approval-md 0.0.1 → 0.1.0

package/dist/src/core/values.js

@@ -0,0 +1,153 @@
+/**
+ * The values block of `APPROVAL.md` (SPEC.md §5.3), read.
+ *
+ * Everything else in this directory is control: what an agent may do, who
+ * decides, what is sampled. This module reads the other half of the file — the
+ * optional ` ```yaml approval-values ` block in which the operator says what
+ * they value in the work, what they want from the agent, and how they read and
+ * answer. It is the mirror of the journal (SPEC.md §10.1): the journal is the
+ * agent's outlet the gate does not stand in front of, and the values block is
+ * the human's, with the same rule running in both directions, that nothing said
+ * there moves a verdict.
+ *
+ * Three decisions are worth stating here rather than leaving to be inferred.
+ *
+ * **Absence is a declaration, never a default.** A file with no values block is
+ * an operator who has declared no values, which is information. It is not a
+ * missing thing to be repaired, and it is not an invitation to invent a neutral
+ * middle. So the result has three states rather than two: present, absent, and
+ * unreadable, and `ok: true, present: false` is the absent one. Surfaces render
+ * it in the words SPEC.md §5.3 fixes, so a session can tell "nothing was
+ * declared" from "I did not look".
+ *
+ * **Two blocks fail.** One file, at most one values block, exactly as the policy
+ * block is exactly one. Two blocks are two answers to one question, and a reader
+ * that silently took the first would be choosing between two things a human
+ * wrote, on the strength of document order.
+ *
+ * **A values failure never fails the policy.** Enforcement fails closed on the
+ * policy block because an unparseable permission document is one whose author
+ * believes constraints are in force that are not. Nothing about that argument
+ * carries here, because this block is not enforcement: no routing, class match,
+ * sampling draw, budget, token or execution decision reads it (SPEC.md §11.1
+ * invariant 10, pinned by `tests/values-inert.test.ts`). Failing closed on a
+ * malformed values block would convert a typo into an all-manual repository, and
+ * would buy no safety at all in exchange. The two blocks are therefore parsed
+ * and judged independently, on paths that share only the fence splitter, and
+ * this module never calls the policy loader's parse path.
+ *
+ * ## Determinism
+ *
+ * {@link loadValues} is a pure function of the file bytes on disk plus the
+ * schema directory. No clock, no network, no randomness, no cross-call caching,
+ * and no throw: every failure is a result.
+ */
+import { readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { scanFences } from "./md-fence.js";
+// `POLICY_FILENAMES` is the SPEC.md §5 filename precedence and `parseHardenedYaml`
+// is the ONE hardened YAML parse in this codebase (see its own doc comment). The
+// values block lives inside the same file and deserves the same parser stance,
+// so both are borrowed rather than replicated. Nothing else is: the policy
+// loader's own parse path is untouched from here, in either direction.
+import { POLICY_FILENAMES, parseHardenedYaml } from "./policy-load.js";
+import { validate } from "./validate.js";
+/** Info string that marks the OPTIONAL values block (SPEC.md §5.3). */
+export const VALUES_INFO_STRING = "yaml approval-values";
+function errorMessage(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+function sourceOf(path) {
+    return { path, filename: basename(path) };
+}
+function failure(code, message, source, errors) {
+    const base = { ok: false, code, message };
+    const withSource = source === undefined ? base : { ...base, source };
+    return errors === undefined ? withSource : { ...withSource, errors };
+}
+/**
+ * Find the file the values block would live in.
+ *
+ * The SAME discovery `loadPolicy` performs, and the same precedence
+ * ({@link POLICY_FILENAMES}: `APPROVAL.md`, then `APPROVALS.md`), because it is
+ * the same file. It is written out here rather than imported because the policy
+ * loader's is private to it, and a values reader that reached into the policy
+ * loader for anything but a shared constant is the coupling this module exists
+ * without.
+ */
+function resolveFile(options) {
+    if (options.file !== undefined) {
+        try {
+            return { path: options.file, text: readFileSync(options.file, "utf8") };
+        }
+        catch (cause) {
+            return failure("file-missing", `policy file ${options.file} could not be read: ${errorMessage(cause)}`, sourceOf(options.file));
+        }
+    }
+    const dir = options.dir ?? process.cwd();
+    for (const filename of POLICY_FILENAMES) {
+        const candidate = join(dir, filename);
+        try {
+            return { path: candidate, text: readFileSync(candidate, "utf8") };
+        }
+        catch {
+            continue;
+        }
+    }
+    return failure("file-missing", `no policy file found in ${dir} (looked for ${POLICY_FILENAMES.join(", ")})`);
+}
+/**
+ * Extract, parse, and validate the values block of an already-read file.
+ *
+ * The bytes-in form of {@link loadValues}, for the caller that has the file in
+ * hand (a doctor run reading it once for several questions) and for the tests
+ * that build a file variant without touching a disk. Nothing here touches the
+ * filesystem, nothing throws, and `path` is used only for messages and for
+ * {@link ValuesSource}.
+ */
+export function loadValuesText(path, text, options = {}) {
+    const source = sourceOf(path);
+    const scan = scanFences(text, VALUES_INFO_STRING);
+    if (scan.unterminated) {
+        // CommonMark would close an unterminated fence at EOF. This does not, for
+        // the reason the policy loader does not: the truncated tail of a block is
+        // indistinguishable from a complete one, and a values block that says half
+        // of what a human wrote is worse than one that says it could not be read.
+        return failure("unterminated-fence", `${path}: unterminated \`\`\`${VALUES_INFO_STRING} fence (no closing fence before end of file)`, source);
+    }
+    if (scan.blocks.length === 0) {
+        // The declaration of absence. Not a failure, and not a default.
+        return { ok: true, present: false, source };
+    }
+    if (scan.blocks.length > 1) {
+        return failure("multiple-blocks", `${path}: found ${String(scan.blocks.length)} \`\`\`${VALUES_INFO_STRING} fenced blocks; SPEC.md §5.3 allows at most one`, source);
+    }
+    const parsed = parseHardenedYaml(scan.blocks[0] ?? "", {
+        subject: "values YAML",
+        tagContext: "a values block",
+    });
+    if (!parsed.ok)
+        return failure("yaml-error", `${path}: ${parsed.message}`, source);
+    // `exactOptionalPropertyTypes` is on, so the key is omitted rather than
+    // passed as `undefined`: the validator's own default is not the same thing as
+    // an explicit `undefined` schema directory.
+    const validated = validate("values", parsed.value, options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir });
+    if (!validated.ok) {
+        return failure("schema-invalid", `${path}: the values block does not match values.schema.json`, source, validated.errors);
+    }
+    return { ok: true, present: true, values: parsed.value, source };
+}
+/**
+ * Find `APPROVAL.md`, and read its values block if it has one.
+ *
+ * Discovery plus {@link loadValuesText}. A file that cannot be read at all is
+ * `file-missing`, which is the only failure code here that says nothing about
+ * the block: there was no file to hold one.
+ */
+export function loadValues(options = {}) {
+    const resolved = resolveFile(options);
+    if ("ok" in resolved)
+        return resolved;
+    return loadValuesText(resolved.path, resolved.text, options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir });
+}
+//# sourceMappingURL=values.js.map

package/dist/src/core/values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../src/core/values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAE/D,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AA4EzD,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,OAAO,CACd,IAA2B,EAC3B,OAAe,EACf,MAAqB,EACrB,MAA0B;IAE1B,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;IACrE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,OAA0B;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,cAAc,EACd,eAAe,OAAO,CAAC,IAAI,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,EACvE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,EACd,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAO,GAA2B,EAAE;IAEpC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAElD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,OAAO,CACZ,oBAAoB,EACpB,GAAG,IAAI,wBAAwB,kBAAkB,8CAA8C,EAC/F,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,gEAAgE;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,iBAAiB,EACjB,GAAG,IAAI,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,kBAAkB,iDAAiD,EACzH,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;QACrD,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAEnF,wEAAwE;IACxE,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,SAAS,GAAG,QAAQ,CACxB,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,IAAI,sDAAsD,EAC7D,MAAM,EACN,SAAS,CAAC,MAAM,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAe,EAAE,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,cAAc,CACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC"}