approval-md 0.0.1 → 0.1.0

package/dist/src/cli/setup-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-channel.js","sourceRoot":"","sources":["../../../src/cli/setup-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAE5E,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,UAAU,GAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,OAAO,EACP,iBAAiB,GAKlB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,gFAAgF;AAChF,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,2YAA2Y,CAAC;AAwB1a,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,+EAA+E;AAC/E,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAChF,CAAC;AAQD,iFAAiF;AACjF,KAAK,UAAU,IAAI,CACjB,SAAwB,EACxB,OAAe,EACf,KAAa,EACb,MAAc,EACd,IAAa,EACb,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,QAAQ,GAAG,MAAiC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC9D,MAAM,IAAI,GAAI,OAAmC,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACxD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACjB,CAAC,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE;gBAC1B,CAAC,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;oBACxC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;oBACtB,CAAC,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,qKAAqK,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,kWAAkW,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAEpyB;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,OAAgB,EAChB,IAAe,EACf,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAkC,CAAC;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAErD,gFAAgF;IAChF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,mEAAmE;IACnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,iEAAiE;IACjE,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,2FAA2F;IAC3F,IAAI,OAAO,GAAkB,IAAI,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,aAAa;QACpB,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CACT,yCAAyC,6BAA6B,4BAA4B;YAChG,yFAAyF;YACzF,0FAA0F;YAC1F,iEAAiE;YACjE,oBAAoB,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;YAChG,wBAAwB,IAAI,OAAO;YACnC,0FAA0F;YAC1F,oFAAoF;YACpF,mFAAmF,CACtF,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CACtC,QAAQ,6BAA6B,8DAA8D,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,OAAO,GAAG,6BAA6B,CAAC;YACxC,OAAO,CAAC,GAAG,CACT,WAAW,6BAA6B,gEAAgE,CACzG,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,GAAG,CACT,yDAAyD,IAAI,SAAS,6BAA6B,sBAAsB,CAC1H,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,aAAa;QAC1B,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,YAAY,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,IAAI,CAAC,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CACT,sBAAsB,OAAO,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CAChG,CAAC;YACF,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC3D,CAAC,CAAC,iEAAiE,QAAQ,IAAI;gBAC/E,CAAC,CAAC,8BAA8B,OAAO,8BAA8B,CACxE,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC9E,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,YAAY;QACzB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CACd,OAAO,EACP,KAAK,EACL,yEAAyE,EACzE,QAAQ,CACT;iBACF,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,CAAC;iBACxF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;QACrF,MAAM,YAAY,GAChB,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,aAAa,CAAC;QACpB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,6HAA6H;YAC3H,GAAG,MAAM,qCAAqC,YAAY,0BAA0B;YACpF,+DAA+D,IAAI,KAAK;YACxE,kGAAkG;YAClG,oGAAoG;YACpG,2CAA2C,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAC3F,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,4CAA4C,MAAM,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC3G,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,8DAA8D,IAAI,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC3H,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAW,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,YAAY;QACnB,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,wHAAwH,OAAO,CAAC,OAAO,mGAAmG,CACpQ,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,uDAAuD,6BAA6B,sHAAsH,QAAQ,4CAA4C,CACnR,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,oHAAoH,IAAI,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC1M,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,aAAa,CAAC,IAAY;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC1F,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,0CAA0C,IAAI,CAAC,MAAM,oDAAoD,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3F,OAAO,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,OAAO,GAAG,CAAC;YACT,CAAC,CAAC,oBAAoB,MAAM,CAAC,OAAO,CAAC,wMAAwM;YAC7O,CAAC,CAAC,gQAAgQ,CACrQ,CAAC;QACF,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,gCAAgC,IAAI,uIAAuI;YAC7K,CAAC,CAAC,gFAAgF,CACrF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,UAAU,YAAY;QACzB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,IAAI,SAAS,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAEzB,MAAM,UAAU,GAAI,IAAyB,CAAC,mBAAmB,IAAI,qBAAqB,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,8BAA8B,GAAG,WAAW,aAAa,CAAC,UAAU,CAAC,2KAA2K,CACjP,CAAC;QAEF,IAAI,UAAU,GAAgB,EAAE,CAAC;QACjC,SAAS,CAAC;YACR,2EAA2E;YAC3E,uDAAuD;YACvD,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,SAAS,EACT,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,EACrE,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,gBAAgB,CACrD,CAAC;YACF,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,YAAY,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC7D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC9F,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,sBAAsB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CACpG,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,qHAAqH,CACtH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YACnD,CAAC;YACD,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YACjC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;QACpC,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CACT,gCAAgC,GAAG,OAAO,aAAa,CAAC,UAAU,CAAC,qIAAqI,GAAG,yJAAyJ,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,uCAAuC,OAAO,CAAC,OAAO,0FAA0F,OAAO,qKAAqK,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,OAAO,mIAAmI,CAC72B,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAc,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACnF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;gBAChD,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wBAAwB,GAAG,mBAAmB;gBACrF,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,GAAG;gBAC9E,MAAM,EAAE,iBAAiB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK;gBACvD,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,uBAAuB,EAAE,QAAQ,CAAC;iBACrF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,UAAU,CAAC,MAA8B;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,0BAA0B,MAAM,eAAe,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,SAAS,EACT,OAAO,EACP,IAAI,EACJ,aAAa,EACb,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,sDAAsD,EAAE,EACjF,gBAAgB,CACjB,CAAC;QACF,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,GAAG,GACP,QAAQ,IAAI,IAAI;gBACd,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7E,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,oCAAoC,GAAG,yCAAyC;aACzF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,MAAM,EAAE,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE;QAC3E,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACvB,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,MAAM,YAAY,EAAE;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE;QAC/B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAsC;IAC/D,QAAQ,EAAE;QACR,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAC9C,OAAO,EAAE,wEAAwE;QACjF,MAAM,EAAE,2eAA2e;QACnf,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE;YACT,4EAA4E;YAC5E,gFAAgF;YAChF,EAAE;YACF,gDAAgD;YAChD,EAAE;YACF,0BAA0B;YAC1B,oCAAoC;SACrC;QACD,IAAI,EAAE,2BAA2B;KAClC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAErB,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kEAAkE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClG,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAE5B,MAAM,OAAO,GAAG,KAAK,CACnB,WAAW,IAAI,EAAE,EACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACb,OAAO,EACP,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,CAAC,OAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,MAAM,GAAe,MAAM,iBAAiB,CAAC;QACjD,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,MAAM,EAAE;YACN,KAAK,EAAE,0BAA0B,IAAI,MAAM,KAAK,CAAC,OAAO,GAAG;YAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;KACrD,CAAC,CAAC;IAEH,2DAA2D;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/src/cli/setup-checkpoint.js

@@ -0,0 +1,196 @@
+/**
+ * `approval setup checkpoint` — mint the key a human signs the log with
+ * (APRV-257, the ceremony half of APRV-220).
+ *
+ * APRV-220 built the record, the signature and the verify rule, and left the
+ * key to an operator with a Node REPL. This is the ceremony that replaces the
+ * REPL, and it is shaped like every other `approval setup` subcommand for the
+ * reason that family exists: establishing a secret is an act of the human at
+ * the machine, so the verb refuses a non-terminal stdin and prints the scripted
+ * alternative instead of accepting a pipe.
+ *
+ * ## The two halves go to two different places, and that is the whole design
+ *
+ * The PRIVATE half goes into the vault, under the reserved name
+ * `approval.checkpoint.key`. Encrypted at rest under the passphrase
+ * `vault.passphrase_env` names, which `core/child-env.ts` strips from every
+ * child this runtime spawns (APRV-205), behind a file whose reading classifies
+ * `account.credential`. `core/vault.ts`'s header records why it belongs there
+ * and not in the OS keystore.
+ *
+ * The PUBLIC half is PRINTED, with the exact `audit.checkpoint_keys` line to
+ * paste, and this verb goes no further. **Nothing an agent runs writes that
+ * line**, and nothing this verb runs writes it either: `APPROVAL.md` is
+ * attested, an edit de-attests it until a human re-attests, and a setup wizard
+ * that silently edited an attested policy would be forging the sign-off. The
+ * same rule `setup sampling` already keeps for `audit.sampling_secret_env`.
+ *
+ * So the key is INERT when this verb finishes, and the verb says so: a
+ * checkpoint signed by a key the policy does not list is
+ * `checkpoint-key-unknown`, which is a refusal. The ceremony is two steps and
+ * the second one is the human's.
+ *
+ * ## Rotation appends; it never drops
+ *
+ * `--rotate` mints a second key and prints the list with BOTH in it. Retiring
+ * is a separate, deliberate act (`--retire <fingerprint>`), and it is REFUSED
+ * for any key that signed a checkpoint in the log, naming the seqs that would
+ * stop verifying. That is not caution: removing such a key turns every
+ * checkpoint it signed into `checkpoint-key-unknown` for the life of the log,
+ * which is the cost APRV-220 accepted knowingly when it made an unlisted key a
+ * refusal rather than a shrug. A key that has signed nothing may be dropped,
+ * and this verb prints the line that does it.
+ *
+ * ## Human-only, three times over
+ *
+ * The terminal check (this family's own rule), the `--as human:<id>` gate
+ * (`requireHuman`), and — since APRV-257 — the classification: `approval setup
+ * checkpoint` classifies `policy.core` in `core/command-class.ts`, which the
+ * reference policy holds human-only, so the Claude Code hook denies an agent
+ * running it with `hook-class-human-only` before a process starts. It mints no
+ * new class (SPEC.md §11.1 invariant 9): `policy.core` already exists and
+ * already covers `gate open`, `gate close` and `log checkpoint`.
+ */
+import { checkpointKeyFingerprint, checkpointPolicyOf, CHECKPOINT_KEY_CREDENTIAL, checkpointSignersIn, mintCheckpointKeypair, } from "../core/checkpoint.js";
+import { envFilePathFor, readEnvFile } from "../core/env-file.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { passphraseEnvFor, passphraseFrom, setCredential, vaultExists, vaultPathFor, } from "../core/vault.js";
+import { boolFlag, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK } from "./exit-codes.js";
+import { SETUP_CHECKPOINT_HELP } from "./help.js";
+import { absolute, front, requireHuman, usageError, } from "./setup-common.js";
+import { refusal as renderRefusal, style } from "./style.js";
+/** Flags this subcommand adds to the family's shared table. */
+const EXTRA_FLAGS = {
+    "--rotate": "boolean",
+    "--retire": "string",
+};
+const CHECKPOINT_HINT = (where) => `  # there is no non-interactive form of this ceremony, and that is the point:\n  # a checkpoint key exists to be a key no agent-launched process can mint.\n  # What a script CAN do is establish the passphrase and then leave the key to\n  # a human at a terminal:\n\n  approval setup vault --as human:<id>\n  eval "$(approval env)"        # puts ${where.passphraseEnv} in this shell\n  approval setup checkpoint --as human:<id>\n\n  # then paste the printed public key into APPROVAL.md and attest it:\n  approval policy amend`;
+/** The `audit.checkpoint_keys` block to paste, with every key that must stay. */
+function policyBlock(keys) {
+    return ["  audit:", "    checkpoint_keys:", ...keys.map((key) => `      - ${key}`)].join("\n");
+}
+/** Short form of a fingerprint, for prose. The full value is always printed too. */
+function short(fingerprint) {
+    return fingerprint.slice(0, 12);
+}
+/**
+ * The refusal for an unset passphrase, in `setup adapter`'s two shapes.
+ *
+ * Same diagnosis and the same two repairs, because it is the same fact: the
+ * vault passphrase is read from the environment under the policy's name and
+ * from nowhere else, and an operator meeting this on a second verb should meet
+ * the sentence they already know.
+ */
+function passphraseHint(variable, logPath) {
+    const envPath = envFilePathFor(logPath);
+    const file = readEnvFile(envPath);
+    const hasLine = file.ok && file.entries.some((entry) => entry.key === variable);
+    return hasLine || vaultExists(vaultPathFor(logPath))
+        ? `The passphrase is recorded but not in this shell. Establish it with:\n\n  eval "$(approval env)"`
+        : `Nobody has established a vault passphrase here. Do that first, then evaluate it:\n\n  approval setup vault --as human:<id>\n  eval "$(approval env)"`;
+}
+/**
+ * `--retire <fingerprint>`: print the line that drops a key, or refuse.
+ *
+ * Answered from the LOG and never from a memory of what was rotated when: the
+ * question is "would removing this name change a verdict", and only the records
+ * can answer it. A log that does not verify refuses the retirement too — a
+ * chain nobody can walk cannot be asked which keys signed inside it, and
+ * guessing here would be guessing about the one thing this whole mechanism
+ * exists to make unguessable.
+ */
+function retireKey(streams, fingerprint, configured, logPath, schemaDir) {
+    const wanted = fingerprint.trim().toLowerCase();
+    const matches = configured.filter((key) => {
+        const seen = checkpointKeyFingerprint(key);
+        return seen !== null && (seen === wanted || seen.startsWith(wanted));
+    });
+    if (matches.length === 0) {
+        return usageError(streams, false, `no configured checkpoint key hashes to ${JSON.stringify(fingerprint)}. audit.checkpoint_keys lists ${String(configured.length)} key(s); \`approval doctor\` names their fingerprints. Nothing was changed`, SETUP_CHECKPOINT_HELP);
+    }
+    if (matches.length > 1) {
+        return usageError(streams, false, `${JSON.stringify(fingerprint)} is a prefix of ${String(matches.length)} configured keys; give more of the fingerprint. Nothing was changed`, SETUP_CHECKPOINT_HELP);
+    }
+    const read = readVerifiedRecords(logPath, schemaDir === undefined ? {} : { schemaDir });
+    if (!read.ok) {
+        streams.err(`${renderRefusal(style(), read.code, `${read.message}. A log that does not verify cannot be asked which keys signed inside it, and retiring a key on a guess is how a checkpoint range stops verifying. Nothing was changed`)}\n`);
+        return EXIT_INTEGRITY;
+    }
+    const target = matches[0];
+    const targetFingerprint = checkpointKeyFingerprint(target);
+    const signed = checkpointSignersIn(read.records).get(targetFingerprint) ?? [];
+    if (signed.length > 0) {
+        streams.err(`${renderRefusal(style(), "checkpoint-key-in-use", `key ${targetFingerprint} signed ${String(signed.length)} checkpoint(s) in ${logPath}, at seq ${signed.join(", ")}. Removing it from audit.checkpoint_keys would turn every one of them into checkpoint-key-unknown, which is a REFUSAL and not a warning: \`approval log verify --checkpoints\` would stop passing on a log nobody has touched. Retired keys stay listed forever, which is why the field is a list. Nothing was changed`)}\n`);
+        return EXIT_INTEGRITY;
+    }
+    streams.out(`key ${targetFingerprint} has signed no checkpoint in ${logPath}, so removing it changes no\nverdict. This verb does not edit an attested policy; here is the block to leave\nbehind, through the ceremony that attests it:\n\n${policyBlock(configured.filter((key) => key !== target))}\n\n  approval policy amend\n`);
+    return EXIT_OK;
+}
+/** `approval setup checkpoint` — mint the checkpoint keypair. HUMAN-ONLY. */
+export function commandSetupCheckpoint(argv, streams, cwd, deps = {}) {
+    const outcome = front("checkpoint", argv, streams, cwd, deps, SETUP_CHECKPOINT_HELP, CHECKPOINT_HINT, EXTRA_FLAGS);
+    if (outcome.kind === "handled")
+        return outcome.code;
+    const context = outcome;
+    const extra = context.positionals[0];
+    if (extra !== undefined) {
+        return usageError(streams, false, `unexpected argument ${JSON.stringify(extra)}`, SETUP_CHECKPOINT_HELP);
+    }
+    const human = requireHuman(context.flags, streams, SETUP_CHECKPOINT_HELP, "checkpoint");
+    if (!human.ok)
+        return human.code;
+    const policyFlag = stringFlag(context.flags, "--policy");
+    const dirFlag = stringFlag(context.flags, "--dir");
+    // Resolved against the verb's `cwd` and not the process's, the way every
+    // other path in this family is: a relative `--policy` that landed on a
+    // different file than `front()` loaded would answer questions about a policy
+    // nobody chose.
+    const policyWhere = policyFlag !== null
+        ? { file: absolute(policyFlag, cwd) }
+        : { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
+    const configured = checkpointPolicyOf(policyWhere);
+    const retire = stringFlag(context.flags, "--retire");
+    if (retire !== null) {
+        return retireKey(streams, retire, configured.publicKeys, context.logPath, undefined);
+    }
+    streams.out(`approval setup checkpoint — mints the Ed25519 key you sign the log's head with.\n\nA checkpoint is the one witness an agent process is not supposed to be able to\nproduce: it says a key nobody's runtime holds saw this chain at this head. The\nPRIVATE half goes into ${vaultPathFor(context.logPath)}\nunder ${CHECKPOINT_KEY_CREDENTIAL} and is never printed. The PUBLIC half is\nprinted below for you to put in APPROVAL.md yourself.\n\n`);
+    const rotating = boolFlag(context.flags, "--rotate");
+    if (configured.publicKeys.length > 0 && !rotating) {
+        streams.out(`Your policy already lists ${String(configured.publicKeys.length)} checkpoint key(s). Minting a second one and\nstoring it under ${CHECKPOINT_KEY_CREDENTIAL} REPLACES the private half in the\nvault: checkpoints already signed keep verifying (their key stays listed), but\nthe old private half is gone and nothing in this runtime can print it back.\n\nRe-run with --rotate if that is what you mean.\n`);
+        return EXIT_OK;
+    }
+    if (rotating) {
+        streams.out(`ROTATING. The new key is ADDED to audit.checkpoint_keys and no key is removed:\nretiring one that has signed a checkpoint would de-verify the range it signed,\nwhich is why this verb refuses it (--retire tells you which seqs). The private\nhalf under ${CHECKPOINT_KEY_CREDENTIAL} is replaced, so signatures from here on\nuse the new key.\n\n`);
+        if (!context.prompter.confirm("mint a new checkpoint key and replace the stored private half?")) {
+            streams.out("aborted: nothing was minted, stored, or printed\n");
+            return EXIT_OK;
+        }
+    }
+    // The passphrase, from the SHELL environment under the policy's name. Never
+    // from `.approval/env` directly: SPEC.md §11.1 invariant 7.
+    const variable = passphraseEnvFor(context.load);
+    const passphrase = passphraseFrom(variable, deps.env ?? process.env);
+    if (passphrase === null) {
+        return usageError(streams, false, `${variable} is unset or empty: the vault passphrase is read from that environment variable and from nowhere else, and this verb mints nothing without it. No key was generated and no vault was created.\n\n${passphraseHint(variable, context.logPath)}`, SETUP_CHECKPOINT_HELP);
+    }
+    const pair = mintCheckpointKeypair();
+    const vaultPath = vaultPathFor(context.logPath);
+    const stored = setCredential(vaultPath, passphrase, CHECKPOINT_KEY_CREDENTIAL, pair.privateKey);
+    if (!stored.ok) {
+        streams.err(`${renderRefusal(style(), stored.code, stored.message)}\n`);
+        return stored.code === "vault-io" || stored.code === "vault-write-failed"
+            ? EXIT_IO
+            : EXIT_INTEGRITY;
+    }
+    const keys = [...configured.publicKeys, pair.publicKey];
+    streams.out(`stored the private half in ${vaultPath} under ${CHECKPOINT_KEY_CREDENTIAL}\n  fingerprint ${pair.fingerprint}\n  it was not printed, and there is no verb in this CLI that prints it\n\n`);
+    streams.out(`THE KEY IS INERT UNTIL THE POLICY LISTS IT. A checkpoint signed by a key\naudit.checkpoint_keys does not carry is checkpoint-key-unknown, which is a\nrefusal. This verb does not edit an attested policy — an edited policy is\ninoperative until it is re-attested, and a wizard that edited one would be\nforging the sign-off. Add this block yourself, through the ceremony that\nattests it:\n\n${policyBlock(keys)}\n\n  approval policy amend\n\n`);
+    streams.out(`Then set the cadence, if you want to be asked rather than to remember:\n\n  audit:\n    checkpoint_every: 24h\n\nWith a cadence set, the listener puts one \`CHECKPOINT DUE\` prompt in front of\nyou when one is owed — at most one outstanding, never a nag — and \`approval\ndoctor\`'s checkpoint row says how old the newest one is. A checkpoint that is\ndue is a warning at every layer and never a refusal.\n\n`);
+    streams.out(`IF YOU LOSE THIS KEY: mint another one with --rotate and add it to the list.\nLEAVE THE OLD PUBLIC KEY WHERE IT IS — every checkpoint it signed verifies\nagainst it and only against it, and removing it would refuse a range of a log\nnobody has touched. A lost key costs you future signatures, never past ones.\n`);
+    if (rotating) {
+        streams.out(`\nRotated: key ${short(pair.fingerprint)}… is new, and the ${String(configured.publicKeys.length)} key(s) already listed stay.\n`);
+    }
+    return EXIT_OK;
+}
+//# sourceMappingURL=setup-checkpoint.js.map

package/dist/src/cli/setup-checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-checkpoint.js","sourceRoot":"","sources":["../../../src/cli/setup-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACL,QAAQ,EACR,KAAK,EACL,YAAY,EACZ,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,WAAW,GAA6B;IAC5C,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAkB,EAAU,EAAE,CACrD,4VAA4V,KAAK,CAAC,aAAa,+JAA+J,CAAC;AAEjhB,iFAAiF;AACjF,SAAS,WAAW,CAAC,IAAuB;IAC1C,OAAO,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,oFAAoF;AACpF,SAAS,KAAK,CAAC,WAAmB;IAChC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAChF,OAAO,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,kGAAkG;QACpG,CAAC,CAAC,sJAAsJ,CAAC;AAC7J,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,OAAgB,EAChB,WAAmB,EACnB,UAA6B,EAC7B,OAAe,EACf,SAA6B;IAE7B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,4EAA4E,EAC3M,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qEAAqE,EAC5I,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CACd,KAAK,EAAE,EACP,IAAI,CAAC,IAAI,EACT,GAAG,IAAI,CAAC,OAAO,wKAAwK,CACxL,IAAI,CACN,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;IACpC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,CAAW,CAAC;IACrE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CACd,KAAK,EAAE,EACP,uBAAuB,EACvB,OAAO,iBAAiB,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,OAAO,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wTAAwT,CAC1a,IAAI,CACN,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,OAAO,iBAAiB,gCAAgC,OAAO,kKAAkK,WAAW,CAC1O,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAC3C,+BAA+B,CACjC,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CACnB,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,qBAAqB,EACrB,eAAe,EACf,WAAW,CACZ,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,WAAW,GACf,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,6QAA6Q,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,yBAAyB,sGAAsG,CACrb,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,6BAA6B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,kEAAkE,yBAAyB,oPAAoP,CACjZ,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,8PAA8P,yBAAyB,gEAAgE,CACxV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,gEAAgE,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAwB,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,QAAQ,oMAAoM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAC1P,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,yBAAyB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB;YACvE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,cAAc,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CACT,8BAA8B,SAAS,UAAU,yBAAyB,mBAAmB,IAAI,CAAC,WAAW,6EAA6E,CAC3L,CAAC;IACF,OAAO,CAAC,GAAG,CACT,yYAAyY,WAAW,CAAC,IAAI,CAAC,iCAAiC,CAC5b,CAAC;IACF,OAAO,CAAC,GAAG,CACT,0ZAA0Z,CAC3Z,CAAC;IACF,OAAO,CAAC,GAAG,CACT,yTAAyT,CAC1T,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,kBAAkB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,gCAAgC,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/cli/setup-common.js

@@ -0,0 +1,376 @@
+/**
+ * What every `approval setup` subcommand shares (SPEC.md §5.2, §10.1; APRV-79).
+ *
+ * `setup` began as one file with four subcommands in it. APRV-78 added
+ * `setup adapter <name>` in a file of its own, and it had to reach back into
+ * `cli/setup.ts` for the front matter — which made a cycle: `setup.ts` imports
+ * the adapter verb to dispatch it, and the adapter verb imports `front`,
+ * `requireHuman` and `SetupDeps` back. ESM tolerates that until the day an
+ * initialisation order changes and a `const` at module scope is `undefined` in
+ * one direction only. APRV-79 adds a THIRD such file (`setup-channel.ts`), so
+ * the cycle is broken by extraction rather than tolerated a second time.
+ *
+ * The rule this file exists to enforce, asserted in `tests/layering.test.ts`:
+ *
+ * ```
+ * setup.ts ──┬─> setup-adapter.ts ──┐
+ *            └─> setup-channel.ts ──┴─> setup-common.ts   (and no arrow back)
+ * ```
+ *
+ * What lives here is what more than one of those three needs: the dependency
+ * bag, the keystore seam, the flag table, the front matter (`--help`, the paths,
+ * the policy, the terminal check), the human-only gate, the `.approval/env`
+ * refusal mapping, the service names, and the plaintext-literal offer. What does
+ * NOT live here is anything one subcommand alone uses: the chat picker is
+ * `setup-channel.ts`'s, the manifest hint generator is `setup-adapter.ts`'s, and
+ * the generated-secret path (`storeGeneratedSecret`) stays with `vault` and
+ * `sampling` in `setup.ts`.
+ *
+ * The reasoning for each decision this file encodes — why the token is never
+ * handled by this process, why a generated value may reach an argv and an
+ * operator's own may not, why every subcommand refuses a non-terminal stdin —
+ * is in `cli/setup.ts`'s module doc, which is the family's front page. It is not
+ * repeated here; this file is the mechanism.
+ */
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { userInfo } from "node:os";
+import { isAbsolute, resolve as resolvePathSegments } from "node:path";
+import { HUMAN_ACTOR_ENV, resolveHumanActor } from "../core/attest.js";
+import { defaultSourceRunner, envFilePathFor, } from "../core/env-file.js";
+import { LEGACY_SERVICE_SAMPLING_SECRET, LEGACY_SERVICE_TELEGRAM_TOKEN, LEGACY_SERVICE_VAULT_PASSPHRASE, scopedService, } from "../core/instance.js";
+import { loadPolicy } from "../core/policy-load.js";
+import { telegramChatEnvFor, telegramTokenEnvFor } from "../core/telegram-config.js";
+import { passphraseEnvFor } from "../core/vault.js";
+import { TELEGRAM_DEFAULT_API_BASE } from "../channels/telegram.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { DEFAULT_LOG_PATH, resolvePath } from "./paths.js";
+import { createPrompter } from "./prompt.js";
+import { refusal as renderRefusal, style } from "./style.js";
+import { usageErrorText } from "./usage.js";
+/** The three item names the instance owning `logPath` reads and writes. */
+export function servicesFor(logPath) {
+    return {
+        telegramToken: scopedService(LEGACY_SERVICE_TELEGRAM_TOKEN, logPath),
+        vaultPassphrase: scopedService(LEGACY_SERVICE_VAULT_PASSPHRASE, logPath),
+        samplingSecret: scopedService(LEGACY_SERVICE_SAMPLING_SECRET, logPath),
+    };
+}
+/**
+ * The variable a sampling secret goes into when the policy names none. The
+ * value is stored either way; what the operator is then told to do is add the
+ * `audit.sampling_secret_env` line, because until the POLICY names a variable
+ * the sampler stays off (SPEC.md §5.2) and no amount of environment fixes that.
+ */
+export const DEFAULT_SAMPLING_ENV = "APPROVAL_SAMPLING_SECRET";
+/** The long-poll `getUpdates` asks for, in seconds. */
+export const POLL_TIMEOUT_SECONDS = 10;
+/** doctor's probe timeout, for the calls that answer immediately. */
+export const PROBE_TIMEOUT_MS = 10_000;
+/** The flags every subcommand accepts. One table, so none of them drifts. */
+export const FLAGS = {
+    "--policy": "string",
+    "--dir": "string",
+    "--log": "string",
+    "--api-base": "string",
+    "--as": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/** Is `binary` on PATH? An ENOENT from a spawn is the honest way to ask. */
+function onPath(binary, probeArgs) {
+    const result = spawnSync(binary, probeArgs, { encoding: "utf8", stdio: "ignore" });
+    return result.error?.code !== "ENOENT";
+}
+/** A thrown thing, as a sentence. */
+export function detail(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+/** The real one. Nothing in the test suite constructs it. */
+export const defaultKeystoreRunner = {
+    kind() {
+        if (process.platform === "darwin" && onPath("security", ["help"]))
+            return "keychain";
+        // `secret-tool` with no arguments prints its usage and exits non-zero,
+        // which is all this probe needs: it touches no keyring and unlocks nothing.
+        if (onPath("secret-tool", []))
+            return "secret-service";
+        return "none";
+    },
+    storeGenerated(service, value) {
+        const backend = defaultKeystoreRunner.kind();
+        if (backend === "secret-service") {
+            // `secret-tool store` reads the secret from stdin. One canonical form,
+            // no fallback needed, and the value is never in an argv.
+            const stored = spawnSync("secret-tool", ["store", "--label", service, "approval", service], { encoding: "utf8", input: value });
+            if (stored.error !== undefined) {
+                return { ok: false, message: `secret-tool could not be run: ${detail(stored.error)}` };
+            }
+            return stored.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `secret-tool store exited ${String(stored.status)}` };
+        }
+        if (backend !== "keychain") {
+            return { ok: false, message: "no OS keystore is available on this machine" };
+        }
+        const account = process.env["USER"] ?? userInfo().username;
+        const base = ["add-generic-password", "-a", account, "-s", service, "-U"];
+        // Attempt one: the value on `security`'s STDIN. Its `-w` with no argument
+        // prompts twice (the value and its confirmation), so it is written twice.
+        //
+        // `detached: true` is load-bearing (APRV-94). `security -w` reads the
+        // secret from the CONTROLLING TTY whenever the process has one and ignores
+        // stdin entirely, so from a real terminal the pipe below was never read:
+        // Apple's "password data for new item:" prompt appeared to the human,
+        // whatever they typed was stored, and only the read-back mismatch and the
+        // argv fallback rescued the run (Ctrl-C at that prompt stored nothing at
+        // all). A detached child starts its own session with no controlling
+        // terminal, so `security` has nothing to prompt on and reads the pipe.
+        // spawnSync still waits for it; detaching changes the session, not the
+        // synchrony. The option is absent from the sync typings (undocumented for
+        // spawnSync, honoured by Node's SyncProcessRunner, verified against Node
+        // 24 with a scratch item), hence the widened type. A Node that ignored it
+        // would land on exactly the pre-APRV-94 path, and the read-back below is
+        // what catches that.
+        //
+        // Exit status is NOT trusted as proof of a correct store. A probe against a
+        // scratch keychain (APRV-74 review) showed `security … -w` with piped stdin
+        // exiting 0 while leaving no findable item under the service name (that
+        // was this same tty behaviour, seen from the other side). So every attempt
+        // is followed by a read-back, and success is "the keystore returns exactly
+        // the bytes we generated", nothing less.
+        const pipedOptions = {
+            encoding: "utf8",
+            input: `${value}\n${value}\n`,
+            detached: true,
+        };
+        const piped = spawnSync("security", [...base, "-w"], pipedOptions);
+        if (piped.error === undefined && piped.status === 0) {
+            const back = defaultKeystoreRunner.read(service);
+            if (back.ok && back.value === value)
+                return { ok: true, viaArgv: false };
+        }
+        // Attempt two, for GENERATED VALUES ONLY: the argv form. See `cli/setup.ts`
+        // for exactly what is being accepted here and why it is not extended to a
+        // value the operator brought with them.
+        const argv = spawnSync("security", [...base, "-w", value], { encoding: "utf8" });
+        if (argv.error !== undefined) {
+            return { ok: false, message: `security could not be run: ${detail(argv.error)}` };
+        }
+        if (argv.status === 0) {
+            const back = defaultKeystoreRunner.read(service);
+            if (back.ok && back.value === value)
+                return { ok: true, viaArgv: true };
+            return {
+                ok: false,
+                message: `security add-generic-password reported success for service ${JSON.stringify(service)} but the read-back did not return the stored value; nothing this run wrote can be trusted, inspect the keychain by hand`,
+            };
+        }
+        return {
+            ok: false,
+            message: `security add-generic-password exited ${String(argv.status)} for service ${JSON.stringify(service)}`,
+        };
+    },
+    storePrompted(service) {
+        const backend = defaultKeystoreRunner.kind();
+        if (backend === "keychain") {
+            const account = process.env["USER"] ?? userInfo().username;
+            // `stdio: "inherit"`: Apple's own prompt owns the terminal for the length
+            // of this call, and the value it reads is never seen by this process.
+            const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", service, "-U", "-w"], { stdio: "inherit" });
+            if (result.error !== undefined) {
+                return { ok: false, message: `security could not be run: ${detail(result.error)}` };
+            }
+            return result.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `security add-generic-password exited ${String(result.status)}` };
+        }
+        if (backend === "secret-service") {
+            const result = spawnSync("secret-tool", ["store", "--label", service, "approval", service], { stdio: "inherit" });
+            if (result.error !== undefined) {
+                return { ok: false, message: `secret-tool could not be run: ${detail(result.error)}` };
+            }
+            return result.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `secret-tool store exited ${String(result.status)}` };
+        }
+        return { ok: false, message: "no OS keystore is available on this machine" };
+    },
+    read(service) {
+        const backend = defaultKeystoreRunner.kind();
+        const outcome = backend === "keychain"
+            ? defaultSourceRunner.keychain(service)
+            : defaultSourceRunner.secretService(service);
+        return outcome.ok ? { ok: true, value: outcome.value } : { ok: false, message: outcome.message };
+    },
+};
+/** The `.approval/env` scheme a backend writes. */
+export function schemeFor(kind, service) {
+    if (kind === "keychain")
+        return `keychain:${service}`;
+    if (kind === "secret-service")
+        return `secret-service:${service}`;
+    return null;
+}
+/** The command an operator runs by hand to see that the item is really there. */
+export function retrievalCommand(kind, service) {
+    return kind === "keychain"
+        ? `security find-generic-password -a "$USER" -s ${service} -w`
+        : `secret-tool lookup approval ${service}`;
+}
+/** The command an operator runs by hand to STORE the item, with no value in it. */
+export function storageCommand(kind, service) {
+    return kind === "secret-service"
+        ? `secret-tool store --label ${service} approval ${service}`
+        : `security add-generic-password -a "$USER" -s ${service} -U -w`;
+}
+export function usageError(streams, json, message, helpText) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, helpText));
+    return EXIT_USAGE;
+}
+/**
+ * A refused PROMPT, as one line and no help page (APRV-90).
+ *
+ * The distinction this function exists to draw: {@link usageError} answers a
+ * mangled command line, so it names the shape that line should have had, which
+ * is the thing the operator got wrong. A prompt that was aborted or answered
+ * wrongly five times is not a command line at all — the operator was in a
+ * conversation, the question was on screen, and a usage block under it teaches
+ * nothing. Same exit code (the frozen table is unchanged), one line of output,
+ * and not even the `--help` pointer a usage error carries.
+ */
+export function promptRefusal(streams, message) {
+    streams.err(`approval: ${message}\n`);
+    return EXIT_USAGE;
+}
+export function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+export function refusalExitCode(refusal) {
+    return refusal.code === "env-file-io" || refusal.code === "env-file-mode"
+        ? EXIT_IO
+        : EXIT_INTEGRITY;
+}
+export function emitRefusal(streams, refusal) {
+    streams.err(`${renderRefusal(style(), refusal.code, refusal.message)}\n`);
+    return refusalExitCode(refusal);
+}
+/** The policy's `audit.sampling_secret_env`, or `null`. */
+export function samplingEnvName(load) {
+    if (!load.ok)
+        return null;
+    const declared = load.policy.audit?.sampling_secret_env;
+    return typeof declared === "string" && declared.length > 0 ? declared : null;
+}
+export function hintContextFor(load, envPath, kind, services) {
+    return {
+        envPath,
+        kind,
+        services,
+        passphraseEnv: passphraseEnvFor(load),
+        samplingEnv: samplingEnvName(load) ?? DEFAULT_SAMPLING_ENV,
+        tokenEnv: telegramTokenEnvFor(load),
+        chatEnv: telegramChatEnvFor(load),
+    };
+}
+/**
+ * `--help`, the paths, the policy, the terminal check.
+ *
+ * The terminal check has no `process.stdin.isTTY` in it, deliberately: the real
+ * prompter refuses to construct without one ({@link createPrompter}), so "there
+ * is no prompter" IS "there is no terminal", and a test that injects one has
+ * not bypassed a check that a CI job could also bypass — it has supplied the
+ * human's side of the conversation, which is the only thing a test can honestly
+ * do here.
+ */
+export function front(subcommand, argv, streams, cwd, deps, helpText, nonInteractiveHint, 
+/**
+ * Flags this subcommand accepts on top of the shared table (APRV-110).
+ *
+ * `setup service` is the first subcommand whose subject is not a credential,
+ * so it needs words the other four have no use for (a platform, a unit label,
+ * a log directory). They are passed in rather than added to {@link FLAGS},
+ * because a flag every subcommand silently accepts is a flag an operator will
+ * eventually pass to the one that ignores it.
+ */
+extraFlags = {}) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, { ...FLAGS, ...extraFlags });
+    if (!parsed.ok)
+        return { kind: "handled", code: usageError(streams, json, parsed.message, helpText) };
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${helpText}\n`);
+        return { kind: "handled", code: EXIT_OK };
+    }
+    const logPath = resolvePath(stringFlag(parsed.flags, "--log"), DEFAULT_LOG_PATH, cwd);
+    const envPath = envFilePathFor(logPath);
+    const policyFlag = stringFlag(parsed.flags, "--policy");
+    const dirFlag = stringFlag(parsed.flags, "--dir");
+    const load = loadPolicy(policyFlag !== null
+        ? { file: absolute(policyFlag, cwd) }
+        : { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) });
+    const keystore = deps.keystore ?? defaultKeystoreRunner;
+    const kind = keystore.kind();
+    const services = servicesFor(logPath);
+    const prompter = deps.prompter ?? createPrompter(streams);
+    if (json || prompter === null) {
+        streams.err(`approval: \`approval setup ${subcommand}\` is interactive and ${json
+            ? "--json was given"
+            : "stdin is not a terminal"}. Nothing was written.\n\nIdentity is declared, not proved, so establishing it — and the credentials beside it — is an act of the human at the machine, not something a pipe or a CI job can do. The non-interactive path is explicit, and here it is:\n\n${nonInteractiveHint(hintContextFor(load, envPath, kind, services))}\n\nThen check it with \`approval env --check\`, which prints no values.\n`);
+        return { kind: "handled", code: EXIT_USAGE };
+    }
+    return {
+        kind: "run",
+        flags: parsed.flags,
+        positionals: parsed.positionals,
+        prompter,
+        keystore,
+        backend: kind,
+        load,
+        logPath,
+        envPath,
+        services,
+        apiBase: deps.apiBase ?? stringFlag(parsed.flags, "--api-base") ?? TELEGRAM_DEFAULT_API_BASE,
+        generate: deps.generate ?? (() => randomBytes(32).toString("base64")),
+        pollTimeoutSeconds: deps.pollTimeoutSeconds ?? POLL_TIMEOUT_SECONDS,
+    };
+}
+/** The human-only rule, spelled exactly as `vault set` spells it. */
+export function requireHuman(flags, streams, helpText, verb) {
+    const asFlag = stringFlag(flags, "--as");
+    const actor = resolveHumanActor(asFlag === null ? {} : { actor: asFlag });
+    if (actor !== null)
+        return { ok: true, actor };
+    return {
+        ok: false,
+        code: usageError(streams, false, asFlag === null
+            ? `no human identity: set ${HUMAN_ACTOR_ENV}=human:<id> or pass --as human:<id>. \`approval setup identity\` is the verb that establishes it, and it is the one subcommand exempt from this check`
+            : `--as expects a human identity matching human:<id>, got ${JSON.stringify(asFlag)}; \`approval setup ${verb}\` stores a credential and is human-only`, helpText),
+    };
+}
+// ---------------------------------------------------------------------------
+// The plaintext-literal offer
+// ---------------------------------------------------------------------------
+/**
+ * The plaintext-literal offer, for a machine with no keystore.
+ *
+ * An explicit typed `yes` — not `y`, not Enter — because the whole content of
+ * this question is that the operator understood it. The warning is worded to
+ * match what `approval env --check` will print at them on every run afterwards,
+ * so the two never read as different claims about the same file.
+ */
+export function offerLiteral(streams, prompter, envPath, what) {
+    streams.out(`\nThis machine has no OS keystore this runtime can drive: \`security\` (macOS) and\n\`secret-tool\` (Linux, libsecret) are both absent, so there is nowhere to put the\n${what} except ${envPath} itself, in plaintext.\n\nThat is PERMITTED and it is always reported: \`approval env --check\` will list the\nvariable under PLAINTEXT for as long as the line exists. The file is mode 0600 and\n\`approval init\` gitignores it. A rule people route around is not a control — the\nalternative to writing it here is writing it into a shell profile, where nothing in\nthis runtime can see it to tell you.\n\n`);
+    const answer = prompter.readLine(`type \`yes\` in full to write it in plaintext: `);
+    const typed = (answer ?? "").trim();
+    if (typed === "yes")
+        return true;
+    streams.out("not confirmed: nothing was stored and nothing was written\n");
+    return false;
+}
+//# sourceMappingURL=setup-common.js.map