15 does not know `--is-shallow-repository` and echoes it
+ * back, so only an exact `true` / `false` is an answer; otherwise the `shallow` file in the git directory
+ * (common dir, or the git dir) decides, and when not even that can be found the clone is taken as shallow
+ * — its history is then unknown, which fails closed for the callers that ask.
+ */
+export declare function isShallowRepository(cwd: string): boolean;
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+export declare function committedText(projectRoot: string, abs: string): string | null;
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+export declare function committedJson(projectRoot: string, abs: string): unknown;
+//# sourceMappingURL=git-head-trust.d.ts.map

package/dist/decisions/git-head-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.d.ts","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":"AAWA,wGAAwG;AACxG,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAuBtF;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7E;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIvE"}

package/dist/decisions/git-head-trust.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitOutput = gitOutput;
+exports.gitFileTexts = gitFileTexts;
+exports.isShallowRepository = isShallowRepository;
+exports.committedText = committedText;
+exports.committedJson = committedJson;
+/**
+ * What git HEAD says — the trust anchor for agent-writable state (red-team #3, review H1).
+ *
+ * `.sungen/` files are written by the CLI and, without the guard, by any agent. A record in them is
+ * trusted only where it equals its committed version: a commit went through review, a local edit
+ * did not. Outside git, or for a file git does not track, nothing is trusted. Never throws.
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+function gitOutput(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024, timeout: 30000 }).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The text of each `<rev>:<path>` spec, read by ONE `git cat-file --batch` in `cwd` (`./path` is relative
+ * to it): null where git holds no such file; null for the whole call when git fails.
+ */
+function gitFileTexts(cwd, specs) {
+    if (specs.length === 0)
+        return [];
+    if (specs.some((s) => /[\r\n]/.test(s)))
+        return null;
+    let out;
+    try {
+        out = (0, child_process_1.execFileSync)('git', ['cat-file', '--batch'], { cwd, input: `${specs.join('\n')}\n`, stdio: ['pipe', 'pipe', 'ignore'], maxBuffer: 256 * 1024 * 1024, timeout: 60000 });
+    }
+    catch {
+        return null;
+    }
+    // Each answer: `<oid> <type> <size>\n<content>\n`, or `<spec> missing\n` (also `ambiguous`).
+    const texts = [];
+    let at = 0;
+    for (let i = 0; i < specs.length; i++) {
+        const eol = out.indexOf(0x0a, at);
+        if (eol < 0)
+            return null;
+        const header = out.subarray(at, eol).toString('utf8').split(' ');
+        at = eol + 1;
+        if (header.length !== 3 || !/^\d+$/.test(header[2])) {
+            texts.push(null);
+            continue;
+        }
+        const size = Number(header[2]);
+        texts.push(header[1] === 'blob' ? out.subarray(at, at + size).toString('utf8') : null);
+        at += size + 1;
+    }
+    return texts;
+}
+/**
+ * Whether `cwd` is in a shallow clone. git < 2.15 does not know `--is-shallow-repository` and echoes it
+ * back, so only an exact `true` / `false` is an answer; otherwise the `shallow` file in the git directory
+ * (common dir, or the git dir) decides, and when not even that can be found the clone is taken as shallow
+ * — its history is then unknown, which fails closed for the callers that ask.
+ */
+function isShallowRepository(cwd) {
+    const answer = gitOutput(cwd, ['rev-parse', '--is-shallow-repository'])?.trim();
+    if (answer === 'true' || answer === 'false')
+        return answer === 'true';
+    const dirs = ['--git-common-dir', '--git-dir'].map((flag) => gitOutput(cwd, ['rev-parse', flag])?.trim())
+        .filter((d) => !!d && !d.startsWith('-'));
+    return dirs.length === 0 || dirs.some((d) => fs.existsSync(path.join(path.resolve(cwd, d), 'shallow')));
+}
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+function committedText(projectRoot, abs) {
+    const rel = path.relative(projectRoot, abs).split(path.sep).join('/');
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return gitOutput(projectRoot, ['show', `HEAD:./${rel}`]);
+}
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+function committedJson(projectRoot, abs) {
+    const text = committedText(projectRoot, abs);
+    if (text === null)
+        return null;
+    try {
+        return JSON.parse(text.replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git-head-trust.js.map

package/dist/decisions/git-head-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.js","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,8BAMC;AAMD,oCAuBC;AAQD,kDAMC;AAGD,sCAIC;AAGD,sCAIC;AA3ED;;;;;;GAMG;AACH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAE7B,wGAAwG;AACxG,SAAgB,SAAS,CAAC,GAAW,EAAE,IAAc;IACnD,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAe;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/K,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,6FAA6F;IAC7F,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvF,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACtG,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,yGAAyG;AACzG,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3E,CAAC"}

package/dist/decisions/human-confirmation.d.ts

@@ -0,0 +1,35 @@
+export interface ConfirmationIO {
+    input: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    output: NodeJS.WritableStream;
+    /** The CLI's real terminal: prompt on `/dev/tty` (opened only when a confirmation is asked). */
+    controllingTerminal?: boolean;
+}
+export declare class HumanConfirmationRefused extends Error {
+    readonly command?: string;
+    constructor(message: string, command?: string);
+}
+/** The CLI's streams: stdin decides whether a human is there; the prompt itself uses /dev/tty. */
+export declare const processIO: () => ConfirmationIO;
+export declare const isInteractive: (io: ConfirmationIO) => boolean;
+export declare function shellQuote(arg: string): string;
+export declare const formatCommand: (argv: string[]) => string;
+/** Refuse up front, before any state is read or written, when no human is at a terminal. */
+export declare function requireInteractive(io: ConfirmationIO, what: string, command: string): void;
+/** A fresh, hard-to-guess suffix for one prompt. */
+export declare const confirmationNonce: () => string;
+export declare function requireTypedConfirmation(opts: {
+    what: string;
+    phrase: string;
+    command: string;
+    summary: string[];
+    io: ConfirmationIO;
+}): Promise<void>;
+/** A leftover write-ahead sentinel: the human answers REVERT or KEEP. Never answered for them. */
+export declare function askMigrationChoice(opts: {
+    detail: string;
+    command: string;
+    io: ConfirmationIO;
+}): Promise<'REVERT' | 'KEEP'>;
+//# sourceMappingURL=human-confirmation.d.ts.map

package/dist/decisions/human-confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-confirmation.d.ts","sourceRoot":"","sources":["../../src/decisions/human-confirmation.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aACJ,OAAO,CAAC,EAAE,MAAM;gBAAjD,OAAO,EAAE,MAAM,EAAkB,OAAO,CAAC,EAAE,MAAM;CAI9D;AAED,kGAAkG;AAClG,eAAO,MAAM,SAAS,QAAO,cAA+F,CAAC;AAC7H,eAAO,MAAM,aAAa,GAAI,IAAI,cAAc,KAAG,OAAkC,CAAC;AAEtF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AACD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,KAAG,MAAwC,CAAC;AAyCxF,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1F;AAED,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,QAAO,MAAsD,CAAC;AAE5F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,cAAc,CAAC;CACtF,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAWlI"}

package/dist/decisions/human-confirmation.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmationNonce = exports.formatCommand = exports.isInteractive = exports.processIO = exports.HumanConfirmationRefused = void 0;
+exports.shellQuote = shellQuote;
+exports.requireInteractive = requireInteractive;
+exports.requireTypedConfirmation = requireTypedConfirmation;
+exports.askMigrationChoice = askMigrationChoice;
+/**
+ * Typed human confirmation (DOS-13.4, red-team #3; review phase 03 M5).
+ *
+ * `journey --waive`, `journey --decide`, `delivery --accept-in-run` record or accept decisions that
+ * relax a gate, so a person must type a confirmation on a terminal:
+ *   - no TTY (an agent's shell, a pipe, CI) → refuse and print the exact command for a human to run;
+ *     piped stdin is not a TTY, so piping the phrase in never counts
+ *   - the prompt and the answer go through the controlling terminal (`/dev/tty`), not stdin/stderr,
+ *     so a redirected or wrapped stream neither sees nor answers it
+ *   - the phrase carries a NONCE drawn per prompt, so an answer cannot be scripted from the refusal
+ *     message: the printed command never contains it (it does not exist until the prompt is shown)
+ * This is a hard floor under Claude Code (the PreToolUse guard also denies agent writes to
+ * qa/**\/decisions/**) and a soft barrier elsewhere; git-HEAD comparison and the in-run rule remain.
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const readline = __importStar(require("readline"));
+const tty = __importStar(require("tty"));
+class HumanConfirmationRefused extends Error {
+    constructor(message, command) {
+        super(message);
+        this.command = command;
+        this.name = 'HumanConfirmationRefused';
+    }
+}
+exports.HumanConfirmationRefused = HumanConfirmationRefused;
+/** The CLI's streams: stdin decides whether a human is there; the prompt itself uses /dev/tty. */
+const processIO = () => ({ input: process.stdin, output: process.stderr, controllingTerminal: true });
+exports.processIO = processIO;
+const isInteractive = (io) => io.input.isTTY === true;
+exports.isInteractive = isInteractive;
+function shellQuote(arg) {
+    return /^[A-Za-z0-9_./:=@%+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+const formatCommand = (argv) => argv.map(shellQuote).join(' ');
+exports.formatCommand = formatCommand;
+/** The terminal to talk to a human on, or null when there is none. */
+function openTerminal(io) {
+    if (!(0, exports.isInteractive)(io))
+        return null;
+    if (!io.controllingTerminal || process.platform === 'win32')
+        return { input: io.input, output: io.output, close: () => undefined };
+    let rfd = -1;
+    let wfd = -1;
+    try {
+        rfd = fs.openSync('/dev/tty', 'r');
+        wfd = fs.openSync('/dev/tty', 'w');
+        const input = new tty.ReadStream(rfd);
+        const output = new tty.WriteStream(wfd);
+        return { input, output, close: () => { input.destroy(); output.destroy(); } };
+    }
+    catch {
+        for (const fd of [rfd, wfd])
+            if (fd >= 0) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* already closed */ }
+            }
+        return null; // no controlling terminal: not a human at a keyboard
+    }
+}
+/** One line from the human, or null on EOF. */
+function askLine(t, prompt) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: t.input, output: t.output, terminal: false });
+        let settled = false;
+        const done = (v) => { if (!settled) {
+            settled = true;
+            resolve(v);
+            rl.close();
+        } };
+        rl.on('close', () => done(null));
+        rl.question(prompt, (answer) => done(answer));
+    });
+}
+function refuseWithoutTty(what, command) {
+    return new HumanConfirmationRefused(`Refused: ${what} needs a human at a terminal to type a confirmation, and this run has no TTY.\n`
+        + `  Nothing was recorded. Run this yourself in a terminal:\n    ${command}`, command);
+}
+/** Refuse up front, before any state is read or written, when no human is at a terminal. */
+function requireInteractive(io, what, command) {
+    if (!(0, exports.isInteractive)(io))
+        throw refuseWithoutTty(what, command);
+}
+/** A fresh, hard-to-guess suffix for one prompt. */
+const confirmationNonce = () => (0, crypto_1.randomBytes)(3).toString('hex').toUpperCase();
+exports.confirmationNonce = confirmationNonce;
+async function requireTypedConfirmation(opts) {
+    const t = openTerminal(opts.io);
+    if (!t)
+        throw refuseWithoutTty(opts.what, opts.command);
+    try {
+        const expected = `${opts.phrase} ${(0, exports.confirmationNonce)()}`;
+        t.output.write(`\nAbout to ${opts.what}:\n${opts.summary.map((l) => `  ${l}`).join('\n')}\n`);
+        const answer = await askLine(t, `Type "${expected}" to confirm (anything else cancels): `);
+        if ((answer ?? '').trim() !== expected) {
+            throw new HumanConfirmationRefused(`Cancelled: the confirmation did not match the phrase shown. Nothing was recorded.`, opts.command);
+        }
+    }
+    finally {
+        t.close();
+    }
+}
+/** A leftover write-ahead sentinel: the human answers REVERT or KEEP. Never answered for them. */
+async function askMigrationChoice(opts) {
+    const t = openTerminal(opts.io);
+    if (!t)
+        throw refuseWithoutTty('answering an interrupted migration (REVERT or KEEP)', opts.command);
+    try {
+        t.output.write(`\n${opts.detail}\n`);
+        const answer = ((await askLine(t, 'Type REVERT (restore every file it lists) or KEEP (keep the new files): ')) ?? '').trim().toUpperCase();
+        if (answer === 'REVERT' || answer === 'KEEP')
+            return answer;
+        throw new HumanConfirmationRefused('Cancelled: answer REVERT or KEEP. Nothing was changed.', opts.command);
+    }
+    finally {
+        t.close();
+    }
+}
+//# sourceMappingURL=human-confirmation.js.map

package/dist/decisions/human-confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-confirmation.js","sourceRoot":"","sources":["../../src/decisions/human-confirmation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,gCAEC;AA2CD,gDAEC;AAKD,4DAeC;AAGD,gDAWC;AAtHD;;;;;;;;;;;;;GAaG;AACH,mCAAqC;AACrC,uCAAyB;AACzB,mDAAqC;AACrC,yCAA2B;AAS3B,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe,EAAkB,OAAgB;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,YAAO,GAAP,OAAO,CAAS;QAE3D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,kGAAkG;AAC3F,MAAM,SAAS,GAAG,GAAmB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;AAAhH,QAAA,SAAS,aAAuG;AACtH,MAAM,aAAa,GAAG,CAAC,EAAkB,EAAW,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;AAAzE,QAAA,aAAa,iBAA4D;AAEtF,SAAgB,UAAU,CAAC,GAAW;IACpC,OAAO,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACvF,CAAC;AACM,MAAM,aAAa,GAAG,CAAC,IAAc,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAA3E,QAAA,aAAa,iBAA8D;AAIxF,sEAAsE;AACtE,SAAS,YAAY,CAAC,EAAkB;IACtC,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,EAAE,CAAC,mBAAmB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACnI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnC,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;QACtG,OAAO,IAAI,CAAC,CAAG,qDAAqD;IACtE,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAS,OAAO,CAAC,CAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAgB,EAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACvG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,wBAAwB,CACjC,YAAY,IAAI,iFAAiF;UAC/F,iEAAiE,OAAO,EAAE,EAC5E,OAAO,CACR,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAgB,kBAAkB,CAAC,EAAkB,EAAE,IAAY,EAAE,OAAe;IAClF,IAAI,CAAC,IAAA,qBAAa,EAAC,EAAE,CAAC;QAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,oDAAoD;AAC7C,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAA/E,QAAA,iBAAiB,qBAA8D;AAErF,KAAK,UAAU,wBAAwB,CAAC,IAE9C;IACC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAA,yBAAiB,GAAE,EAAE,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,QAAQ,wCAAwC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,wBAAwB,CAAC,mFAAmF,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kGAAkG;AAC3F,KAAK,UAAU,kBAAkB,CAAC,IAA6D;IACpG,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,gBAAgB,CAAC,qDAAqD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,0EAA0E,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3I,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5D,MAAM,IAAI,wBAAwB,CAAC,wDAAwD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}