approval-md 0.0.1 → 0.2.0

package/dist/src/core/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../../src/core/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,EACJ,MAAM,GACP,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,WAAW,GAKZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,UAAU,EAA0B,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AAExC,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAEjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC;;;;OAIG;IACH,wBAAwB;IACxB;;;;;OAKG;IACH,8BAA8B;IAC9B;;;;;;OAMG;IACH,0BAA0B;IAC1B;;;;;OAKG;IACH,yBAAyB;IACzB;;;;;OAKG;IACH,sBAAsB;CACd,CAAC;AAkBX,kFAAkF;AAClF,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvF,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,mFAAmF;AACnF,SAAS,KAAK,CAAC,SAAiB;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,IAAI,GAAG,YAAY,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,cAAc;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,UAAkB;IACrE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE;YACzC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,yBAAyB,CACvC,IAAoB,EACpB,SAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,IAAI,EACJ,iBAAiB,CAAC,IAAI,CAAC,EACvB,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EACtE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAeD,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAChC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,MAAmB;IACpD,OAAO,MAAM,CAAC,KAAK,KAAK,gBAAgB,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAmB;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA+B;IAE/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,0EAA0E;IAC1E,iBAAiB;IACjB,yDAAyD;IACzD,yBAAyB;IACzB,sEAAsE;IACtE,WAAW;IACX;;;;;;;;;;;OAWG;IACH,yBAAyB;IACzB,mCAAmC;IACnC,gBAAgB;IAChB,mEAAmE;IACnE,eAAe;IACf,2EAA2E;IAC3E,aAAa;IACb,6EAA6E;IAC7E,eAAe;CACP,CAAC;AA8CX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,OAAO,GAA4B,EAAE;IAErC,OAAO,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,IAAoB,EACpB,OAAO,GAA4B,EAAE;IAErC,OAAO,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,IAA0C,EAC1C,OAAgC;IAEhC,OAAO,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,CACtD,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,UAAkB,EAClB,KAAa,EACb,IAA0C,EAC1C,OAAgC;IAEhC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,uEAAuE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,0HAA0H;SAChO,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,GAAG,OAAO,mFAAmF;SACvG,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,IAAoB,CAAC;IACzB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,WAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KACtE,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,iDAAiD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC1E,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,QAChC,uIAAuI;aACxI,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACL,2GAA2G;SAC9G,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EACL,+JAA+J;SAClK,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP;QACE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE,gBAAgB;QACvB,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,cAAc;YACnB,UAAU,EAAE,WAAW;YACvB,SAAS;SACV;KACF,EACD;QACE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,GAAG,OAAO,CAAC,MAAM;QACjB,YAAY,EAAE,IAAI,CAAC,IAAI;KACxB,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE;YAC7F,MAAM,EAAE,QAAQ,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,+EAA+E;IAC/E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QACxC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAC1B,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAC3F,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA+B;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,CAAC;YACd,MAAM,EACJ,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,IAAI,gEAAgE,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,4EAA4E;gBAC5M,CAAC,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,yEAAyE,MAAM,CAAC,UAAU,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,2DAA2D;SACzP,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,SAAS,CACd,MAAM,EACN,sBAAsB,EACtB,6BAA6B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iEAAiE,cAAc,wKAAwK,EACtS,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO,SAAS,CACd,MAAM,EACN,yBAAyB,EACzB,6BAA6B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sJAAsJ,EACtO,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CACd,MAAM,EACN,wBAAwB,EACxB,6BAA6B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,SAAS,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mRAAmR,EACzY,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,IACE,CAAC,yBAAyB,CACxB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAC1D,OAAO,CAAC,SAAS,EACjB,SAAS,CACV,EACD,CAAC;YACD,OAAO,SAAS,CACd,MAAM,EACN,8BAA8B,EAC9B,8CAA8C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,4CAA4C,OAAO,CAAC,SAAS,cAAc,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,gDAAgD,EAC9N,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC3B,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CACd,MAAM,EACN,0BAA0B,EAC1B,6BAA6B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uCAAuC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,kBACvH,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,WAAW,MAAM,QACvB,oMAAoM,EACpM,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,QAAQ;QACrB,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC1C,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,gDAAgD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D;YAC7H,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C,MAAM,CAC/H,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAwB,CAAC,GAAG,CAC1D,EAAE;KACV,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,MAAmB,EACnB,IAA2B,EAC3B,OAAe,EACf,WAAiC;IAEjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CACrB,QAAuC,EACvC,OAA+B;IAE/B,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,wEAAwE;AACxE,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3C,CAAC;AAwBD;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAChB,QAAuC,EACvC,OAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvF,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC;IACxB,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAE9B,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QACxC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;QACzB,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,KAAK;QACd,OAAO,EACL,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,6BAA6B,KAAK,CAAC,KAAK,CAAC,mEAAmE,KAAK,CAAC,GAAG,CAAC,gHAAgH;YACxO,CAAC,CAAC,6BAA6B,KAAK,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,mGAAmG;KAC5P,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAuC,EACvC,SAAkB;IAElB,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,UAAU,EAAE,EAAE;YACd,iBAAiB,EAAE,IAAI;YACvB,UAAU,EAAE,mCAAmC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,oCAAoC;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;IAChD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAChD,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB;QACnD,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,OAA+B;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC"}

package/dist/src/core/child-env.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The environment a spawned child receives (APRV-205).
+ *
+ * `approval run` used to call `spawnSync` with no `env` option, so Node handed
+ * the child a copy of the whole session environment: the Telegram bot token,
+ * whatever `vault.passphrase_env` names, every other credential the session was
+ * launched with. APRV-194 closed the direct route by classifying the shell
+ * commands that READ credential material, and it could not close this one,
+ * because the classifier reads `npm test` and the reading happens inside
+ * whatever `npm test` runs. A gate that holds the token while handing it to
+ * every child it launches is custody theatre.
+ *
+ * This module is the scrub. It is the minimal, pre-launch slice of APRV-193's
+ * "spawn starved": it removes credential-bearing variables and does nothing
+ * else. It is not a sandbox — the child keeps the network, the filesystem, and
+ * every other ambient capability of the session, and APRV-193 is where those
+ * are taken away.
+ *
+ * Three rules, in this order:
+ *
+ * 1. A name the granted action's adapter declared in `requiredCredentials`
+ *    (APRV-169) is PASSED. That declaration is static, made by the adapter's own
+ *    code, and reaches this function through nothing a caller typed: a flag that
+ *    could name a variable to keep would be a flag that hands an agent the
+ *    token back.
+ * 2. A name under the credential-bearing prefixes (`APPROVAL_`, `TELEGRAM_`,
+ *    `VAULT_`), less the APRV-194 allowlist of runtime names that hold no
+ *    secret, is REMOVED. The list is imported from `command-class.ts` rather
+ *    than restated, so the classifier and the scrub cannot drift apart.
+ * 3. The name the policy's `vault.passphrase_env` gives is REMOVED, whatever it
+ *    is. The default (`APPROVAL_VAULT_PASSPHRASE`) is already caught by rule 2;
+ *    a deployment that renamed it to something outside the prefixes is the
+ *    reason this rule is separate.
+ *
+ * Everything else passes through untouched. `PATH`, `HOME`, `TMPDIR`, `LANG`,
+ * `NODE_OPTIONS` and the rest of a working environment are not this task's
+ * business, and a scrub that broke `PATH` would be reverted within the day.
+ * That is an allowlist inverted, and the design says so plainly: APRV-193's
+ * §3.4 wants a real allowlist at the SESSION boundary, where the operator
+ * launches the harness; a per-child allowlist here would break every command an
+ * agent legitimately runs.
+ *
+ * What comes back beside the environment is a COUNT. The log records how many
+ * variables were withheld and never which ones, because a name is the half of a
+ * credential this repository can print, and SPEC.md §11.1's raw-secrets
+ * invariant is not satisfied by leaking the other half slowly. The count is
+ * informational: nothing in the gate reads it back, and no decision anywhere
+ * turns on it.
+ */
+import { NON_SECRET_ENV_NAMES, SECRET_ENV_PREFIXES, isSecretEnvName } from "./command-class.js";
+export { NON_SECRET_ENV_NAMES, SECRET_ENV_PREFIXES, isSecretEnvName };
+export interface ChildEnvironmentOptions {
+    /** The environment to start from. Defaults to this process's own. */
+    readonly source?: NodeJS.ProcessEnv;
+    /**
+     * The name the policy's `vault.passphrase_env` gives, when a policy was
+     * loaded. `null` or omitted removes nothing beyond the prefixed family.
+     */
+    readonly passphraseEnv?: string | null;
+    /**
+     * The credential names the granted action's adapter declared in
+     * `requiredCredentials` (APRV-169). Passed through even when they fall under
+     * the credential-bearing prefixes: the adapter said it cannot act without
+     * them, and this is the injection point the design names.
+     */
+    readonly declaredCredentials?: readonly string[];
+}
+export interface ChildEnvironment {
+    /** What to hand `spawnSync`. Never a reference to the source. */
+    readonly env: Record<string, string>;
+    /** How many variables were withheld. Names are deliberately not reported. */
+    readonly stripped: number;
+    /**
+     * The declared names that were present in the source and survived, as a
+     * count, for the same reason: a caller may want to know that injection
+     * happened without learning what was injected.
+     */
+    readonly passed: number;
+}
+/**
+ * Build the environment a granted child gets.
+ *
+ * Total and deterministic: no reads, no throws, and the same source produces
+ * the same answer every time. A variable whose value is `undefined` (Node's
+ * spelling for "unset") is neither copied nor counted, because there was
+ * nothing there to withhold.
+ */
+export declare function childEnvironment(options?: ChildEnvironmentOptions): ChildEnvironment;

package/dist/src/core/child-env.js

@@ -0,0 +1,86 @@
+/**
+ * The environment a spawned child receives (APRV-205).
+ *
+ * `approval run` used to call `spawnSync` with no `env` option, so Node handed
+ * the child a copy of the whole session environment: the Telegram bot token,
+ * whatever `vault.passphrase_env` names, every other credential the session was
+ * launched with. APRV-194 closed the direct route by classifying the shell
+ * commands that READ credential material, and it could not close this one,
+ * because the classifier reads `npm test` and the reading happens inside
+ * whatever `npm test` runs. A gate that holds the token while handing it to
+ * every child it launches is custody theatre.
+ *
+ * This module is the scrub. It is the minimal, pre-launch slice of APRV-193's
+ * "spawn starved": it removes credential-bearing variables and does nothing
+ * else. It is not a sandbox — the child keeps the network, the filesystem, and
+ * every other ambient capability of the session, and APRV-193 is where those
+ * are taken away.
+ *
+ * Three rules, in this order:
+ *
+ * 1. A name the granted action's adapter declared in `requiredCredentials`
+ *    (APRV-169) is PASSED. That declaration is static, made by the adapter's own
+ *    code, and reaches this function through nothing a caller typed: a flag that
+ *    could name a variable to keep would be a flag that hands an agent the
+ *    token back.
+ * 2. A name under the credential-bearing prefixes (`APPROVAL_`, `TELEGRAM_`,
+ *    `VAULT_`), less the APRV-194 allowlist of runtime names that hold no
+ *    secret, is REMOVED. The list is imported from `command-class.ts` rather
+ *    than restated, so the classifier and the scrub cannot drift apart.
+ * 3. The name the policy's `vault.passphrase_env` gives is REMOVED, whatever it
+ *    is. The default (`APPROVAL_VAULT_PASSPHRASE`) is already caught by rule 2;
+ *    a deployment that renamed it to something outside the prefixes is the
+ *    reason this rule is separate.
+ *
+ * Everything else passes through untouched. `PATH`, `HOME`, `TMPDIR`, `LANG`,
+ * `NODE_OPTIONS` and the rest of a working environment are not this task's
+ * business, and a scrub that broke `PATH` would be reverted within the day.
+ * That is an allowlist inverted, and the design says so plainly: APRV-193's
+ * §3.4 wants a real allowlist at the SESSION boundary, where the operator
+ * launches the harness; a per-child allowlist here would break every command an
+ * agent legitimately runs.
+ *
+ * What comes back beside the environment is a COUNT. The log records how many
+ * variables were withheld and never which ones, because a name is the half of a
+ * credential this repository can print, and SPEC.md §11.1's raw-secrets
+ * invariant is not satisfied by leaking the other half slowly. The count is
+ * informational: nothing in the gate reads it back, and no decision anywhere
+ * turns on it.
+ */
+import { NON_SECRET_ENV_NAMES, SECRET_ENV_PREFIXES, isSecretEnvName } from "./command-class.js";
+export { NON_SECRET_ENV_NAMES, SECRET_ENV_PREFIXES, isSecretEnvName };
+/**
+ * Build the environment a granted child gets.
+ *
+ * Total and deterministic: no reads, no throws, and the same source produces
+ * the same answer every time. A variable whose value is `undefined` (Node's
+ * spelling for "unset") is neither copied nor counted, because there was
+ * nothing there to withhold.
+ */
+export function childEnvironment(options = {}) {
+    const source = options.source ?? process.env;
+    const passphraseEnv = typeof options.passphraseEnv === "string" && options.passphraseEnv.length > 0
+        ? options.passphraseEnv
+        : null;
+    const declared = new Set(options.declaredCredentials ?? []);
+    const env = {};
+    let stripped = 0;
+    let passed = 0;
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (declared.has(name)) {
+            env[name] = value;
+            if (isSecretEnvName(name) || name === passphraseEnv)
+                passed += 1;
+            continue;
+        }
+        if (isSecretEnvName(name) || name === passphraseEnv) {
+            stripped += 1;
+            continue;
+        }
+        env[name] = value;
+    }
+    return { env, stripped, passed };
+}
+//# sourceMappingURL=child-env.js.map

package/dist/src/core/child-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../../src/core/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEhG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAgCtE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAA4B,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7C,MAAM,aAAa,GACjB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,aAAa;gBAAE,MAAM,IAAI,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YACpD,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/core/clock.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The write-boundary clock (amended SPEC.md §8, APRV-20 pass two / amendment A2).
+ *
+ * ## Why this module exists
+ *
+ * "Events written through the gate (`approval.*`, `execution.*`, `budget.*`,
+ * `audit.*`, `policy.updated`) have `ts` assigned by the runtime at the write
+ * boundary. Caller-supplied timestamps on these types MUST be refused. Because
+ * TTL judgment and budget windows read `ts`, a party subject to those controls
+ * must never author the clock they are judged by."
+ *
+ * Before this amendment every gate-typed append took `ts` as a positional
+ * parameter, so an agent calling the core (or the CLI's own argv, had a flag
+ * ever been added) could hand the runtime the moment it wished to be judged at:
+ * a timestamp inside a lapsed TTL, or one that placed an authorization outside
+ * the rolling budget window. The refusal the spec asks for is expressed here
+ * **structurally rather than as a check**: the parameter no longer exists on any
+ * public gate/token/execute/attest function, so there is nothing to refuse and
+ * nothing to forget to refuse.
+ *
+ * Determinism is preserved by injection rather than by parameters. Every such
+ * function takes an optional `clock` in its options; the CLI never passes one
+ * (so the real clock is read once, at the write boundary, inside core), and
+ * tests pass a fixed clock so TTL lapse and budget windows stay exercised
+ * without sleeps. A replay still reproduces exactly, because the clock is an
+ * input to the run rather than a read of ambient state inside the hashing path.
+ *
+ * ## The carve-out
+ *
+ * `core/log.ts`'s `appendEvent` still accepts `ts`, deliberately. SPEC.md §8
+ * leaves direct log writers outside the gate free to supply their own
+ * timestamps — an importer replaying a historical log is the obvious case, and
+ * a writer that could not state when something happened could not import
+ * anything. The rule binds the *gate*, which is where a subject of oversight
+ * would benefit from lying.
+ */
+/** A source of RFC 3339 instants. Injected, never read from ambient state. */
+export type Clock = () => string;
+/** The default: the real clock, read at the write boundary and nowhere else. */
+export declare const systemClock: Clock;
+/** Options carrying an injectable clock. Shared by every gate-typed writer. */
+export interface ClockOptions {
+    /**
+     * The clock the runtime stamps this write with. Defaults to
+     * {@link systemClock}. Tests inject a fixed clock; production does not pass
+     * one at all, so the timestamp of a gate event is authored by the runtime and
+     * never by the party being judged (amended SPEC.md §8).
+     */
+    clock?: Clock;
+}
+/** Read the injected clock, or the real one. One line, one place. */
+export declare function tick(options?: ClockOptions): string;

package/dist/src/core/clock.js

@@ -0,0 +1,43 @@
+/**
+ * The write-boundary clock (amended SPEC.md §8, APRV-20 pass two / amendment A2).
+ *
+ * ## Why this module exists
+ *
+ * "Events written through the gate (`approval.*`, `execution.*`, `budget.*`,
+ * `audit.*`, `policy.updated`) have `ts` assigned by the runtime at the write
+ * boundary. Caller-supplied timestamps on these types MUST be refused. Because
+ * TTL judgment and budget windows read `ts`, a party subject to those controls
+ * must never author the clock they are judged by."
+ *
+ * Before this amendment every gate-typed append took `ts` as a positional
+ * parameter, so an agent calling the core (or the CLI's own argv, had a flag
+ * ever been added) could hand the runtime the moment it wished to be judged at:
+ * a timestamp inside a lapsed TTL, or one that placed an authorization outside
+ * the rolling budget window. The refusal the spec asks for is expressed here
+ * **structurally rather than as a check**: the parameter no longer exists on any
+ * public gate/token/execute/attest function, so there is nothing to refuse and
+ * nothing to forget to refuse.
+ *
+ * Determinism is preserved by injection rather than by parameters. Every such
+ * function takes an optional `clock` in its options; the CLI never passes one
+ * (so the real clock is read once, at the write boundary, inside core), and
+ * tests pass a fixed clock so TTL lapse and budget windows stay exercised
+ * without sleeps. A replay still reproduces exactly, because the clock is an
+ * input to the run rather than a read of ambient state inside the hashing path.
+ *
+ * ## The carve-out
+ *
+ * `core/log.ts`'s `appendEvent` still accepts `ts`, deliberately. SPEC.md §8
+ * leaves direct log writers outside the gate free to supply their own
+ * timestamps — an importer replaying a historical log is the obvious case, and
+ * a writer that could not state when something happened could not import
+ * anything. The rule binds the *gate*, which is where a subject of oversight
+ * would benefit from lying.
+ */
+/** The default: the real clock, read at the write boundary and nowhere else. */
+export const systemClock = () => new Date().toISOString();
+/** Read the injected clock, or the real one. One line, one place. */
+export function tick(options = {}) {
+    return (options.clock ?? systemClock)();
+}
+//# sourceMappingURL=clock.js.map

package/dist/src/core/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../../src/core/clock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAU,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAajE,qEAAqE;AACrE,MAAM,UAAU,IAAI,CAAC,OAAO,GAAiB,EAAE;IAC7C,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;AAC1C,CAAC"}