@webpieces/pr-gate 0.4.719 → 0.4.721

package/src/scripts/workflow/authorization-context-resolver.d.ts

@@ -1,63 +0,0 @@
-import { AuthorizationContext, DiffScope } from '@webpieces/rules-config';
-import { AiBranchName } from './git-readAiBranchName';
-import { DiffBasisResolver } from './diff-basis';
-/**
- * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the
- * authorization commands cannot answer it two different ways.
- *
- * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a
- * repeated three-liner:
- *
- * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the
- *                           set a reviewer is pointed at — and, here, the set an approval's scope is
- *                           checked against, which would let terraform-adjacent files slip inside a
- *                           "terraform only" grant.
- * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
- *                           deletes a migration or an auth check changed exactly what a checklist exists
- *                           to catch.
- *
- * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
- */
-export declare class ReviewChangedFiles {
-    private readonly diffScope;
-    constructor(diffScope: DiffScope);
-    /**
-     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.
-     *
-     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions
-     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and
-     * untracked work, so an approval could be verified against a scope the working tree has already grown
-     * out of.
-     */
-    since(repoRoot: string, base: string): string[];
-}
-/**
- * Gathers the ONE branch state a human authorization is minted against and verified against: the stable
- * feature name, the fork point, and the changed-file set.
- *
- * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a
- * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying
- * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the
- * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same
- * unit of work as the review it authorizes.
- *
- * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
- */
-export declare class AuthorizationContextResolver {
-    private readonly aiBranchName;
-    private readonly diffBasisResolver;
-    private readonly changedFiles;
-    constructor(aiBranchName: AiBranchName, diffBasisResolver: DiffBasisResolver, changedFiles: ReviewChangedFiles);
-    resolve(repoRoot: string): AuthorizationContext;
-    /**
-     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one
-     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a
-     * readable handful rather than one glob per folder.
-     *
-     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived
-     * default matters anyway, because the alternative to a good default is a human who types `**` to get
-     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible
-     * to reach by accident.
-     */
-    proposeScopePaths(changedFiles: readonly string[]): string[];
-}

package/src/scripts/workflow/authorization-context-resolver.js

@@ -1,107 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthorizationContextResolver = exports.ReviewChangedFiles = void 0;
-const tslib_1 = require("tslib");
-const rules_config_1 = require("@webpieces/rules-config");
-const inversify_1 = require("inversify");
-const git_readAiBranchName_1 = require("./git-readAiBranchName");
-const diff_basis_1 = require("./diff-basis");
-/**
- * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the
- * authorization commands cannot answer it two different ways.
- *
- * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a
- * repeated three-liner:
- *
- * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the
- *                           set a reviewer is pointed at — and, here, the set an approval's scope is
- *                           checked against, which would let terraform-adjacent files slip inside a
- *                           "terraform only" grant.
- * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
- *                           deletes a migration or an auth check changed exactly what a checklist exists
- *                           to catch.
- *
- * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
- */
-let ReviewChangedFiles = class ReviewChangedFiles {
-    diffScope;
-    constructor(diffScope) {
-        this.diffScope = diffScope;
-    }
-    /**
-     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.
-     *
-     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions
-     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and
-     * untracked work, so an approval could be verified against a scope the working tree has already grown
-     * out of.
-     */
-    since(repoRoot, base) {
-        if (base === '')
-            return [];
-        const opts = new rules_config_1.ChangedFilesOptions();
-        opts.tsOnly = false;
-        opts.includeDeletions = true;
-        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);
-    }
-};
-exports.ReviewChangedFiles = ReviewChangedFiles;
-exports.ReviewChangedFiles = ReviewChangedFiles = tslib_1.__decorate([
-    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
-    tslib_1.__metadata("design:paramtypes", [rules_config_1.DiffScope])
-], ReviewChangedFiles);
-/**
- * Gathers the ONE branch state a human authorization is minted against and verified against: the stable
- * feature name, the fork point, and the changed-file set.
- *
- * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a
- * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying
- * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the
- * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same
- * unit of work as the review it authorizes.
- *
- * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
- */
-let AuthorizationContextResolver = class AuthorizationContextResolver {
-    aiBranchName;
-    diffBasisResolver;
-    changedFiles;
-    constructor(aiBranchName, diffBasisResolver, changedFiles) {
-        this.aiBranchName = aiBranchName;
-        this.diffBasisResolver = diffBasisResolver;
-        this.changedFiles = changedFiles;
-    }
-    resolve(repoRoot) {
-        const base = this.diffBasisResolver.resolve(repoRoot).base;
-        return new rules_config_1.AuthorizationContext(this.aiBranchName.getFeatureName(), base, this.changedFiles.since(repoRoot, base));
-    }
-    /**
-     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one
-     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a
-     * readable handful rather than one glob per folder.
-     *
-     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived
-     * default matters anyway, because the alternative to a good default is a human who types `**` to get
-     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible
-     * to reach by accident.
-     */
-    proposeScopePaths(changedFiles) {
-        const globs = new Set();
-        for (const file of changedFiles) {
-            const parts = file.split('/');
-            if (parts.length === 1)
-                globs.add(file);
-            else
-                globs.add(`${parts.slice(0, Math.min(2, parts.length - 1)).join('/')}/**`);
-        }
-        return [...globs].sort();
-    }
-};
-exports.AuthorizationContextResolver = AuthorizationContextResolver;
-exports.AuthorizationContextResolver = AuthorizationContextResolver = tslib_1.__decorate([
-    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
-    tslib_1.__metadata("design:paramtypes", [git_readAiBranchName_1.AiBranchName,
-        diff_basis_1.DiffBasisResolver,
-        ReviewChangedFiles])
-], AuthorizationContextResolver);
-//# sourceMappingURL=authorization-context-resolver.js.map

package/src/scripts/workflow/authorization-context-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization-context-resolver.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/authorization-context-resolver.ts"],"names":[],"mappings":";;;;AAAA,0DAA+F;AAC/F,yCAA2D;AAC3D,iEAAsD;AACtD,6CAAiD;AAEjD;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACE;IAA7B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD;;;;;;;OAOG;IACH,KAAK,CAAC,QAAgB,EAAE,IAAY;QAChC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,kCAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;CACJ,CAAA;AAlBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEG,wBAAS;GADxC,kBAAkB,CAkB9B;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAEhB;IACA;IACA;IAHrB,YACqB,YAA0B,EAC1B,iBAAoC,EACpC,YAAgC;QAFhC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAoB;IAClD,CAAC;IAEJ,OAAO,CAAC,QAAgB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC3D,OAAO,IAAI,mCAAoB,CAC3B,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;OASG;IACH,iBAAiB,CAAC,YAA+B;QAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;gBACnC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAA;AAhCY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGF,mCAAY;QACP,8BAAiB;QACtB,kBAAkB;GAJ5C,4BAA4B,CAgCxC","sourcesContent":["import { AuthorizationContext, ChangedFilesOptions, DiffScope } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { DiffBasisResolver } from './diff-basis';\n\n/**\n * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the\n * authorization commands cannot answer it two different ways.\n *\n * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a\n * repeated three-liner:\n *\n * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the\n *                           set a reviewer is pointed at — and, here, the set an approval's scope is\n *                           checked against, which would let terraform-adjacent files slip inside a\n *                           \"terraform only\" grant.\n * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that\n *                           deletes a migration or an auth check changed exactly what a checklist exists\n *                           to catch.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReviewChangedFiles {\n    constructor(private readonly diffScope: DiffScope) {}\n\n    /**\n     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.\n     *\n     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions\n     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and\n     * untracked work, so an approval could be verified against a scope the working tree has already grown\n     * out of.\n     */\n    since(repoRoot: string, base: string): string[] {\n        if (base === '') return [];\n        const opts = new ChangedFilesOptions();\n        opts.tsOnly = false;\n        opts.includeDeletions = true;\n        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);\n    }\n}\n\n/**\n * Gathers the ONE branch state a human authorization is minted against and verified against: the stable\n * feature name, the fork point, and the changed-file set.\n *\n * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a\n * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying\n * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the\n * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same\n * unit of work as the review it authorizes.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class AuthorizationContextResolver {\n    constructor(\n        private readonly aiBranchName: AiBranchName,\n        private readonly diffBasisResolver: DiffBasisResolver,\n        private readonly changedFiles: ReviewChangedFiles,\n    ) {}\n\n    resolve(repoRoot: string): AuthorizationContext {\n        const base = this.diffBasisResolver.resolve(repoRoot).base;\n        return new AuthorizationContext(\n            this.aiBranchName.getFeatureName(), base, this.changedFiles.since(repoRoot, base));\n    }\n\n    /**\n     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one\n     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a\n     * readable handful rather than one glob per folder.\n     *\n     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived\n     * default matters anyway, because the alternative to a good default is a human who types `**` to get\n     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible\n     * to reach by accident.\n     */\n    proposeScopePaths(changedFiles: readonly string[]): string[] {\n        const globs = new Set<string>();\n        for (const file of changedFiles) {\n            const parts = file.split('/');\n            if (parts.length === 1) globs.add(file);\n            else globs.add(`${parts.slice(0, Math.min(2, parts.length - 1)).join('/')}/**`);\n        }\n        return [...globs].sort();\n    }\n}\n"]}

package/src/scripts/wp-authorize.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import 'reflect-metadata';

package/src/scripts/wp-authorize.js

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-require("reflect-metadata");
-const inversify_1 = require("inversify");
-const rules_config_1 = require("@webpieces/rules-config");
-const pr_gate_app_1 = require("./pr-gate-app");
-// Composition root for the HUMAN-ONLY authorization mint. It reads every prompt from /dev/tty, so an
-// agent's Bash tool cannot drive it — see AuthorizeCommand for why that gate, and not stdin, is the
-// mechanism. The matching harness `permissions.deny` entry exists to make the refusal legible rather
-// than a hang.
-(0, rules_config_1.runMain)(async () => {
-    // autobind self-binds every @injectable(Singleton) tooling class (replaces the buildProviderModule registry scan)
-    const container = new inversify_1.Container({ autobind: true });
-    const args = container.get(rules_config_1.CliArgs).parse(new rules_config_1.CliUsage('wp-authorize', 'HUMAN ONLY: sign an authorization letting one review checklist be overridden on this branch.', [
-        new rules_config_1.CliFlag('--checklist', 'REQUIRED. The checklist id (= reviewer subagent name) being authorized.', true),
-        new rules_config_1.CliFlag('--gate', 'Optional. The specific gate inside that checklist this approval is for.', true),
-        new rules_config_1.CliFlag('--hours', 'Optional. How long the approval lives (default 4). An approval is for today\'s work.', true),
-    ]));
-    container.get(pr_gate_app_1.PrGateApp).authorize(args);
-});
-//# sourceMappingURL=wp-authorize.js.map

package/src/scripts/wp-authorize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"wp-authorize.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/wp-authorize.ts"],"names":[],"mappings":";;;AACA,4BAA0B;AAC1B,yCAAsC;AACtC,0DAA8E;AAC9E,+CAA0C;AAE1C,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,eAAe;AACf,IAAA,sBAAO,EAAC,KAAK,IAAmB,EAAE;IAC9B,kHAAkH;IAClH,MAAM,SAAS,GAAG,IAAI,qBAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,sBAAO,CAAC,CAAC,KAAK,CAAC,IAAI,uBAAQ,CAClD,cAAc,EACd,8FAA8F,EAC9F;QACI,IAAI,sBAAO,CAAC,aAAa,EAAE,yEAAyE,EAAE,IAAI,CAAC;QAC3G,IAAI,sBAAO,CAAC,QAAQ,EAAE,yEAAyE,EAAE,IAAI,CAAC;QACtG,IAAI,sBAAO,CAAC,SAAS,EAAE,sFAAsF,EAAE,IAAI,CAAC;KACvH,CACJ,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,CAAC,uBAAS,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport 'reflect-metadata';\nimport { Container } from 'inversify';\nimport { runMain, CliArgs, CliUsage, CliFlag } from '@webpieces/rules-config';\nimport { PrGateApp } from './pr-gate-app';\n\n// Composition root for the HUMAN-ONLY authorization mint. It reads every prompt from /dev/tty, so an\n// agent's Bash tool cannot drive it — see AuthorizeCommand for why that gate, and not stdin, is the\n// mechanism. The matching harness `permissions.deny` entry exists to make the refusal legible rather\n// than a hang.\nrunMain(async (): Promise<void> => {\n    // autobind self-binds every @injectable(Singleton) tooling class (replaces the buildProviderModule registry scan)\n    const container = new Container({ autobind: true });\n    const args = container.get(CliArgs).parse(new CliUsage(\n        'wp-authorize',\n        'HUMAN ONLY: sign an authorization letting one review checklist be overridden on this branch.',\n        [\n            new CliFlag('--checklist', 'REQUIRED. The checklist id (= reviewer subagent name) being authorized.', true),\n            new CliFlag('--gate', 'Optional. The specific gate inside that checklist this approval is for.', true),\n            new CliFlag('--hours', 'Optional. How long the approval lives (default 4). An approval is for today\\'s work.', true),\n        ],\n    ));\n    container.get(PrGateApp).authorize(args);\n});\n"]}

package/src/scripts/wp-check-auth.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import 'reflect-metadata';

package/src/scripts/wp-check-auth.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-require("reflect-metadata");
-const inversify_1 = require("inversify");
-const rules_config_1 = require("@webpieces/rules-config");
-const pr_gate_app_1 = require("./pr-gate-app");
-// Composition root for the AGENT-runnable half: read-only verification of the approvals a human signed
-// with wp-authorize. This is the only channel a reviewer may accept an override from.
-(0, rules_config_1.runMain)(async () => {
-    // autobind self-binds every @injectable(Singleton) tooling class (replaces the buildProviderModule registry scan)
-    const container = new inversify_1.Container({ autobind: true });
-    const args = container.get(rules_config_1.CliArgs).parse(new rules_config_1.CliUsage('wp-check-auth', 'Verify (never mint) the human authorizations recorded for this branch. Read-only; agents run this.', [new rules_config_1.CliFlag('--checklist', 'Only report this checklist id. Omitted: report every approval on the branch.', true)]));
-    container.get(pr_gate_app_1.PrGateApp).checkAuth(args);
-});
-//# sourceMappingURL=wp-check-auth.js.map

package/src/scripts/wp-check-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"wp-check-auth.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/wp-check-auth.ts"],"names":[],"mappings":";;;AACA,4BAA0B;AAC1B,yCAAsC;AACtC,0DAA8E;AAC9E,+CAA0C;AAE1C,uGAAuG;AACvG,sFAAsF;AACtF,IAAA,sBAAO,EAAC,KAAK,IAAmB,EAAE;IAC9B,kHAAkH;IAClH,MAAM,SAAS,GAAG,IAAI,qBAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,sBAAO,CAAC,CAAC,KAAK,CAAC,IAAI,uBAAQ,CAClD,eAAe,EACf,oGAAoG,EACpG,CAAC,IAAI,sBAAO,CAAC,aAAa,EAAE,8EAA8E,EAAE,IAAI,CAAC,CAAC,CACrH,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,CAAC,uBAAS,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport 'reflect-metadata';\nimport { Container } from 'inversify';\nimport { runMain, CliArgs, CliUsage, CliFlag } from '@webpieces/rules-config';\nimport { PrGateApp } from './pr-gate-app';\n\n// Composition root for the AGENT-runnable half: read-only verification of the approvals a human signed\n// with wp-authorize. This is the only channel a reviewer may accept an override from.\nrunMain(async (): Promise<void> => {\n    // autobind self-binds every @injectable(Singleton) tooling class (replaces the buildProviderModule registry scan)\n    const container = new Container({ autobind: true });\n    const args = container.get(CliArgs).parse(new CliUsage(\n        'wp-check-auth',\n        'Verify (never mint) the human authorizations recorded for this branch. Read-only; agents run this.',\n        [new CliFlag('--checklist', 'Only report this checklist id. Omitted: report every approval on the branch.', true)],\n    ));\n    container.get(PrGateApp).checkAuth(args);\n});\n"]}