agentwrangler 0.1.0

package/dist/evidence/create-scratch.js

@@ -0,0 +1,542 @@
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import Database from "better-sqlite3";
+import { EvidenceBoundaryError, assertScratchBoundary, readFileIdentity, resolveProspectivePath, sameFileIdentity, } from "./common/boundary.js";
+import { canonicalJson, sha256Bytes, sha256File } from "./common/canonical.js";
+import { assertDatabaseIntegrity, openQueryOnlyDb } from "./common/sqlite.js";
+import { writeApprovedStateJson } from "./common/state.js";
+export const SCRATCH_APPROVAL_VERSION = "wave2-scratch-approval-v1";
+export const SCRATCH_PREPARATION_VERSION = "wave2-scratch-preparation-v2";
+const REPOSITORY_ROOT = path.resolve(fileURLToPath(new URL("../../", import.meta.url)));
+const SHA256_RE = /^[0-9a-f]{64}$/u;
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function assertExactKeys(value, expected, code) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+        throw new EvidenceBoundaryError(code);
+    }
+}
+function requiredNonEmptyString(value, code) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new EvidenceBoundaryError(code);
+    return value;
+}
+function parseApprovalManifest(value) {
+    if (!isRecord(value))
+        throw new EvidenceBoundaryError("approval_manifest_invalid");
+    assertExactKeys(value, [
+        "version",
+        "sourceDbPath",
+        "scratchDbPath",
+        "scratchStatePath",
+        "repositories",
+        "privateArtifactParentAcknowledged",
+    ], "approval_manifest_unknown_or_missing_key");
+    if (value.version !== SCRATCH_APPROVAL_VERSION) {
+        throw new EvidenceBoundaryError("approval_manifest_version_mismatch");
+    }
+    if (value.privateArtifactParentAcknowledged !== true) {
+        throw new EvidenceBoundaryError("private_artifact_parent_not_acknowledged");
+    }
+    if (!Array.isArray(value.repositories)) {
+        throw new EvidenceBoundaryError("approval_repository_allowlist_invalid");
+    }
+    const workspaceIds = new Set();
+    const reportAliases = new Set();
+    const canonicalRepositories = new Set();
+    const repositories = value.repositories.map((entry) => {
+        if (!isRecord(entry))
+            throw new EvidenceBoundaryError("approval_repository_invalid");
+        assertExactKeys(entry, ["workspaceId", "owner", "repo", "reportAlias"], "approval_repository_unknown_or_missing_key");
+        const parsed = {
+            workspaceId: requiredNonEmptyString(entry.workspaceId, "approval_workspace_id_invalid"),
+            owner: requiredNonEmptyString(entry.owner, "approval_owner_invalid"),
+            repo: requiredNonEmptyString(entry.repo, "approval_repo_invalid"),
+            reportAlias: requiredNonEmptyString(entry.reportAlias, "approval_report_alias_invalid"),
+        };
+        if (workspaceIds.has(parsed.workspaceId)) {
+            throw new EvidenceBoundaryError("approval_workspace_duplicate");
+        }
+        if (reportAliases.has(parsed.reportAlias)) {
+            throw new EvidenceBoundaryError("approval_report_alias_duplicate");
+        }
+        const canonicalRepository = `${parsed.owner.toLowerCase()}/${parsed.repo.toLowerCase()}`;
+        if (canonicalRepositories.has(canonicalRepository)) {
+            throw new EvidenceBoundaryError("approval_repository_duplicate");
+        }
+        workspaceIds.add(parsed.workspaceId);
+        reportAliases.add(parsed.reportAlias);
+        canonicalRepositories.add(canonicalRepository);
+        return parsed;
+    });
+    return {
+        version: SCRATCH_APPROVAL_VERSION,
+        sourceDbPath: requiredNonEmptyString(value.sourceDbPath, "approval_source_path_invalid"),
+        scratchDbPath: requiredNonEmptyString(value.scratchDbPath, "approval_scratch_path_invalid"),
+        scratchStatePath: requiredNonEmptyString(value.scratchStatePath, "approval_state_path_invalid"),
+        repositories,
+        privateArtifactParentAcknowledged: true,
+    };
+}
+function comparisonPath(value) {
+    const normalized = path.normalize(value).replace(/[\\/]+$/u, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function isWithin(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== "..");
+}
+function exactFileIdentity(left, right) {
+    return left.device === right.device && left.inode === right.inode && left.size === right.size;
+}
+function readCanonicalSourceRepositoryRows(sourceDbPath) {
+    const db = openQueryOnlyDb(sourceDbPath);
+    try {
+        const rows = db
+            .prepare(`SELECT workspace_id, repo_owner, repo_name
+           FROM workspaces
+          ORDER BY workspace_id COLLATE BINARY`)
+            .all();
+        for (const row of rows) {
+            if (typeof row.workspace_id !== "string" ||
+                row.workspace_id.length === 0 ||
+                (row.repo_owner !== null && typeof row.repo_owner !== "string") ||
+                (row.repo_name !== null && typeof row.repo_name !== "string")) {
+                throw new EvidenceBoundaryError("source_repository_mapping_invalid");
+            }
+        }
+        return canonicalJson(rows);
+    }
+    finally {
+        db.close();
+    }
+}
+function readApproval(approvalManifestPath, approvalSha256, repositoryRoot) {
+    if (!SHA256_RE.test(approvalSha256))
+        throw new EvidenceBoundaryError("approval_sha256_invalid");
+    if (!fs.existsSync(approvalManifestPath)) {
+        throw new EvidenceBoundaryError("approval_manifest_missing");
+    }
+    const resolvedPath = fs.realpathSync.native(approvalManifestPath);
+    const stat = fs.statSync(resolvedPath);
+    if (!stat.isFile())
+        throw new EvidenceBoundaryError("approval_manifest_not_file");
+    if (isWithin(repositoryRoot, resolvedPath)) {
+        throw new EvidenceBoundaryError("approval_manifest_inside_repository");
+    }
+    const bytes = fs.readFileSync(resolvedPath);
+    if (sha256Bytes(bytes) !== approvalSha256) {
+        throw new EvidenceBoundaryError("approval_sha256_mismatch");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throw new EvidenceBoundaryError("approval_manifest_invalid_json");
+    }
+    return parseApprovalManifest(parsed);
+}
+function assertApprovalPaths(approval, boundary) {
+    let approvedSource;
+    try {
+        approvedSource = fs.realpathSync.native(approval.sourceDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("approval_source_path_unresolvable");
+    }
+    const approvedScratch = resolveProspectivePath(approval.scratchDbPath);
+    const approvedState = resolveProspectivePath(approval.scratchStatePath);
+    if (comparisonPath(approvedSource) !== comparisonPath(boundary.sourceDbPath) ||
+        comparisonPath(approvedScratch) !== comparisonPath(boundary.scratchDbPath) ||
+        comparisonPath(approvedState) !== comparisonPath(boundary.scratchStatePath)) {
+        throw new EvidenceBoundaryError("approval_path_binding_mismatch");
+    }
+}
+function planApprovedRepoMap(db, approved, permitUnmappedAdditions) {
+    const rows = db
+        .prepare(`SELECT workspace_id, repo_owner, repo_name
+         FROM workspaces
+        ORDER BY workspace_id COLLATE BINARY`)
+        .all();
+    const live = new Map();
+    for (const row of rows) {
+        if (typeof row.workspace_id !== "string" || row.workspace_id.length === 0) {
+            throw new EvidenceBoundaryError("invalid_workspace_identity");
+        }
+        const ownerMissing = row.repo_owner === null;
+        const repoMissing = row.repo_name === null;
+        if (ownerMissing !== repoMissing)
+            throw new EvidenceBoundaryError("partial_repository_mapping");
+        if (live.has(row.workspace_id))
+            throw new EvidenceBoundaryError("duplicate_db_workspace");
+        if (ownerMissing) {
+            live.set(row.workspace_id, null);
+            continue;
+        }
+        if (typeof row.repo_owner !== "string" ||
+            row.repo_owner.length === 0 ||
+            typeof row.repo_name !== "string" ||
+            row.repo_name.length === 0) {
+            throw new EvidenceBoundaryError("invalid_repository_mapping");
+        }
+        live.set(row.workspace_id, { owner: row.repo_owner, repo: row.repo_name });
+    }
+    const result = [...approved].sort((left, right) => left.workspaceId < right.workspaceId ? -1 : left.workspaceId > right.workspaceId ? 1 : 0);
+    const approvedByWorkspace = new Map(result.map((entry) => [entry.workspaceId, entry]));
+    const additions = [];
+    for (const [workspaceId, dbMapping] of live) {
+        const entry = approvedByWorkspace.get(workspaceId);
+        if (dbMapping === null) {
+            if (entry !== undefined)
+                additions.push(entry);
+            continue;
+        }
+        if (entry === undefined || dbMapping.owner !== entry.owner || dbMapping.repo !== entry.repo) {
+            throw new EvidenceBoundaryError("repository_allowlist_not_exact");
+        }
+    }
+    for (const entry of result) {
+        if (!live.has(entry.workspaceId)) {
+            throw new EvidenceBoundaryError("repository_allowlist_unknown_workspace");
+        }
+        if (live.get(entry.workspaceId) === null && !permitUnmappedAdditions) {
+            throw new EvidenceBoundaryError("repository_overlay_verification_failed");
+        }
+    }
+    return { repoMap: result, additions };
+}
+function applyApprovedRepoMapOverlay(partialDbPath, approved, duringMappingOverlay) {
+    const db = new Database(partialDbPath, { fileMustExist: true });
+    try {
+        const plan = planApprovedRepoMap(db, approved, true);
+        const update = db.prepare(`UPDATE workspaces
+          SET repo_owner = ?, repo_name = ?
+        WHERE workspace_id = ? AND repo_owner IS NULL AND repo_name IS NULL`);
+        const apply = db.transaction(() => {
+            let updatedN = 0;
+            for (const entry of plan.additions) {
+                const result = update.run(entry.owner, entry.repo, entry.workspaceId);
+                if (result.changes !== 1)
+                    throw new EvidenceBoundaryError("repository_overlay_race");
+                const verified = db
+                    .prepare("SELECT repo_owner, repo_name FROM workspaces WHERE workspace_id = ?")
+                    .get(entry.workspaceId);
+                if (verified?.repo_owner !== entry.owner || verified.repo_name !== entry.repo) {
+                    throw new EvidenceBoundaryError("repository_overlay_readback_failed");
+                }
+                updatedN += 1;
+                duringMappingOverlay?.(updatedN);
+            }
+        });
+        apply();
+        if (db.pragma("journal_mode", { simple: true }) === "wal") {
+            const checkpoint = db.pragma("wal_checkpoint(TRUNCATE)");
+            if (checkpoint.length !== 1 || checkpoint[0]?.busy !== 0 || checkpoint[0]?.log !== 0) {
+                throw new EvidenceBoundaryError("repository_overlay_checkpoint_failed");
+            }
+        }
+        if (db.pragma("journal_mode = DELETE", { simple: true }) !== "delete") {
+            throw new EvidenceBoundaryError("repository_overlay_journal_mode_failed");
+        }
+    }
+    finally {
+        db.close();
+    }
+}
+function reservePartialPath(scratchDbPath) {
+    const parent = path.dirname(scratchDbPath);
+    for (let attempt = 0; attempt < 10; attempt++) {
+        const partialPath = path.join(parent, `.${path.basename(scratchDbPath)}.${process.pid}.${randomUUID()}.partial`);
+        try {
+            const descriptor = fs.openSync(partialPath, "wx", 0o600);
+            fs.closeSync(descriptor);
+            return partialPath;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    throw new EvidenceBoundaryError("partial_reservation_failed");
+}
+function retainedFailure(error, fallback) {
+    const base = error instanceof EvidenceBoundaryError ? error.code : fallback;
+    return new EvidenceBoundaryError(`${base}_partial_retained`);
+}
+function privateArtifactBoundary() {
+    return process.platform === "win32"
+        ? "WINDOWS_INHERITED_PARENT_ACL_ACKNOWLEDGED"
+        : "POSIX_OWNER_ONLY_MODES_REQUESTED";
+}
+export function parseCreateScratchArgs(args) {
+    const allowed = new Set([
+        "--source-db",
+        "--scratch-db",
+        "--scratch-state",
+        "--approval-manifest",
+        "--approval-sha256",
+    ]);
+    const values = new Map();
+    for (let index = 0; index < args.length; index += 2) {
+        const flag = args[index];
+        const value = args[index + 1];
+        if (flag === undefined || !allowed.has(flag)) {
+            throw new EvidenceBoundaryError("unknown_cli_argument");
+        }
+        if (values.has(flag))
+            throw new EvidenceBoundaryError("duplicate_cli_argument");
+        if (value === undefined || value.length === 0 || value.startsWith("--")) {
+            throw new EvidenceBoundaryError("missing_cli_value");
+        }
+        values.set(flag, value);
+    }
+    const sourceDbPath = values.get("--source-db");
+    const scratchDbPath = values.get("--scratch-db");
+    const scratchStatePath = values.get("--scratch-state");
+    const approvalManifestPath = values.get("--approval-manifest");
+    const approvalSha256 = values.get("--approval-sha256");
+    if (sourceDbPath === undefined ||
+        scratchDbPath === undefined ||
+        scratchStatePath === undefined ||
+        approvalManifestPath === undefined ||
+        approvalSha256 === undefined) {
+        throw new EvidenceBoundaryError("missing_required_cli_argument");
+    }
+    return {
+        sourceDbPath,
+        scratchDbPath,
+        scratchStatePath,
+        approvalManifestPath,
+        approvalSha256,
+    };
+}
+export async function createApprovedScratchCopy(input, options = {}) {
+    const now = options.now ?? new Date();
+    if (!Number.isFinite(now.getTime()))
+        throw new EvidenceBoundaryError("invalid_clock");
+    const repositoryRoot = fs.realpathSync.native(options.repositoryRoot ?? REPOSITORY_ROOT);
+    const approval = readApproval(input.approvalManifestPath, input.approvalSha256, repositoryRoot);
+    const boundary = assertScratchBoundary({
+        sourceDbPath: input.sourceDbPath,
+        scratchDbPath: input.scratchDbPath,
+        scratchStatePath: input.scratchStatePath,
+        repositoryRoot,
+    });
+    assertApprovalPaths(approval, boundary);
+    const sourceShaBefore = await sha256File(boundary.sourceDbPath);
+    const sourceRepositoryRowsBefore = readCanonicalSourceRepositoryRows(boundary.sourceDbPath);
+    fs.mkdirSync(path.dirname(boundary.scratchDbPath), { recursive: true });
+    const partialDbPath = reservePartialPath(boundary.scratchDbPath);
+    let backup;
+    let source;
+    try {
+        source = openQueryOnlyDb(boundary.sourceDbPath);
+        backup = await source.backup(partialDbPath);
+    }
+    catch (error) {
+        throw retainedFailure(error, "online_backup_failed");
+    }
+    finally {
+        source?.close();
+    }
+    await options.testHooks?.afterBackup?.(partialDbPath);
+    let verifiedSourceIdentity;
+    try {
+        verifiedSourceIdentity = readFileIdentity(boundary.sourceDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("source_identity_changed_partial_retained");
+    }
+    if (!exactFileIdentity(boundary.sourceIdentity, verifiedSourceIdentity)) {
+        throw new EvidenceBoundaryError("source_identity_changed_partial_retained");
+    }
+    if (backup.remainingPages !== 0) {
+        throw new EvidenceBoundaryError("online_backup_incomplete_partial_retained");
+    }
+    const reservedPartialIdentity = readFileIdentity(partialDbPath);
+    if (sameFileIdentity(verifiedSourceIdentity, reservedPartialIdentity)) {
+        throw new EvidenceBoundaryError("partial_aliases_source_partial_retained");
+    }
+    try {
+        applyApprovedRepoMapOverlay(partialDbPath, approval.repositories, options.testHooks?.duringMappingOverlay);
+    }
+    catch (error) {
+        throw retainedFailure(error, "repository_overlay_failed");
+    }
+    const partialIdentity = readFileIdentity(partialDbPath);
+    const firstSha = await sha256File(partialDbPath);
+    let repoMap;
+    const scratch = openQueryOnlyDb(partialDbPath);
+    try {
+        assertDatabaseIntegrity(scratch);
+        repoMap = planApprovedRepoMap(scratch, approval.repositories, false).repoMap;
+    }
+    catch (error) {
+        throw retainedFailure(error, "scratch_verification_failed");
+    }
+    finally {
+        scratch.close();
+    }
+    const verifiedSha = await sha256File(partialDbPath);
+    if (verifiedSha !== firstSha) {
+        throw new EvidenceBoundaryError("scratch_sha_changed_during_verify_partial_retained");
+    }
+    await options.testHooks?.beforePublish?.(partialDbPath);
+    let sourceShaAfter;
+    try {
+        sourceShaAfter = await sha256File(boundary.sourceDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("source_bytes_changed_partial_retained");
+    }
+    let finalSourceIdentity;
+    try {
+        finalSourceIdentity = readFileIdentity(boundary.sourceDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("source_bytes_changed_partial_retained");
+    }
+    if (sourceShaAfter !== sourceShaBefore ||
+        !exactFileIdentity(verifiedSourceIdentity, finalSourceIdentity)) {
+        throw new EvidenceBoundaryError("source_bytes_changed_partial_retained");
+    }
+    let sourceRepositoryRowsAfter;
+    try {
+        sourceRepositoryRowsAfter = readCanonicalSourceRepositoryRows(boundary.sourceDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("source_mapping_changed_partial_retained");
+    }
+    if (sourceRepositoryRowsAfter !== sourceRepositoryRowsBefore) {
+        throw new EvidenceBoundaryError("source_mapping_changed_partial_retained");
+    }
+    try {
+        fs.linkSync(partialDbPath, boundary.scratchDbPath);
+    }
+    catch (error) {
+        const code = error.code;
+        throw new EvidenceBoundaryError(code === "EEXIST"
+            ? "scratch_publish_target_exists_partial_retained"
+            : "scratch_publish_failed_partial_retained");
+    }
+    let publishedSha;
+    try {
+        publishedSha = await sha256File(boundary.scratchDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("published_scratch_hash_failed_partial_and_scratch_retained");
+    }
+    if (publishedSha !== verifiedSha) {
+        throw new EvidenceBoundaryError("published_scratch_sha_mismatch_partial_and_scratch_retained");
+    }
+    try {
+        fs.unlinkSync(partialDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("partial_unlink_failed_partial_and_scratch_retained");
+    }
+    let scratchIdentity;
+    try {
+        scratchIdentity = readFileIdentity(boundary.scratchDbPath);
+    }
+    catch {
+        throw new EvidenceBoundaryError("published_scratch_identity_failed_scratch_retained");
+    }
+    if (!exactFileIdentity(partialIdentity, scratchIdentity)) {
+        throw new EvidenceBoundaryError("published_scratch_identity_mismatch_scratch_retained");
+    }
+    try {
+        await options.testHooks?.beforeState?.();
+        fs.mkdirSync(path.dirname(boundary.scratchStatePath), { recursive: true });
+        fs.mkdirSync(boundary.scratchStatePath, { recursive: false, mode: 0o700 });
+    }
+    catch {
+        throw new EvidenceBoundaryError("scratch_state_create_failed_scratch_published_state_may_be_retained");
+    }
+    let repoMapWrite;
+    try {
+        repoMapWrite = writeApprovedStateJson(boundary.scratchStatePath, "repo-map.json", repoMap);
+    }
+    catch {
+        throw new EvidenceBoundaryError("repo_map_write_failed_scratch_published_state_retained");
+    }
+    const artifactBoundary = privateArtifactBoundary();
+    const manifest = {
+        version: SCRATCH_PREPARATION_VERSION,
+        createdAt: now.toISOString(),
+        approval: {
+            version: SCRATCH_APPROVAL_VERSION,
+            sha256: input.approvalSha256,
+            privateArtifactParentAcknowledged: true,
+        },
+        source: {
+            path: boundary.sourceDbPath,
+            identity: verifiedSourceIdentity,
+            access: "explicit-readonly-online-backup",
+        },
+        scratch: {
+            path: boundary.scratchDbPath,
+            identity: scratchIdentity,
+            sha256: verifiedSha,
+            integrity: "ok",
+            publication: "atomic-hard-link-no-replace",
+        },
+        state: {
+            path: boundary.scratchStatePath,
+            cleanup: "manual-only",
+            privateArtifactBoundary: artifactBoundary,
+        },
+        repositoryMap: {
+            file: "repo-map.json",
+            sha256: repoMapWrite.sha256,
+            mappedWorkspaceN: repoMap.length,
+        },
+        backup: { totalPages: backup.totalPages, remainingPages: 0 },
+        prohibitedOperations: [
+            "migrations",
+            "github-reads",
+            "transcript-reads",
+            "reset-replay-vacuum-prune-delete",
+        ],
+    };
+    let manifestWrite;
+    try {
+        await options.testHooks?.beforeManifestWrite?.();
+        manifestWrite = writeApprovedStateJson(boundary.scratchStatePath, "preparation-manifest.json", manifest);
+    }
+    catch {
+        throw new EvidenceBoundaryError("manifest_write_failed_scratch_published_state_retained");
+    }
+    return {
+        scratchDbSha256: verifiedSha,
+        repoMapSha256: repoMapWrite.sha256,
+        manifestSha256: manifestWrite.sha256,
+        approvalSha256: input.approvalSha256,
+        mappedWorkspaceN: repoMap.length,
+        totalPages: backup.totalPages,
+        privateArtifactBoundary: artifactBoundary,
+    };
+}
+async function main() {
+    try {
+        const result = await createApprovedScratchCopy(parseCreateScratchArgs(process.argv.slice(2)));
+        process.stdout.write(`${canonicalJson({ status: "CREATED", ...result })}\n`);
+    }
+    catch (error) {
+        const code = error instanceof EvidenceBoundaryError ? error.code : "unexpected_failure";
+        process.stderr.write(`${canonicalJson({ status: "REFUSED", failure: code })}\n`);
+        process.exitCode = 1;
+    }
+}
+const invokedPath = process.argv[1];
+if (invokedPath !== undefined &&
+    pathToFileURL(path.resolve(invokedPath)).href ===
+        pathToFileURL(fileURLToPath(import.meta.url)).href) {
+    void main();
+}

package/dist/evidence/d7/cli.js

@@ -0,0 +1,113 @@
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { loadApprovedEvidenceInput, publishApprovedOutput, } from "../common/approved-input.js";
+import { EvidenceBoundaryError } from "../common/boundary.js";
+import { canonicalJson } from "../common/canonical.js";
+import { assertD7AsOf, measureD7ForwardCoverage } from "./measure.js";
+const FLAGS = [
+    "approval-manifest",
+    "approval-sha256",
+    "scratch-preparation-manifest",
+    "scratch-preparation-sha256",
+    "scratch-db",
+    "approved-scratch-db-sha256",
+    "repo-map",
+    "repo-map-sha256",
+    "scratch-state",
+    "scratch-verification",
+    "live-db",
+    "repository-root",
+    "source-commit",
+    "as-of",
+    "window-days",
+    "out",
+];
+function fail(code) {
+    throw new Error(code);
+}
+function parse(argv) {
+    if (argv.length !== FLAGS.length * 2)
+        fail("d7_cli_argument_missing");
+    const values = new Map();
+    for (let i = 0; i < argv.length; i += 2) {
+        const flag = argv[i];
+        const value = argv[i + 1];
+        if (flag === undefined || value === undefined || !flag.startsWith("--") || value.length === 0)
+            fail("d7_cli_argument_invalid");
+        const key = flag.slice(2);
+        if (!FLAGS.includes(key) || values.has(key))
+            fail("d7_cli_argument_unknown_or_duplicate");
+        values.set(key, value);
+    }
+    if (values.size !== FLAGS.length)
+        fail("d7_cli_argument_missing");
+    return values;
+}
+function required(values, key) {
+    return values.get(key) ?? fail("d7_cli_argument_missing");
+}
+function approved(values) {
+    return {
+        approvalManifestPath: required(values, "approval-manifest"),
+        approvalManifestSha256: required(values, "approval-sha256"),
+        preparationManifestPath: required(values, "scratch-preparation-manifest"),
+        preparationManifestSha256: required(values, "scratch-preparation-sha256"),
+        scratchDbPath: required(values, "scratch-db"),
+        scratchDbSha256: required(values, "approved-scratch-db-sha256"),
+        repoMapPath: required(values, "repo-map"),
+        repoMapSha256: required(values, "repo-map-sha256"),
+        scratchStatePath: required(values, "scratch-state"),
+        scratchVerificationPath: required(values, "scratch-verification"),
+        liveDbPath: required(values, "live-db"),
+        repositoryRoot: required(values, "repository-root"),
+    };
+}
+export async function runD7CoverageCli(argv, dependencies = {}) {
+    const stdout = dependencies.stdout ?? ((line) => process.stdout.write(`${line}\n`));
+    const stderr = dependencies.stderr ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const values = parse(argv);
+        if (required(values, "window-days") !== "30")
+            fail("d7_window_days_invalid");
+        const sourceCommit = required(values, "source-commit");
+        if (!/^[0-9a-f]{40}$/u.test(sourceCommit))
+            fail("d7_source_commit_invalid");
+        assertD7AsOf(required(values, "as-of"));
+        const loaded = await (dependencies.loadApproved ?? loadApprovedEvidenceInput)(approved(values));
+        const db = loaded.openVerifiedScratchDb();
+        try {
+            const report = measureD7ForwardCoverage({
+                db,
+                repositories: loaded.repositories,
+                scratchDbSha256: loaded.scratchDbSha256,
+                repoMapSha256: loaded.repoMapSha256,
+                sourceCommit,
+                asOf: required(values, "as-of"),
+                windowDays: 30,
+            });
+            const publication = (dependencies.publish ?? publishApprovedOutput)(loaded, required(values, "out"), `${canonicalJson(report)}\n`);
+            stdout(canonicalJson({ status: report.status, reportSha256: publication.sha256 }));
+        }
+        finally {
+            db.close();
+        }
+        return 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "unexpected_failure";
+        stderr(canonicalJson({
+            status: "REFUSED",
+            failure: error instanceof EvidenceBoundaryError || /^[a-z0-9_]+$/u.test(message)
+                ? message
+                : "unexpected_failure",
+        }));
+        return 1;
+    }
+}
+const invokedPath = process.argv[1];
+if (invokedPath !== undefined &&
+    pathToFileURL(path.resolve(invokedPath)).href ===
+        pathToFileURL(fileURLToPath(import.meta.url)).href)
+    void runD7CoverageCli(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    });