@tangle-network/agent-app 0.45.27 → 0.45.29

package/dist/signoff/index.d.ts

@@ -1,32 +1,7 @@
-export { R as RunSignoffOptions, r as runSignoff } from '../run-tEsZUhAf.js';
-import { c as SignoffConfig, L as LoadedSignoffConfig, b as SignoffReport, d as SignoffStepResult, e as SignoffStepSpec, f as SignoffRepoFacts, S as SignoffSource } from '../types-U7Nz-txa.js';
-export { g as SignoffAttempt, h as SignoffConfigOrigin, a as SignoffEvent, i as SignoffHostFacts, j as SignoffInstallResult, k as SignoffInstallSpec, l as SignoffShuffleSpec, m as SignoffStepStatus } from '../types-U7Nz-txa.js';
+export { R as RunSignoffOptions, r as runSignoff } from '../run-D80hoLKh.js';
+import { L as LoadedSignoffConfig, b as SignoffReport } from '../types-Bd6uW9vQ.js';
+export { c as SignoffAttempt, d as SignoffConfig, e as SignoffConfigOrigin, a as SignoffEvent, f as SignoffHostFacts, g as SignoffInstallResult, h as SignoffInstallSpec, i as SignoffRepoFacts, j as SignoffShuffleSpec, S as SignoffSource, k as SignoffStepResult, l as SignoffStepSpec, m as SignoffStepStatus } from '../types-Bd6uW9vQ.js';
 
-/**
- * Where the step list comes from.
- *
- * It is declared by the repo, never hardcoded here, because the three workflows
- * this has to reproduce do not share a shape: tax-agent filters its install to
- * one workspace package and runs a Python toolkit suite; legal-agent runs a
- * react-router typegen and a Worker startup check; agent-app runs a named
- * incident-class gate, a generated-project test and knip. A checker that
- * hardcodes any one of those is wrong for the other two.
- *
- * Three sources, in order:
- *  1. `signoff.config.mjs` (or `.js`) — the full surface, including per-step
- *     `env`, `needs` and shuffle specs.
- *  2. a `signoff` key in `package.json` — the same shape, JSON-only.
- *  3. derived from the repo's own `scripts`, so a repo gets a real gate before
- *     anyone writes a config. The derivation is documented below and its origin
- *     is stamped into the proof, because a derived run is a weaker claim than a
- *     declared one.
- */
-declare const SIGNOFF_CONFIG_FILES: readonly string[];
-declare function parseSignoffConfig(value: unknown, where: string): SignoffConfig;
-declare function deriveSignoffConfig(scripts: Readonly<Record<string, string>>): {
-    readonly config: SignoffConfig;
-    readonly used: readonly string[];
-};
 interface LoadSignoffConfigOptions {
     readonly repoRoot: string;
     /** Explicit config path. Missing file is an error, never a silent fallback. */
@@ -34,397 +9,6 @@ interface LoadSignoffConfigOptions {
 }
 declare function loadSignoffConfig(options: LoadSignoffConfigOptions): Promise<LoadedSignoffConfig>;
 
-/** Concurrency actually achieved, measured from the step windows rather than
- *  asserted from the config. A claimed speedup nobody measured is a wish. */
-declare function peakConcurrency(steps: readonly SignoffStepResult[]): number;
 declare function formatSignoffReport(report: SignoffReport): string;
-/** One line for a commit message, a PR comment, or a chat handoff. */
-declare function formatSignoffLine(report: SignoffReport): string;
 
-/**
- * Refuse to sign off on a runtime the product does not ship.
- *
- * CI pins its Node version (`actions/setup-node` with `node-version: 22` in all
- * three fleet workflows). A developer's shell does not — this host runs 24. A
- * local gate that inherits whatever is on `PATH` therefore verifies a runtime
- * nobody deploys, and reports it as the runtime that ships. That is the same
- * failure shape as a number measured in a narrower context than it is
- * presented in, and it is not acceptable in the thing that replaces the merge
- * gate.
- *
- * So the pin is read from the repo and enforced, or it is absent and the report
- * says so. Three sources, in order:
- *
- *  - `signoff.config.mjs`'s `nodeVersion` — the explicit declaration.
- *  - `.nvmrc` — the pin a repo already keeps for humans.
- *  - the `pull_request` workflows' `node-version` (`./workflow-pin`) — the pin
- *    CI itself runs on.
- *
- * **The third source was added because the first two were empty on the entire
- * fleet, and that produced a false PASS.** legal-agent `4c0d688` failed CI on
- * `Cannot bundle Node.js built-in "node:sqlite"` and this gate signed it off.
- * Reproduced in one installed tree, same bytes: Node 22 fails both files, Node
- * 24 passes both, every time. No `.nvmrc` exists in tax-agent, legal-agent or
- * agent-app; all three pin `node-version: 22` in the workflow being replaced.
- * A gate that replaces a workflow has to read the runtime that workflow pins.
- *
- * A `.nvmrc` and a workflow that disagree is not resolved by preference — it is
- * a refusal, because it means the local gate and CI verify different runtimes,
- * which is the exact defect this module exists to prevent.
- *
- * **`engines.node` is deliberately NOT read.** It is a floor (`">=18"`), not a
- * pin, so treating it as one manufactures refusals on every version above the
- * floor — and an unsatisfiable gate does not stop bad work, it gets waived.
- */
-interface NodeVersionRequirement {
-    /** The declared major, e.g. `22`. */
-    readonly major: number;
-    readonly declared: string;
-    /** Where it came from, for the proof. */
-    readonly source: string;
-}
-declare function resolveNodeRequirement(repoRoot: string, configured?: string): NodeVersionRequirement | null;
-/**
- * Throw when the running Node cannot stand in for the declared one.
- *
- * Major-only: a patch difference is not a different runtime, and demanding an
- * exact patch would refuse every host that has not just re-installed.
- */
-declare function assertNodeVersion(requirement: NodeVersionRequirement | null, running?: string): void;
-
-/**
- * The dependency graph, and running it as wide as the graph allows.
- *
- * CI runs these steps in a line because a YAML `steps:` list is a line. Nothing
- * about the work requires that: typecheck, the suite, the build and knip all
- * read source and none reads another's output. On a 32-core host, running them
- * concurrently is free wall-clock, and it is the only reason a strictly larger
- * verification can still finish faster than the CI it replaces.
- *
- * The graph is declared per step (`needs`), validated here, and the schedule is
- * derived from it — so an omitted edge is a correctness bug the repo owns, and
- * a cycle is named rather than deadlocking.
- */
-interface GraphNode {
-    readonly name: string;
-    readonly needs?: readonly string[];
-}
-/** Throws on a duplicate name, a dangling `needs`, or a cycle. */
-declare function validateGraph(nodes: readonly GraphNode[]): void;
-type TaskStatus = 'passed' | 'failed' | 'skipped' | 'cancelled' | 'blocked';
-interface TaskOutcome<T> {
-    readonly name: string;
-    readonly status: TaskStatus;
-    /** Present for anything that actually ran, including a cancelled task. */
-    readonly value: T | null;
-    readonly startedAtMs: number | null;
-    readonly finishedAtMs: number | null;
-}
-interface RunGraphOptions<TNode extends GraphNode, TValue> {
-    readonly nodes: readonly TNode[];
-    readonly maxParallel: number;
-    /** `false` stops scheduling after the first failure and kills what is running. */
-    readonly keepGoing: boolean;
-    /** Runs one node. Resolves `{ ok }` for pass/fail; must not throw for a
-     *  failing command — a non-zero exit is data. */
-    readonly run: (node: TNode, signal: AbortSignal) => Promise<{
-        readonly ok: boolean;
-        readonly value: TValue;
-    }>;
-    /** Wall-clock origin, so outcomes are comparable across the whole run. */
-    readonly now?: () => number;
-}
-/**
- * Run the graph, honouring dependencies and the parallelism cap.
- *
- * Failure semantics, stated because they are the difference between a gate you
- * trust and one you argue with:
- *  - fail-fast (default): nothing new is scheduled, everything in flight is
- *    aborted and reported as `cancelled`, everything unstarted as `skipped`.
- *  - `keepGoing`: independent work continues, but a step whose dependency
- *    failed is reported `blocked`. It is never reported as passed, and never
- *    silently omitted.
- */
-declare function runGraph<TNode extends GraphNode, TValue>(options: RunGraphOptions<TNode, TValue>): Promise<TaskOutcome<TValue>[]>;
-
-/**
- * Suite-order randomization — the half of this gate that CI does not have.
- *
- * CI runs one arbitrary file order, so a scheduling-dependent failure is a coin
- * flip it happens to win or lose. The `node:sqlite` bundling failure that
- * started this was exactly that shape: it reproduced under CI's clean install
- * and worker sharding and not under a warm local run, and a single fixed order
- * could have missed it in either direction.
- *
- * Two rules make randomization useful rather than merely noisy:
- *
- * 1. **Every seed is recorded.** A shuffled failure that cannot be replayed is
- *    a rumour. The report carries the base seed and every derived seed, and the
- *    derivation is a pure function of `(base, step, index)` — so `--seed <base>`
- *    reproduces the whole run, and a single seed replays one step.
- * 2. **Files are shuffled; tests inside a file are not.** File order is what
- *    module-graph and worker-scheduling failures depend on. Shuffling the tests
- *    within a file mostly finds intentional ordering in a `describe` block,
- *    which is a false alarm, and a gate that cries wolf gets waived.
- */
-/**
- * Vitest file-order shuffle. `{seed}` is substituted per attempt.
- *
- * **No `--` separator, and that is measured, not assumed.** The habit is to
- * write `pnpm run test -- --flag`, and it silently breaks this: pnpm forwards
- * script arguments verbatim without needing the separator, so the `--` reaches
- * vitest, whose CLI treats it as end-of-options and drops everything after it.
- * Measured on this repo, four test files, `--reporter=verbose`:
- *
- * | invocation | seed 1 order | seed 2 order |
- * |---|---|---|
- * | `vitest run -- --sequence.shuffle.files=true --sequence.seed=N` | schedule, store, seeds, config | schedule, store, seeds, config |
- * | `vitest run --sequence.shuffle.files=true --sequence.seed=N` | schedule, config, store, seeds | seeds, schedule, config, store |
- *
- * The first row is the failure this gate exists to prevent, applied to itself:
- * a run that reports "2 orders, seeds recorded" while running one fixed order
- * twice. If a runner ever does need a separator, its config declares its own
- * `shuffle.args`.
- */
-declare const DEFAULT_SHUFFLE_ARGS: readonly string[];
-declare const DEFAULT_SHUFFLE_RUNS = 2;
-/** A fresh base seed. Random, then recorded — never a fixed constant, or the
- *  "randomized" order is one more fixed order. */
-declare function newSeedBase(): number;
-/**
- * Derive a step's Nth seed from the base.
- *
- * A hash rather than `base + n`: adjacent seeds produce correlated orders in
- * some runners, and the point is independent samples of the order space.
- */
-declare function deriveSeed(base: number, stepName: string, index: number): number;
-/**
- * Refuse a shuffled step whose command cannot receive the appended flags.
- *
- * pnpm only forwards extra arguments to a script through `run`, `exec` or
- * `dlx`. The shorthand form puts pnpm's own option parser in front of them, and
- * what happens next is a version lottery. Measured on this host, appending
- * `--sequence.shuffle.files=true --sequence.seed=7` to a script that prints its
- * `process.argv`:
- *
- * | command | pnpm 9.15.9 | pnpm 10.22.0 |
- * |---|---|---|
- * | `pnpm run t <flags>` | forwarded, exit 0 | forwarded, exit 0 |
- * | `pnpm exec node probe.mjs <flags>` | forwarded, exit 0 | forwarded, exit 0 |
- * | `pnpm t <flags>` | `Unknown options`, exit 1 | exit 254, script never ran |
- * | `pnpm --filter web t <flags>` | `Unknown options`, exit 1 | **exit 0, script never ran** |
- *
- * That last cell is the reason this is a refusal and not a note. tax-agent's CI
- * runs `pnpm --filter web test`, and a config that copied the line verbatim
- * would, on pnpm 10, report a green "unit tests" step that executed zero tests.
- * A gate reporting safety it did not provide is the exact failure this module
- * exists to prevent, and the shorthand makes it silent.
- *
- * This is a static approximation — it checks the invocation SHAPE, not what the
- * runner received — so it is deliberately narrow: it fires only on commands
- * that invoke pnpm, and only on steps that get arguments appended.
- */
-declare function assertShuffleArgsReachTheRunner(steps: readonly SignoffStepSpec[]): void;
-interface StepAttemptPlan {
-    readonly command: string;
-    readonly seed: number | null;
-}
-/**
- * Expand one step into the commands that will actually run.
- *
- * An unshuffled step is one attempt with no seed. A shuffled step is one
- * attempt per seed, each with the seed substituted into the appended arguments.
- */
-declare function planAttempts(step: SignoffStepSpec, seedBase: number, overrideRuns?: number): StepAttemptPlan[];
-
-/**
- * Read the Node pin out of the workflows that gate a merge.
- *
- * This exists because of a measured false PASS. legal-agent `4c0d688` was red
- * in CI on two test files — `Cannot bundle Node.js built-in "node:sqlite"` —
- * and the sign-off gate signed it off. Same bytes, same lockfile, same
- * hermetic tree: on Node 22 both files fail, on Node 24 both pass, 100% of the
- * time. The runtime was the whole difference, and the gate never saw it because
- * it looked for a pin in exactly two places the fleet does not keep one.
- *
- * None of tax-agent, legal-agent or agent-app has a `.nvmrc`. All three pin
- * `node-version: 22` in the workflow that IS the merge gate. So the pin the
- * gate is replacing was sitting in the file it is replacing, unread.
- *
- * Scope is deliberate: only workflows that trigger on `pull_request`. Those are
- * the merge gate. agent-app's `publish.yml` runs Node 24.18.0 for its release
- * jobs and triggers on push, and reading it would put the gate in permanent
- * conflict with `ci.yml`'s Node 22.
- *
- * Nothing here guesses. An expression (`${{ matrix.node }}`) is not a version,
- * a `node-version-file` that does not exist is not a pin, and two merge-gate
- * workflows on different majors is a question this module cannot answer — each
- * one refuses and names the config key that settles it.
- */
-interface WorkflowNodePin {
-    /** Repo-relative workflow path, for the proof. */
-    readonly file: string;
-    /** The version as written: `22`, `24.18.0`, `v20`. */
-    readonly value: string;
-    /** `node-version`, or the `node-version-file` path it was read through. */
-    readonly via: string;
-}
-/**
- * Does this workflow run on `pull_request`?
- *
- * Both spellings the fleet uses are handled: the block form every workflow here
- * writes, and the inline form (`on: [push, pull_request]`). `on` is quoted in
- * some repos because YAML 1.1 reads a bare `on` as the boolean true, so the
- * quoted keys are matched too.
- */
-declare function triggersOnPullRequest(source: string): boolean;
-/** Node pins declared by every workflow that gates a merge, in filename order. */
-declare function scanMergeGateNodePins(repoRoot: string): WorkflowNodePin[];
-interface ResolvedWorkflowPin {
-    readonly major: number;
-    readonly declared: string;
-    readonly source: string;
-}
-/**
- * One Node major for the whole merge gate, or a refusal that names why not.
- *
- * `majorOf` is injected rather than imported to keep the direction of the
- * dependency one-way: `node-version.ts` owns what a version string means, this
- * module owns where the string lives.
- */
-declare function resolveWorkflowNodePin(repoRoot: string, majorOf: (raw: string) => number | null): ResolvedWorkflowPin | null;
-
-/**
- * The pristine package store, cached on the lockfile so speed is not paid for
- * with a stale module graph.
- *
- * The whole mechanical difference between "green locally" and "red in CI" is
- * that CI installs `--frozen-lockfile` into an isolated store with no
- * `node_modules` and no framework cache, and a local run reuses both. Only one
- * of those two is safe to keep:
- *
- * - `node_modules` and any build/framework cache are **never** reused. They are
- *   what masked the failure this gate exists to catch, and they are recreated
- *   for every run inside a fresh `git worktree`.
- * - The **store** is reused, keyed on the bytes that decide what gets installed.
- *   A pnpm store is content-addressed: every entry is named by the hash of what
- *   is in it, so a reused entry cannot be a different version of a package than
- *   the lockfile asked for. Reusing it skips downloads, not resolution.
- *
- * The key covers every manifest in the tree — lockfile, workspace file, every
- * `package.json`, `.npmrc`. Change any of them and the key changes, so the next
- * run installs into an empty store and pays the honest cold cost. Generations
- * are kept (default 4) rather than one, so moving between a branch and `main`
- * finds both warm instead of thrashing.
- */
-/** Basenames whose bytes decide what an install resolves to. */
-declare const MANIFEST_FILES: readonly string[];
-interface StoreResolution {
-    readonly storeDir: string;
-    readonly cacheKey: string;
-    /** True when a store for this key already had content. */
-    readonly hit: boolean;
-    /** Repo-relative manifest paths, sorted — the inputs to `cacheKey`. */
-    readonly keyedOn: readonly string[];
-    /** Store directories removed by the generation cap. */
-    readonly pruned: readonly string[];
-}
-interface ResolveStoreOptions {
-    /** The clean tree whose manifests are hashed. */
-    readonly treePath: string;
-    readonly cacheDir: string;
-    /** Generations to keep. Default 4. */
-    readonly generations?: number;
-}
-/** Every manifest in the tree, repo-relative and sorted. */
-declare function manifestFiles(treePath: string): string[];
-/** sha256 over each manifest's path and content — order-independent by sorting. */
-declare function manifestCacheKey(treePath: string, files: readonly string[]): string;
-declare function resolveStore(options: ResolveStoreOptions): StoreResolution;
-
-/**
- * Materialize the pristine checkout every step runs against.
- *
- * **The decision, and the measurement behind it: a `git worktree` of HEAD, not
- * a filtered copy.** Both were timed on two real repos on this host:
- *
- * | repo | `git worktree add --detach` | `rsync -a --exclude node_modules --exclude .git` |
- * |---|---|---|
- * | agent-app (931 tracked files) | **0.04 s / 11 MB** | 0.12 s / 25 MB |
- * | legal-agent (753 tracked files) | **0.06 s / 24 MB** | **3.97 s / 2.7 GB** |
- *
- * The 2.7 GB is the argument. The copy carried `build/`, `.react-router/` and
- * `.wrangler/` — generated output and framework caches — because an exclude
- * list is a hand-maintained enumeration of things to leave behind, and it is
- * never complete. A warm Vite cache is precisely what made the `node:sqlite`
- * bundling failure invisible locally while CI saw it, so a materializer that
- * can leak one has defeated its own purpose. `git` already knows what is source
- * and what is generated, and `.gitignore` is that list, maintained by the repo.
- *
- * The overlay on top is what keeps the gate usable before you commit:
- * `source: 'working-tree'` applies `git diff HEAD` (staged and unstaged) as a
- * patch and copies untracked, non-ignored files in. `source: 'head'` verifies
- * exactly the commit that would merge.
- */
-interface MaterializeOptions {
-    readonly repoDir: string;
-    readonly dest: string;
-    readonly source: SignoffSource;
-    /** Gitignored files the run genuinely needs. Missing ones abort. */
-    readonly carryFiles?: readonly string[];
-}
-interface CleanTree extends SignoffRepoFacts {
-    /** Absolute path of the materialized checkout. */
-    readonly path: string;
-}
-declare function repoRootOf(dir: string): string;
-declare function materializeCleanTree(options: MaterializeOptions): CleanTree;
-/** Unregister and delete a materialized tree. */
-declare function removeCleanTree(tree: CleanTree): void;
-
-/**
- * The subprocess primitive every sign-off step runs through.
- *
- * Three properties the gate depends on, none of which `execSync` gives:
- *
- * 1. **Cancellable.** Under fail-fast, a build still running when typecheck
- *    fails is killed rather than waited out — otherwise the "faster than CI"
- *    claim is spent waiting for work whose verdict no longer matters.
- * 2. **Process-group kill.** Steps run through `sh -c`, so killing the shell
- *    leaves `vitest`'s forks and `tsup`'s dts worker orphaned and holding CPU.
- *    The child is spawned as a group leader and the whole group is signalled.
- * 3. **Bounded, non-silent capture.** Output is capped, and when the cap is hit
- *    the elision is stated in the captured text. A gate that quietly drops the
- *    middle of a failure log is a gate that hides the failure.
- */
-interface CommandResult {
-    readonly command: string;
-    readonly cwd: string;
-    readonly exitCode: number;
-    readonly signal: string | null;
-    readonly durationMs: number;
-    readonly output: string;
-    readonly truncated: boolean;
-    readonly timedOut: boolean;
-}
-interface RunCommandOptions {
-    readonly command: string;
-    readonly cwd: string;
-    readonly env?: Readonly<Record<string, string | undefined>>;
-    readonly timeoutMs?: number;
-    readonly signal?: AbortSignal;
-    /** Retained bytes before elision. Default 2 MiB. */
-    readonly maxOutputBytes?: number;
-    /** Grace between SIGTERM and SIGKILL. Default 5 s. */
-    readonly killGraceMs?: number;
-    readonly onData?: (chunk: string) => void;
-}
-/**
- * Run one shell command to completion and report what happened.
- *
- * Never throws on a non-zero exit — a failing step is data, not an exception.
- * It throws only when the process could not be started at all.
- */
-declare function runCommand(options: RunCommandOptions): Promise<CommandResult>;
-
-export { type CleanTree, type CommandResult, DEFAULT_SHUFFLE_ARGS, DEFAULT_SHUFFLE_RUNS, type GraphNode, type LoadSignoffConfigOptions, LoadedSignoffConfig, MANIFEST_FILES, type MaterializeOptions, type NodeVersionRequirement, type ResolveStoreOptions, type ResolvedWorkflowPin, type RunCommandOptions, type RunGraphOptions, SIGNOFF_CONFIG_FILES, SignoffConfig, SignoffRepoFacts, SignoffReport, SignoffSource, SignoffStepResult, SignoffStepSpec, type StepAttemptPlan, type StoreResolution, type TaskOutcome, type TaskStatus, type WorkflowNodePin, assertNodeVersion, assertShuffleArgsReachTheRunner, deriveSeed, deriveSignoffConfig, formatSignoffLine, formatSignoffReport, loadSignoffConfig, manifestCacheKey, manifestFiles, materializeCleanTree, newSeedBase, parseSignoffConfig, peakConcurrency, planAttempts, removeCleanTree, repoRootOf, resolveNodeRequirement, resolveStore, resolveWorkflowNodePin, runCommand, runGraph, scanMergeGateNodePins, triggersOnPullRequest, validateGraph };
+export { type LoadSignoffConfigOptions, LoadedSignoffConfig, SignoffReport, formatSignoffReport, loadSignoffConfig };

package/dist/signoff/index.js

@@ -1,63 +1,11 @@
 import {
-  DEFAULT_SHUFFLE_ARGS,
-  DEFAULT_SHUFFLE_RUNS,
-  MANIFEST_FILES,
-  SIGNOFF_CONFIG_FILES,
-  assertNodeVersion,
-  assertShuffleArgsReachTheRunner,
-  deriveSeed,
-  deriveSignoffConfig,
-  formatSignoffLine,
   formatSignoffReport,
   loadSignoffConfig,
-  manifestCacheKey,
-  manifestFiles,
-  materializeCleanTree,
-  newSeedBase,
-  parseSignoffConfig,
-  peakConcurrency,
-  planAttempts,
-  removeCleanTree,
-  repoRootOf,
-  resolveNodeRequirement,
-  resolveStore,
-  resolveWorkflowNodePin,
-  runCommand,
-  runGraph,
-  runSignoff,
-  scanMergeGateNodePins,
-  triggersOnPullRequest,
-  validateGraph
-} from "../chunk-WD2B6HGY.js";
+  runSignoff
+} from "../chunk-K4RA5T3A.js";
 export {
-  DEFAULT_SHUFFLE_ARGS,
-  DEFAULT_SHUFFLE_RUNS,
-  MANIFEST_FILES,
-  SIGNOFF_CONFIG_FILES,
-  assertNodeVersion,
-  assertShuffleArgsReachTheRunner,
-  deriveSeed,
-  deriveSignoffConfig,
-  formatSignoffLine,
   formatSignoffReport,
   loadSignoffConfig,
-  manifestCacheKey,
-  manifestFiles,
-  materializeCleanTree,
-  newSeedBase,
-  parseSignoffConfig,
-  peakConcurrency,
-  planAttempts,
-  removeCleanTree,
-  repoRootOf,
-  resolveNodeRequirement,
-  resolveStore,
-  resolveWorkflowNodePin,
-  runCommand,
-  runGraph,
-  runSignoff,
-  scanMergeGateNodePins,
-  triggersOnPullRequest,
-  validateGraph
+  runSignoff
 };
 //# sourceMappingURL=index.js.map

package/dist/signoff/proof-cli.js

@@ -5,7 +5,10 @@ import {
   readSignoffKey,
   verifySignoffAtRev,
   verifySignoffProofFile
-} from "../chunk-N3G3FSM4.js";
+} from "../chunk-YXA3U4JZ.js";
+import {
+  invokedAsScript
+} from "../chunk-C3CAYGGQ.js";
 
 // src/signoff/proof-cli.ts
 function parseArgs(argv) {
@@ -82,11 +85,13 @@ ${outcome.hint.map((line) => `    ${line}`).join("\n")}
   }
   return report(outcome, options);
 }
-try {
-  process.exit(main());
-} catch (error) {
-  process.stderr.write(`agent-app-verify-proof failed: ${error instanceof Error ? error.message : String(error)}
+if (invokedAsScript(import.meta.url, process.argv[1])) {
+  try {
+    process.exit(main());
+  } catch (error) {
+    process.stderr.write(`agent-app-verify-proof failed: ${error instanceof Error ? error.message : String(error)}
 `);
-  process.exit(1);
+    process.exit(1);
+  }
 }
 //# sourceMappingURL=proof-cli.js.map

package/dist/signoff/proof-cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/signoff/proof-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-verify-proof` — the command a reader runs to decide whether a\n * commit was signed off, by what, and whether it passed.\n *\n *     agent-app-verify-proof <sha|rev>            # look the proof up by commit\n *     agent-app-verify-proof --file proof.json    # check a proof document\n *\n * Exits 0 only when every check passes. Exits 1 on any failure, and on a commit\n * with no proof at all — \"nobody signed this off\" is a rejection, not a pass.\n */\nimport { formatSignoffSummary, readSignoffKey } from './proof-record'\nimport { formatSignoffVerification, verifySignoffAtRev, verifySignoffProofFile, type SignoffVerification } from './proof-verify'\n\ninterface CliOptions {\n  readonly rev: string\n  readonly file: string | null\n  readonly dir: string\n  readonly keyPath: string | null\n  readonly repo: string | null\n  readonly json: boolean\n}\n\nfunction parseArgs(argv: readonly string[]): CliOptions {\n  let rev = 'HEAD'\n  let file: string | null = null\n  let dir = process.cwd()\n  let keyPath: string | null = null\n  let repo: string | null = null\n  let json = false\n  let sawRev = false\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const arg = argv[index] as string\n    const next = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) throw new Error(`${arg} requires a value`)\n      index += 1\n      return value\n    }\n    if (arg === '--file') file = next()\n    else if (arg === '--dir') dir = next()\n    else if (arg === '--key') keyPath = next()\n    else if (arg === '--repo') repo = next()\n    else if (arg === '--json') json = true\n    else if (arg.startsWith('-')) throw new Error(`unknown flag ${arg}`)\n    else {\n      if (sawRev) throw new Error(`unexpected second revision ${arg}`)\n      rev = arg\n      sawRev = true\n    }\n  }\n  return { rev, file, dir, keyPath, repo, json }\n}\n\nfunction report(result: SignoffVerification, options: CliOptions): number {\n  if (options.json) {\n    process.stdout.write(\n      `${JSON.stringify(\n        {\n          ok: result.ok,\n          commitBinding: result.commitBinding,\n          macChecked: result.macChecked,\n          failures: result.failures,\n          requiredSteps: result.requiredSteps,\n          summary: formatSignoffSummary(result.proof),\n          proof: result.proof,\n        },\n        null,\n        2,\n      )}\\n`,\n    )\n  } else {\n    process.stdout.write(`${formatSignoffVerification(result)}\\n${formatSignoffSummary(result.proof)}\\n`)\n  }\n  return result.ok ? 0 : 1\n}\n\nfunction main(): number {\n  const options = parseArgs(process.argv.slice(2))\n  const key = options.keyPath === null ? undefined : readSignoffKey(options.keyPath)\n\n  if (options.file !== null) {\n    return report(verifySignoffProofFile({ repoDir: options.dir, file: options.file, rev: options.rev, key, expectRepo: options.repo ?? undefined }), options)\n  }\n\n  const outcome = verifySignoffAtRev({ repoDir: options.dir, rev: options.rev, key, expectRepo: options.repo ?? undefined })\n  if (!outcome.found) {\n    process.stdout.write(\n      `NO PROOF ${outcome.commit}\\n  nothing is attached under refs/notes/signoff, and no proof covers this commit's tree\\n  if notes exist upstream, this repo may not fetch them:\\n${outcome.hint.map((line) => `    ${line}`).join('\\n')}\\n`,\n    )\n    return 1\n  }\n  return report(outcome, options)\n}\n\ntry {\n  process.exit(main())\n} catch (error) {\n  process.stderr.write(`agent-app-verify-proof failed: ${error instanceof Error ? error.message : String(error)}\\n`)\n  process.exit(1)\n}\n"],"mappings":";;;;;;;;;;AAuBA,SAAS,UAAU,MAAqC;AACtD,MAAI,MAAM;AACV,MAAI,OAAsB;AAC1B,MAAI,MAAM,QAAQ,IAAI;AACtB,MAAI,UAAyB;AAC7B,MAAI,OAAsB;AAC1B,MAAI,OAAO;AACX,MAAI,SAAS;AAEb,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,MAAM,KAAK,KAAK;AACtB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,OAAM,IAAI,MAAM,GAAG,GAAG,mBAAmB;AAClE,eAAS;AACT,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAU,QAAO,KAAK;AAAA,aACzB,QAAQ,QAAS,OAAM,KAAK;AAAA,aAC5B,QAAQ,QAAS,WAAU,KAAK;AAAA,aAChC,QAAQ,SAAU,QAAO,KAAK;AAAA,aAC9B,QAAQ,SAAU,QAAO;AAAA,aACzB,IAAI,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAAA,SAC9D;AACH,UAAI,OAAQ,OAAM,IAAI,MAAM,8BAA8B,GAAG,EAAE;AAC/D,YAAM;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,EAAE,KAAK,MAAM,KAAK,SAAS,MAAM,KAAK;AAC/C;AAEA,SAAS,OAAO,QAA6B,SAA6B;AACxE,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK;AAAA,QACN;AAAA,UACE,IAAI,OAAO;AAAA,UACX,eAAe,OAAO;AAAA,UACtB,YAAY,OAAO;AAAA,UACnB,UAAU,OAAO;AAAA,UACjB,eAAe,OAAO;AAAA,UACtB,SAAS,qBAAqB,OAAO,KAAK;AAAA,UAC1C,OAAO,OAAO;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA;AAAA,IACH;AAAA,EACF,OAAO;AACL,YAAQ,OAAO,MAAM,GAAG,0BAA0B,MAAM,CAAC;AAAA,EAAK,qBAAqB,OAAO,KAAK,CAAC;AAAA,CAAI;AAAA,EACtG;AACA,SAAO,OAAO,KAAK,IAAI;AACzB;AAEA,SAAS,OAAe;AACtB,QAAM,UAAU,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC/C,QAAM,MAAM,QAAQ,YAAY,OAAO,SAAY,eAAe,QAAQ,OAAO;AAEjF,MAAI,QAAQ,SAAS,MAAM;AACzB,WAAO,OAAO,uBAAuB,EAAE,SAAS,QAAQ,KAAK,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,KAAK,YAAY,QAAQ,QAAQ,OAAU,CAAC,GAAG,OAAO;AAAA,EAC3J;AAEA,QAAM,UAAU,mBAAmB,EAAE,SAAS,QAAQ,KAAK,KAAK,QAAQ,KAAK,KAAK,YAAY,QAAQ,QAAQ,OAAU,CAAC;AACzH,MAAI,CAAC,QAAQ,OAAO;AAClB,YAAQ,OAAO;AAAA,MACb,YAAY,QAAQ,MAAM;AAAA;AAAA;AAAA,EAAuJ,QAAQ,KAAK,IAAI,CAAC,SAAS,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IACvO;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,SAAS,OAAO;AAChC;AAEA,IAAI;AACF,UAAQ,KAAK,KAAK,CAAC;AACrB,SAAS,OAAO;AACd,UAAQ,OAAO,MAAM,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AACjH,UAAQ,KAAK,CAAC;AAChB;","names":[]}
+{"version":3,"sources":["../../src/signoff/proof-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-verify-proof` — the command a reader runs to decide whether a\n * commit was signed off, by what, and whether it passed.\n *\n *     agent-app-verify-proof <sha|rev>            # look the proof up by commit\n *     agent-app-verify-proof --file proof.json    # check a proof document\n *\n * Exits 0 only when every check passes. Exits 1 on any failure, and on a commit\n * with no proof at all — \"nobody signed this off\" is a rejection, not a pass.\n */\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffSummary, readSignoffKey } from './proof-record'\nimport { formatSignoffVerification, verifySignoffAtRev, verifySignoffProofFile, type SignoffVerification } from './proof-verify'\n\ninterface CliOptions {\n  readonly rev: string\n  readonly file: string | null\n  readonly dir: string\n  readonly keyPath: string | null\n  readonly repo: string | null\n  readonly json: boolean\n}\n\nfunction parseArgs(argv: readonly string[]): CliOptions {\n  let rev = 'HEAD'\n  let file: string | null = null\n  let dir = process.cwd()\n  let keyPath: string | null = null\n  let repo: string | null = null\n  let json = false\n  let sawRev = false\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const arg = argv[index] as string\n    const next = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) throw new Error(`${arg} requires a value`)\n      index += 1\n      return value\n    }\n    if (arg === '--file') file = next()\n    else if (arg === '--dir') dir = next()\n    else if (arg === '--key') keyPath = next()\n    else if (arg === '--repo') repo = next()\n    else if (arg === '--json') json = true\n    else if (arg.startsWith('-')) throw new Error(`unknown flag ${arg}`)\n    else {\n      if (sawRev) throw new Error(`unexpected second revision ${arg}`)\n      rev = arg\n      sawRev = true\n    }\n  }\n  return { rev, file, dir, keyPath, repo, json }\n}\n\nfunction report(result: SignoffVerification, options: CliOptions): number {\n  if (options.json) {\n    process.stdout.write(\n      `${JSON.stringify(\n        {\n          ok: result.ok,\n          commitBinding: result.commitBinding,\n          macChecked: result.macChecked,\n          failures: result.failures,\n          requiredSteps: result.requiredSteps,\n          summary: formatSignoffSummary(result.proof),\n          proof: result.proof,\n        },\n        null,\n        2,\n      )}\\n`,\n    )\n  } else {\n    process.stdout.write(`${formatSignoffVerification(result)}\\n${formatSignoffSummary(result.proof)}\\n`)\n  }\n  return result.ok ? 0 : 1\n}\n\nfunction main(): number {\n  const options = parseArgs(process.argv.slice(2))\n  const key = options.keyPath === null ? undefined : readSignoffKey(options.keyPath)\n\n  if (options.file !== null) {\n    return report(verifySignoffProofFile({ repoDir: options.dir, file: options.file, rev: options.rev, key, expectRepo: options.repo ?? undefined }), options)\n  }\n\n  const outcome = verifySignoffAtRev({ repoDir: options.dir, rev: options.rev, key, expectRepo: options.repo ?? undefined })\n  if (!outcome.found) {\n    process.stdout.write(\n      `NO PROOF ${outcome.commit}\\n  nothing is attached under refs/notes/signoff, and no proof covers this commit's tree\\n  if notes exist upstream, this repo may not fetch them:\\n${outcome.hint.map((line) => `    ${line}`).join('\\n')}\\n`,\n    )\n    return 1\n  }\n  return report(outcome, options)\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  try {\n    process.exit(main())\n  } catch (error) {\n    process.stderr.write(`agent-app-verify-proof failed: ${error instanceof Error ? error.message : String(error)}\\n`)\n    process.exit(1)\n  }\n}\n/* c8 ignore stop */\n"],"mappings":";;;;;;;;;;;;;AAwBA,SAAS,UAAU,MAAqC;AACtD,MAAI,MAAM;AACV,MAAI,OAAsB;AAC1B,MAAI,MAAM,QAAQ,IAAI;AACtB,MAAI,UAAyB;AAC7B,MAAI,OAAsB;AAC1B,MAAI,OAAO;AACX,MAAI,SAAS;AAEb,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,MAAM,KAAK,KAAK;AACtB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,OAAM,IAAI,MAAM,GAAG,GAAG,mBAAmB;AAClE,eAAS;AACT,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,SAAU,QAAO,KAAK;AAAA,aACzB,QAAQ,QAAS,OAAM,KAAK;AAAA,aAC5B,QAAQ,QAAS,WAAU,KAAK;AAAA,aAChC,QAAQ,SAAU,QAAO,KAAK;AAAA,aAC9B,QAAQ,SAAU,QAAO;AAAA,aACzB,IAAI,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAAA,SAC9D;AACH,UAAI,OAAQ,OAAM,IAAI,MAAM,8BAA8B,GAAG,EAAE;AAC/D,YAAM;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,EAAE,KAAK,MAAM,KAAK,SAAS,MAAM,KAAK;AAC/C;AAEA,SAAS,OAAO,QAA6B,SAA6B;AACxE,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK;AAAA,QACN;AAAA,UACE,IAAI,OAAO;AAAA,UACX,eAAe,OAAO;AAAA,UACtB,YAAY,OAAO;AAAA,UACnB,UAAU,OAAO;AAAA,UACjB,eAAe,OAAO;AAAA,UACtB,SAAS,qBAAqB,OAAO,KAAK;AAAA,UAC1C,OAAO,OAAO;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA;AAAA,IACH;AAAA,EACF,OAAO;AACL,YAAQ,OAAO,MAAM,GAAG,0BAA0B,MAAM,CAAC;AAAA,EAAK,qBAAqB,OAAO,KAAK,CAAC;AAAA,CAAI;AAAA,EACtG;AACA,SAAO,OAAO,KAAK,IAAI;AACzB;AAEA,SAAS,OAAe;AACtB,QAAM,UAAU,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC/C,QAAM,MAAM,QAAQ,YAAY,OAAO,SAAY,eAAe,QAAQ,OAAO;AAEjF,MAAI,QAAQ,SAAS,MAAM;AACzB,WAAO,OAAO,uBAAuB,EAAE,SAAS,QAAQ,KAAK,MAAM,QAAQ,MAAM,KAAK,QAAQ,KAAK,KAAK,YAAY,QAAQ,QAAQ,OAAU,CAAC,GAAG,OAAO;AAAA,EAC3J;AAEA,QAAM,UAAU,mBAAmB,EAAE,SAAS,QAAQ,KAAK,KAAK,QAAQ,KAAK,KAAK,YAAY,QAAQ,QAAQ,OAAU,CAAC;AACzH,MAAI,CAAC,QAAQ,OAAO;AAClB,YAAQ,OAAO;AAAA,MACb,YAAY,QAAQ,MAAM;AAAA;AAAA;AAAA,EAAuJ,QAAQ,KAAK,IAAI,CAAC,SAAS,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IACvO;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,SAAS,OAAO;AAChC;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AAAA,EACrB,SAAS,OAAO;AACd,YAAQ,OAAO,MAAM,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,CAAI;AACjH,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}