approval-md 0.0.1 → 0.2.0

package/dist/src/cli/coverage.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `approval coverage` — observed side effects, joined to the verified log
+ * (APRV-245, SPEC.md §10.1).
+ *
+ * ## What it answers
+ *
+ * "Here is everything the witnesses outside this runtime say happened, and here
+ * is what the log says about each one." Nothing more: the join is
+ * `core/coverage.ts`, the witnesses are `core/coverage-sources/`, and this file
+ * is argument parsing, source selection, and the rendering of a table.
+ *
+ * ## Why it exits 0 with gaps
+ *
+ * Because it is INFORMATIONAL, on exactly SPEC.md §10.1's rule for the APRV-145
+ * harness-start coverage in `approval status`: a coverage measurement is not an
+ * integrity verdict, and a control an operator learns to silence is worse than
+ * one that reports beside the verdict. A gap here is a question ("was this
+ * effect ever declared?"), and questions with legitimate answers must not fail
+ * a build. The two codes it can still emit are the filesystem's: 2 for a usage
+ * error and 4 for a log this process could not read, plus 3 for a torn tail,
+ * because a log it could not read is a report it did not make.
+ *
+ * ## Why a source that cannot be reached is not a gap
+ *
+ * A source reports `available: false` with a reason, and its effects are absent
+ * rather than uncovered. "`gh` is not on PATH" and "`gh` saw nothing" are
+ * different facts, and a report that flattened them would let a broken tool read
+ * as a clean bill of health. Every unavailable source prints its reason on its
+ * own line.
+ *
+ * ## Writes nothing, reads only verified records
+ *
+ * The log is read through `readVerifiedRecords` (SPEC.md §11.1 invariant 1) and
+ * nothing here appends, renders, or caches. Running it changes no state any
+ * later verdict depends on, which is what lets it be safe to run on a timer.
+ */
+import { type CoverageEntry } from "../core/coverage.js";
+import type { Streams } from "./main.js";
+/** One source's contribution to the report, ready to print or serialize. */
+interface RenderedSource {
+    name: string;
+    available: boolean;
+    reason: string | null;
+    entries: CoverageEntry[];
+    observed: number;
+    covered: number;
+}
+/**
+ * The evidence column, as one short string a reader can act on.
+ *
+ * The qualifier says how the record was found, so that a weaker match is never
+ * read as a stronger one and the strongest is not read as the ordinary one.
+ * `(id)` is APRV-251's: the record names this exact effect by the provider's own
+ * identifier, which is a different claim from "a record of this class sits in
+ * this effect's window" and prints as one.
+ */
+export declare function evidenceText(entry: CoverageEntry): string;
+/** The coverage line one source prints, in the shape the help promises. */
+export declare function coverageLine(source: RenderedSource): string;
+export declare function commandCoverage(argv: string[], streams: Streams, cwd: string): Promise<number>;
+export {};

package/dist/src/cli/coverage.js

@@ -0,0 +1,343 @@
+/**
+ * `approval coverage` — observed side effects, joined to the verified log
+ * (APRV-245, SPEC.md §10.1).
+ *
+ * ## What it answers
+ *
+ * "Here is everything the witnesses outside this runtime say happened, and here
+ * is what the log says about each one." Nothing more: the join is
+ * `core/coverage.ts`, the witnesses are `core/coverage-sources/`, and this file
+ * is argument parsing, source selection, and the rendering of a table.
+ *
+ * ## Why it exits 0 with gaps
+ *
+ * Because it is INFORMATIONAL, on exactly SPEC.md §10.1's rule for the APRV-145
+ * harness-start coverage in `approval status`: a coverage measurement is not an
+ * integrity verdict, and a control an operator learns to silence is worse than
+ * one that reports beside the verdict. A gap here is a question ("was this
+ * effect ever declared?"), and questions with legitimate answers must not fail
+ * a build. The two codes it can still emit are the filesystem's: 2 for a usage
+ * error and 4 for a log this process could not read, plus 3 for a torn tail,
+ * because a log it could not read is a report it did not make.
+ *
+ * ## Why a source that cannot be reached is not a gap
+ *
+ * A source reports `available: false` with a reason, and its effects are absent
+ * rather than uncovered. "`gh` is not on PATH" and "`gh` saw nothing" are
+ * different facts, and a report that flattened them would let a broken tool read
+ * as a clean bill of health. Every unavailable source prints its reason on its
+ * own line.
+ *
+ * ## Writes nothing, reads only verified records
+ *
+ * The log is read through `readVerifiedRecords` (SPEC.md §11.1 invariant 1) and
+ * nothing here appends, renders, or caches. Running it changes no state any
+ * later verdict depends on, which is what lets it be safe to run on a timer.
+ */
+import { isAbsolute, resolve as resolvePathSegments } from "node:path";
+import { observeAdapter } from "../core/coverage-sources/adapter.js";
+import { observeGh } from "../core/coverage-sources/gh.js";
+import { DEFAULT_TRUNK_REF, defaultRange, observeGit, } from "../core/coverage-sources/git.js";
+import { coverageReport } from "../core/coverage.js";
+import { loadPolicy, parseDuration } from "../core/policy-load.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { passphraseEnvFor, vaultPathFor } from "../core/vault.js";
+import { agentmailAdapter } from "../adapters/agentmail.js";
+import { vaultCredentialProvider } from "../adapters/vault-provider.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_IO, EXIT_OK, EXIT_TORN_TAIL, EXIT_USAGE } from "./exit-codes.js";
+import { repoRoot } from "./git-scope.js";
+import { COVERAGE_HELP } from "./help.js";
+import { DEFAULT_LOG_PATH, preflightLog, resolvePath } from "./paths.js";
+import { style, table } from "./style.js";
+import { usageErrorText } from "./usage.js";
+const FLAGS = {
+    "--base": "string",
+    "--head": "string",
+    "--since": "string",
+    "--until": "string",
+    "--source": "string",
+    "--log": "string",
+    "--policy": "string",
+    "--dir": "string",
+    "--vault": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/** The sources this verb knows how to ask. */
+const KNOWN_SOURCES = ["git", "gh", "agentmail"];
+/** The default set. `agentmail` is opt-in because it opens a vault. */
+const DEFAULT_SOURCES = ["git", "gh"];
+/** The adapter window when `--since` is not given. */
+const DEFAULT_SINCE = "7d";
+function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+/**
+ * Where policy lives, from `--policy` / `--dir`, with the CLI's cwd default.
+ *
+ * The same four lines `cli/execute.ts` gives `status`, spelled again rather than
+ * imported: that copy is module-private, and importing it would pull the whole
+ * execution module (the appender, the child spawner, the token reader) into a
+ * verb whose entire promise is that it writes nothing. The behaviour is pinned
+ * by the CLI suites on both sides, so a drift would show up as a test failure
+ * rather than as a quietly different discovery order.
+ */
+function policyLocation(flags, cwd) {
+    const policyFlag = stringFlag(flags, "--policy");
+    const dirFlag = stringFlag(flags, "--dir");
+    if (policyFlag !== null)
+        return { file: absolute(policyFlag, cwd) };
+    return { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
+}
+function usageError(streams, json, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, COVERAGE_HELP));
+    return EXIT_USAGE;
+}
+function ioError(streams, json, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "io", message } })}\n`);
+    else
+        streams.err(`approval: ${message}\n`);
+    return EXIT_IO;
+}
+function emitJson(streams, value) {
+    streams.out(`${JSON.stringify(value)}\n`);
+}
+/**
+ * The evidence column, as one short string a reader can act on.
+ *
+ * The qualifier says how the record was found, so that a weaker match is never
+ * read as a stronger one and the strongest is not read as the ordinary one.
+ * `(id)` is APRV-251's: the record names this exact effect by the provider's own
+ * identifier, which is a different claim from "a record of this class sits in
+ * this effect's window" and prints as one.
+ */
+export function evidenceText(entry) {
+    const evidence = entry.evidence;
+    if (evidence === null)
+        return "none";
+    if ("verdict" in evidence)
+        return evidence.verdict;
+    const qualifier = entry.match === "family" ? " (family)" : entry.match === "provider-ref" ? " (id)" : "";
+    return `seq ${String(evidence.seq)} ${evidence.event}${qualifier}`;
+}
+/** The coverage line one source prints, in the shape the help promises. */
+export function coverageLine(source) {
+    if (!source.available) {
+        return `${source.name}: unavailable (${source.reason ?? "no reason given"})`;
+    }
+    const qualifier = source.reason === null ? "" : ` — ${source.reason}`;
+    return `${source.name}: ${String(source.covered)} of ${String(source.observed)} effect(s) carry evidence${qualifier}`;
+}
+export async function commandCoverage(argv, streams, cwd) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, FLAGS);
+    if (!parsed.ok)
+        return usageError(streams, json, parsed.message);
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${COVERAGE_HELP}\n`);
+        return EXIT_OK;
+    }
+    const extra = parsed.positionals[0];
+    if (extra !== undefined) {
+        return usageError(streams, json, `unexpected argument ${JSON.stringify(extra)}`);
+    }
+    const flags = parsed.flags;
+    // --- the sources ------------------------------------------------------
+    const requested = stringFlag(flags, "--source");
+    let sources = [...DEFAULT_SOURCES];
+    if (requested !== null) {
+        const named = requested
+            .split(",")
+            .map((word) => word.trim())
+            .filter((word) => word.length > 0);
+        if (named.length === 0) {
+            return usageError(streams, json, "--source was given no source names");
+        }
+        for (const name of named) {
+            if (!KNOWN_SOURCES.includes(name)) {
+                return usageError(streams, json, `unknown source ${JSON.stringify(name)}; the sources are ${KNOWN_SOURCES.join(", ")}`);
+            }
+        }
+        sources = [...new Set(named)];
+    }
+    // --- the adapter window ----------------------------------------------
+    const sinceText = stringFlag(flags, "--since") ?? DEFAULT_SINCE;
+    const sinceMs = parseDuration(sinceText);
+    if (sinceMs === null) {
+        return usageError(streams, json, `--since ${JSON.stringify(sinceText)} is not a duration (e.g. 7d, 24h, 90m)`);
+    }
+    const untilText = stringFlag(flags, "--until");
+    // The one clock read in this verb, and it reaches only the window a source is
+    // ASKED about. Nothing derived from it is written anywhere.
+    const untilAt = untilText === null ? Date.now() : Date.parse(untilText);
+    if (Number.isNaN(untilAt)) {
+        return usageError(streams, json, `--until ${JSON.stringify(untilText ?? "")} is not an RFC 3339 instant`);
+    }
+    const window = {
+        since: new Date(untilAt - sinceMs).toISOString(),
+        until: new Date(untilAt).toISOString(),
+    };
+    // --- the log ----------------------------------------------------------
+    const logPath = resolvePath(stringFlag(flags, "--log"), DEFAULT_LOG_PATH, cwd);
+    const check = preflightLog(logPath);
+    if (!check.ok)
+        return ioError(streams, json, check.message);
+    const read = readVerifiedRecords(logPath);
+    if (!read.ok) {
+        if (read.code === "log-unreadable")
+            return ioError(streams, json, read.message);
+        if (read.code === "log-torn-tail") {
+            if (json) {
+                streams.err(`${JSON.stringify({ error: { code: read.code, message: read.message } })}\n`);
+            }
+            else {
+                streams.err(`approval: ${read.message}\n`);
+            }
+            return EXIT_TORN_TAIL;
+        }
+        // A corrupt chain is reported and the run stops: this verb reads only
+        // VERIFIED records (SPEC.md §11.1 invariant 1), so a chain that does not
+        // verify leaves it with nothing it is allowed to join against.
+        if (json) {
+            streams.err(`${JSON.stringify({ error: { code: read.code, message: read.message } })}\n`);
+        }
+        else {
+            streams.err(`approval: ${read.message}\n`);
+        }
+        return EXIT_IO;
+    }
+    const records = read.records;
+    const location = policyLocation(flags, cwd);
+    const load = loadPolicy(location.file === undefined ? { dir: location.dir ?? cwd } : { file: location.file });
+    const protectedPaths = load.ok ? (load.policy.protected_paths ?? []) : [];
+    // --- the commit range -------------------------------------------------
+    const root = repoRoot(cwd) ?? cwd;
+    const baseFlag = stringFlag(flags, "--base");
+    const headFlag = stringFlag(flags, "--head");
+    const fallback = baseFlag === null ? defaultRange(root, DEFAULT_TRUNK_REF) : null;
+    const base = baseFlag ?? fallback?.base ?? "HEAD~20";
+    const head = headFlag ?? "HEAD";
+    // --- ask each source --------------------------------------------------
+    const observations = [];
+    for (const name of sources) {
+        if (name === "git") {
+            const seen = observeGit(root, {
+                base,
+                head,
+                policyProtectedPaths: protectedPaths,
+            });
+            const note = fallback?.note;
+            observations.push(note === undefined
+                ? seen
+                : { ...seen, reason: seen.reason === undefined ? note : `${note}; ${seen.reason}` });
+            continue;
+        }
+        if (name === "gh") {
+            observations.push(observeGh(root, window));
+            continue;
+        }
+        observations.push(await observeAgentmailSource(flags, cwd, logPath, window));
+    }
+    // --- the join ---------------------------------------------------------
+    const all = observations.flatMap((observation) => observation.effects);
+    const report = coverageReport(all, records);
+    const byEffect = new Map();
+    for (const entry of report.entries)
+        byEffect.set(`${entry.effect.source}${entry.effect.id}`, entry);
+    const rendered = observations.map((observation) => {
+        const entries = observation.effects.flatMap((effect) => {
+            const entry = byEffect.get(`${effect.source}${effect.id}`);
+            return entry === undefined ? [] : [entry];
+        });
+        return {
+            name: observation.name,
+            available: observation.available,
+            reason: observation.reason ?? null,
+            entries,
+            observed: entries.length,
+            covered: entries.filter((entry) => entry.evidence !== null).length,
+        };
+    });
+    if (json) {
+        emitJson(streams, {
+            ok: true,
+            window: { base, head, since: window.since, until: window.until },
+            sources: rendered.map((source) => ({
+                name: source.name,
+                available: source.available,
+                reason: source.reason,
+                effects: source.entries.map((entry) => ({
+                    id: entry.effect.id,
+                    class: entry.effect.class,
+                    at: entry.effect.at,
+                    actor_hint: entry.effect.actorHint,
+                    detail: entry.effect.detail,
+                    path: entry.effect.path ?? null,
+                    match: entry.match,
+                    evidence: entry.evidence === null
+                        ? null
+                        : "verdict" in entry.evidence
+                            ? { seq: null, event: null, verdict: entry.evidence.verdict }
+                            : { seq: entry.evidence.seq, event: entry.evidence.event, verdict: null },
+                })),
+                covered: source.covered,
+                observed: source.observed,
+            })),
+        });
+        return EXIT_OK;
+    }
+    const st = style({ json });
+    const rows = rendered.flatMap((source) => source.entries.map((entry) => [
+        source.name,
+        entry.effect.id.length > 20 ? `${entry.effect.id.slice(0, 19)}…` : entry.effect.id,
+        entry.effect.class,
+        entry.evidence === null
+            ? { text: "none", role: "warn" }
+            : { text: evidenceText(entry), role: "value" },
+    ]));
+    if (rows.length > 0) {
+        streams.out(`${table(st, rows, { header: ["source", "effect", "class", "evidence"] })}\n`);
+    }
+    streams.out(`range ${base}..${head}, adapter window ${window.since} .. ${window.until}\n`);
+    for (const source of rendered)
+        streams.out(`${coverageLine(source)}\n`);
+    streams.out(`${st.muted("informational: exit 0 with or without gaps. A gap is a question, not a verdict — docs/cli-reference.md#coverage")}\n`);
+    return EXIT_OK;
+}
+/**
+ * The AgentMail source, with the credential provider built exactly as
+ * `approval setup adapter agentmail` builds its probe's.
+ *
+ * `passphraseEnv` comes from the policy and `envFilePath` is deliberately NOT
+ * supplied. The `.approval/env` passphrase fallback is legitimate only inside a
+ * consumed-token window (APRV-168): its whole argument is that a human granted
+ * THIS action and the token is the authority. A reporting verb holds no token,
+ * so it reads the passphrase from the shell environment or it reports that it
+ * could not, which is SPEC.md §11.1 invariant 7 applied to a read.
+ *
+ * A vault that will not open is reported as an unavailable SOURCE with the
+ * reason, never as an exit code: the other sources still have answers, and a
+ * coverage report that refused to print because one provider was unreachable
+ * would be a report people stop running.
+ */
+async function observeAgentmailSource(flags, cwd, logPath, window) {
+    const location = policyLocation(flags, cwd);
+    const load = loadPolicy(location.file === undefined ? { dir: location.dir ?? cwd } : { file: location.file });
+    const passphraseEnv = passphraseEnvFor(load);
+    const vaultFlag = stringFlag(flags, "--vault");
+    const vaultPath = vaultFlag === null ? vaultPathFor(logPath) : absolute(vaultFlag, cwd);
+    const credentials = vaultCredentialProvider({ vaultPath }, { passphraseEnv });
+    // No `secrets` list, and deliberately: this verb never reads the vault's
+    // values itself, so the only party that knows what to scrub is the adapter,
+    // whose own configuration reader redacts before it returns. Assembling a
+    // secret corpus here would mean opening the vault a second time in the one
+    // verb that has no business holding what is in it.
+    return await observeAdapter(agentmailAdapter(), window, credentials);
+}
+//# sourceMappingURL=coverage.js.map

package/dist/src/cli/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../src/cli/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,GAEX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAA2C,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAA6B;IACtC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,8CAA8C;AAC9C,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAU,CAAC;AAG1D,uEAAuE;AACvE,MAAM,eAAe,GAA0B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAE7D,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CACrB,KAAuC,EACvC,GAAW;IAEX,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAClE,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB,EAAE,KAAc;IAChD,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAoB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;IACnD,MAAM,SAAS,GACb,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,GAAG,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,MAAM,IAAI,iBAAiB,GAAG,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACtE,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,SAAS,EAAE,CAAC;AACxH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,IAAI,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,yEAAyE;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,GAAiB,CAAC,GAAG,eAAe,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,SAAS;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAqB,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,aAAa,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wCAAwC,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,6BAA6B,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE;QAChD,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,yEAAyE;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CACrF,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,yEAAyE;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAEhC,yEAAyE;IACzE,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;gBAC5B,IAAI;gBACJ,IAAI;gBACJ,oBAAoB,EAAE,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;YAC5B,YAAY,CAAC,IAAI,CACf,IAAI,KAAK,SAAS;gBAChB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CACtF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAqB,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAErG,MAAM,QAAQ,GAAqB,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;YAClC,OAAO;YACP,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,MAAM;SACnE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YAChE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACtC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;oBACnB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBACzB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;oBACnB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;oBAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EACN,KAAK,CAAC,QAAQ,KAAK,IAAI;wBACrB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;4BAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;4BAC7D,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;iBAChF,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI;QACX,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAClF,KAAK,CAAC,MAAM,CAAC,KAAK;QAClB,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAe,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE;KAC1D,CAAC,CACH,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,oBAAoB,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAC3F,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,iHAAiH,CAAC,IAAI,CACnI,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAAuC,EACvC,GAAW,EACX,OAAe,EACf,MAAwC;IAExC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CACrF,CAAC;IACF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,mDAAmD;IACnD,OAAO,MAAM,cAAc,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC"}

package/dist/src/cli/daemon.d.ts

@@ -0,0 +1,120 @@
+/**
+ * `approval daemon run` — the foreground daemon verb (SPEC.md §10.2, APRV-39).
+ *
+ * As everywhere else in this CLI, **no logic lives here**. The loop, the drift
+ * comparison, the TTL sweep, and the queue regeneration are `daemon/daemon.ts`
+ * and `daemon/projection.ts`; every append they make goes through the same
+ * `core/gate.ts` and `core/log.ts` paths every other verb uses. This file
+ * resolves paths, validates two durations, renders the daemon's event stream as
+ * text or JSON, installs the signal handlers, and chooses an exit code.
+ *
+ * ## Foreground, deliberately
+ *
+ * `approval daemon run` runs in the foreground and stops on SIGINT/SIGTERM. It
+ * does not fork, write a pidfile, or manage its own lifecycle: in v0.1
+ * backgrounding is the operator's business, and `systemd`, `launchd`, `tmux`,
+ * and `&` all already do it better than a bespoke daemonizer would. That is
+ * stated in `--help` because an operator has to know it before they type it, and
+ * it is exactly the stance `approval channel telegram listen` takes for the same
+ * reason.
+ *
+ * ## What the exit code means
+ *
+ * A clean stop is 0 — a signal is how this verb is *supposed* to end. The three
+ * non-zero endings are the log's, mapped onto the frozen table exactly as every
+ * other verb maps them: 4 when the log cannot be read, 3 when its tail is torn,
+ * 1 when the chain does not verify. The daemon stops rather than degrades on all
+ * three, because nothing may be appended onto a log that does not verify and a
+ * projection of one would be a screenshot of something nobody should read.
+ */
+import { type DaemonEvent, type DaemonOutcome } from "../daemon/daemon.js";
+import { type AdvanceCadence } from "../daemon/advance.js";
+import { type GitEvidenceEvent } from "../daemon/git-evidence.js";
+import { type LoadPolicyOptions } from "../core/policy-load.js";
+import type { Streams } from "./main.js";
+/**
+ * A duration flag, in the policy's own `<n><unit>` vocabulary (SPEC.md §5.2).
+ *
+ * Exported for `approval up` (APRV-110), which accepts the same three durations
+ * and must refuse a typo in exactly the same words.
+ */
+export declare function durationFlag(flags: Record<string, string | boolean>, name: string, fallback: number): {
+    ok: true;
+    ms: number;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * The cadence-advance flags, as one cadence or none (APRV-204).
+ *
+ * Exported for `approval up`, which accepts every `daemon run` flag and must
+ * refuse a typo in exactly the same words — the reason {@link durationFlag} is
+ * exported, and the reason this parsing is not written twice.
+ *
+ * Every duration and count is judged HERE, before the first tick: a daemon that
+ * accepted `--advance-after twenty` and quietly advanced on the default would be
+ * lying about its own configuration for as long as it ran.
+ */
+export declare function advanceFlags(flags: Record<string, string | boolean>): {
+    ok: true;
+    cadence: AdvanceCadence | null;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * The prefix-proof flags, resolved against the policy (APRV-217).
+ *
+ * Precedence is the one every override in this CLI uses: the flag wins for this
+ * run, the policy governs when no flag was typed, and an unloadable policy
+ * yields the default — which here is `full`, the strictest and most expensive
+ * proof, so a policy nobody could read cannot buy a cheaper one.
+ *
+ * Exported for `approval up`, which accepts every `daemon run` flag and must
+ * refuse a typo in exactly the same words — the reason {@link durationFlag} and
+ * {@link advanceFlags} are exported.
+ */
+export declare function readProofFlags(flags: Record<string, string | boolean>, policy: LoadPolicyOptions): {
+    ok: true;
+    readProof: {
+        mode: "full" | "incremental";
+        everyReads: number;
+        afterMs: number;
+    };
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * One daemon event as a human sentence.
+ *
+ * Warnings go to stderr and everything else to stdout, so `approval daemon run >
+ * daemon.log` keeps the narrative and leaves the complaints on the terminal.
+ */
+export declare function describeDaemonEvent(event: DaemonEvent): {
+    text: string;
+    stderr: boolean;
+};
+/**
+ * One git-evidence line as a human sentence (APRV-42).
+ *
+ * Its own function rather than a branch of {@link describe}, because the
+ * hardening layer has its own frozen event shape and `daemon/daemon.ts`'s union
+ * is untouched by the opt-in. Failures go to stderr with everything else that
+ * complains.
+ */
+export declare function describeGitEvidence(event: GitEvidenceEvent): {
+    text: string;
+    stderr: boolean;
+};
+/** The outcome → frozen exit code mapping, drawn where every other verb draws it. */
+export declare function exitForDaemonOutcome(outcome: DaemonOutcome): number;
+/**
+ * `approval daemon run`. Returns a promise, so `main` treats `daemon` the way it
+ * treats `channel`: the CLI is synchronous by contract, and the two long-lived
+ * verbs report their eventual code through `process.exitCode`.
+ */
+export declare function commandDaemonRun(argv: string[], streams: Streams, cwd: string): number | Promise<number>;
+/** `approval daemon <subcommand>` — `run`, and nothing else at v0.1. */
+export declare function commandDaemon(argv: string[], streams: Streams, cwd: string): number | Promise<number>;