approval-md 0.0.1 → 0.2.0

package/dist/src/cli/setup-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-channel.js","sourceRoot":"","sources":["../../../src/cli/setup-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpG,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAE5E,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,UAAU,GAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,OAAO,EACP,iBAAiB,GAKlB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,gFAAgF;AAChF,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,2YAA2Y,CAAC;AAwB1a,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,+EAA+E;AAC/E,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAChF,CAAC;AAQD,iFAAiF;AACjF,KAAK,UAAU,IAAI,CACjB,SAAwB,EACxB,OAAe,EACf,KAAa,EACb,MAAc,EACd,IAAa,EACb,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,OAAO,KAAK,IAAI,MAAM,EAAE,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,QAAQ,GAA4B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,QAAQ,GAAG,MAAiC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAI,MAAkC,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC9D,MAAM,IAAI,GAAI,OAAmC,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACxD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GACR,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACjB,CAAC,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE;gBAC1B,CAAC,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;oBACxC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;oBACtB,CAAC,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,qKAAqK,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,kWAAkW,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAEpyB;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,OAAgB,EAChB,IAAe,EACf,OAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAkC,CAAC;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAErD,gFAAgF;IAChF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,mEAAmE;IACnE,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,iEAAiE;IACjE,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,2FAA2F;IAC3F,IAAI,OAAO,GAAkB,IAAI,CAAC;IAElC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,SAAS,aAAa;QACpB,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,GAAG,CACT,yCAAyC,6BAA6B,4BAA4B;YAChG,yFAAyF;YACzF,0FAA0F;YAC1F,iEAAiE;YACjE,oBAAoB,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;YAChG,wBAAwB,IAAI,OAAO;YACnC,0FAA0F;YAC1F,oFAAoF;YACpF,mFAAmF,CACtF,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CACtC,QAAQ,6BAA6B,8DAA8D,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,OAAO,GAAG,6BAA6B,CAAC;YACxC,OAAO,CAAC,GAAG,CACT,WAAW,6BAA6B,gEAAgE,CACzG,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,GAAG,CACT,yDAAyD,IAAI,SAAS,6BAA6B,sBAAsB,CAC1H,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,aAAa;QAC1B,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,YAAY,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,IAAI,CAAC,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CACT,sBAAsB,OAAO,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CAChG,CAAC;YACF,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC3D,CAAC,CAAC,iEAAiE,QAAQ,IAAI;gBAC/E,CAAC,CAAC,8BAA8B,OAAO,8BAA8B,CACxE,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC9E,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,YAAY;QACzB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CACd,OAAO,EACP,KAAK,EACL,yEAAyE,EACzE,QAAQ,CACT;iBACF,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,CAAC;iBACxF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;QACrF,MAAM,YAAY,GAChB,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,aAAa,CAAC;QACpB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,6HAA6H;YAC3H,GAAG,MAAM,qCAAqC,YAAY,0BAA0B;YACpF,+DAA+D,IAAI,KAAK;YACxE,kGAAkG;YAClG,oGAAoG;YACpG,2CAA2C,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAC3F,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,4CAA4C,MAAM,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC3G,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,8DAA8D,IAAI,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC3H,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAW,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,YAAY;QACnB,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,wHAAwH,OAAO,CAAC,OAAO,mGAAmG,CACpQ,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5C,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,uDAAuD,6BAA6B,sHAAsH,QAAQ,4CAA4C,CACnR,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,iBAAiB,QAAQ,oHAAoH,IAAI,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC1M,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,aAAa,CAAC,IAAY;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC1F,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,0CAA0C,IAAI,CAAC,MAAM,oDAAoD,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3F,OAAO,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,OAAO,GAAG,CAAC;YACT,CAAC,CAAC,oBAAoB,MAAM,CAAC,OAAO,CAAC,wMAAwM;YAC7O,CAAC,CAAC,gQAAgQ,CACrQ,CAAC;QACF,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,gCAAgC,IAAI,uIAAuI;YAC7K,CAAC,CAAC,gFAAgF,CACrF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,UAAU,YAAY;QACzB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,IAAI,SAAS,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAEzB,MAAM,UAAU,GAAI,IAAyB,CAAC,mBAAmB,IAAI,qBAAqB,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,8BAA8B,GAAG,WAAW,aAAa,CAAC,UAAU,CAAC,2KAA2K,CACjP,CAAC;QAEF,IAAI,UAAU,GAAgB,EAAE,CAAC;QACjC,SAAS,CAAC;YACR,2EAA2E;YAC3E,uDAAuD;YACvD,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,uBAAuB;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CACxB,SAAS,EACT,OAAO,EACP,IAAI,EACJ,YAAY,EACZ,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,EACrE,OAAO,CAAC,kBAAkB,GAAG,IAAI,GAAG,gBAAgB,CACrD,CAAC;YACF,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,YAAY,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC7D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC9F,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,sBAAsB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,CACpG,CAAC;gBACF,OAAO,CAAC,GAAG,CACT,qHAAqH,CACtH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YACnD,CAAC;YACD,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YACjC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;QACpC,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CACT,gCAAgC,GAAG,OAAO,aAAa,CAAC,UAAU,CAAC,qIAAqI,GAAG,yJAAyJ,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,uCAAuC,OAAO,CAAC,OAAO,0FAA0F,OAAO,qKAAqK,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,OAAO,mIAAmI,CAC72B,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAc,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACnF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;gBAChD,OAAO,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,wBAAwB,GAAG,mBAAmB;gBACrF,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,GAAG;gBAC9E,MAAM,EAAE,iBAAiB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK;gBACvD,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,uBAAuB,EAAE,QAAQ,CAAC;iBACrF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,UAAU,CAAC,MAA8B;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,0BAA0B,MAAM,eAAe,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,SAAS,EACT,OAAO,EACP,IAAI,EACJ,aAAa,EACb,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,sDAAsD,EAAE,EACjF,gBAAgB,CACjB,CAAC;QACF,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,GAAG,GACP,QAAQ,IAAI,IAAI;gBACd,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7E,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,oCAAoC,GAAG,yCAAyC;aACzF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,MAAM,EAAE,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACtB,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE;QAC3E,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CACvB,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,MAAM,YAAY,EAAE;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE;QAC/B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAsC;IAC/D,QAAQ,EAAE;QACR,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAC9C,OAAO,EAAE,wEAAwE;QACjF,MAAM,EAAE,2eAA2e;QACnf,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE;YACT,4EAA4E;YAC5E,gFAAgF;YAChF,EAAE;YACF,gDAAgD;YAChD,EAAE;YACF,0BAA0B;YAC1B,oCAAoC;SACrC;QACD,IAAI,EAAE,2BAA2B;KAClC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAErB,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kEAAkE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClG,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAE5B,MAAM,OAAO,GAAG,KAAK,CACnB,WAAW,IAAI,EAAE,EACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACb,OAAO,EACP,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,CAAC,OAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,MAAM,GAAe,MAAM,iBAAiB,CAAC;QACjD,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,MAAM,EAAE;YACN,KAAK,EAAE,0BAA0B,IAAI,MAAM,KAAK,CAAC,OAAO,GAAG;YAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;KACrD,CAAC,CAAC;IAEH,2DAA2D;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/src/cli/setup-checkpoint.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `approval setup checkpoint` — mint the key a human signs the log with
+ * (APRV-257, the ceremony half of APRV-220).
+ *
+ * APRV-220 built the record, the signature and the verify rule, and left the
+ * key to an operator with a Node REPL. This is the ceremony that replaces the
+ * REPL, and it is shaped like every other `approval setup` subcommand for the
+ * reason that family exists: establishing a secret is an act of the human at
+ * the machine, so the verb refuses a non-terminal stdin and prints the scripted
+ * alternative instead of accepting a pipe.
+ *
+ * ## The two halves go to two different places, and that is the whole design
+ *
+ * The PRIVATE half goes into the vault, under the reserved name
+ * `approval.checkpoint.key`. Encrypted at rest under the passphrase
+ * `vault.passphrase_env` names, which `core/child-env.ts` strips from every
+ * child this runtime spawns (APRV-205), behind a file whose reading classifies
+ * `account.credential`. `core/vault.ts`'s header records why it belongs there
+ * and not in the OS keystore.
+ *
+ * The PUBLIC half is PRINTED, with the exact `audit.checkpoint_keys` line to
+ * paste, and this verb goes no further. **Nothing an agent runs writes that
+ * line**, and nothing this verb runs writes it either: `APPROVAL.md` is
+ * attested, an edit de-attests it until a human re-attests, and a setup wizard
+ * that silently edited an attested policy would be forging the sign-off. The
+ * same rule `setup sampling` already keeps for `audit.sampling_secret_env`.
+ *
+ * So the key is INERT when this verb finishes, and the verb says so: a
+ * checkpoint signed by a key the policy does not list is
+ * `checkpoint-key-unknown`, which is a refusal. The ceremony is two steps and
+ * the second one is the human's.
+ *
+ * ## Rotation appends; it never drops
+ *
+ * `--rotate` mints a second key and prints the list with BOTH in it. Retiring
+ * is a separate, deliberate act (`--retire <fingerprint>`), and it is REFUSED
+ * for any key that signed a checkpoint in the log, naming the seqs that would
+ * stop verifying. That is not caution: removing such a key turns every
+ * checkpoint it signed into `checkpoint-key-unknown` for the life of the log,
+ * which is the cost APRV-220 accepted knowingly when it made an unlisted key a
+ * refusal rather than a shrug. A key that has signed nothing may be dropped,
+ * and this verb prints the line that does it.
+ *
+ * ## Human-only, three times over
+ *
+ * The terminal check (this family's own rule), the `--as human:<id>` gate
+ * (`requireHuman`), and — since APRV-257 — the classification: `approval setup
+ * checkpoint` classifies `policy.core` in `core/command-class.ts`, which the
+ * reference policy holds human-only, so the Claude Code hook denies an agent
+ * running it with `hook-class-human-only` before a process starts. It mints no
+ * new class (SPEC.md §11.1 invariant 9): `policy.core` already exists and
+ * already covers `gate open`, `gate close` and `log checkpoint`.
+ */
+import type { Streams } from "./main.js";
+import { type SetupDeps } from "./setup-common.js";
+/** `approval setup checkpoint` — mint the checkpoint keypair. HUMAN-ONLY. */
+export declare function commandSetupCheckpoint(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;

package/dist/src/cli/setup-checkpoint.js

@@ -0,0 +1,196 @@
+/**
+ * `approval setup checkpoint` — mint the key a human signs the log with
+ * (APRV-257, the ceremony half of APRV-220).
+ *
+ * APRV-220 built the record, the signature and the verify rule, and left the
+ * key to an operator with a Node REPL. This is the ceremony that replaces the
+ * REPL, and it is shaped like every other `approval setup` subcommand for the
+ * reason that family exists: establishing a secret is an act of the human at
+ * the machine, so the verb refuses a non-terminal stdin and prints the scripted
+ * alternative instead of accepting a pipe.
+ *
+ * ## The two halves go to two different places, and that is the whole design
+ *
+ * The PRIVATE half goes into the vault, under the reserved name
+ * `approval.checkpoint.key`. Encrypted at rest under the passphrase
+ * `vault.passphrase_env` names, which `core/child-env.ts` strips from every
+ * child this runtime spawns (APRV-205), behind a file whose reading classifies
+ * `account.credential`. `core/vault.ts`'s header records why it belongs there
+ * and not in the OS keystore.
+ *
+ * The PUBLIC half is PRINTED, with the exact `audit.checkpoint_keys` line to
+ * paste, and this verb goes no further. **Nothing an agent runs writes that
+ * line**, and nothing this verb runs writes it either: `APPROVAL.md` is
+ * attested, an edit de-attests it until a human re-attests, and a setup wizard
+ * that silently edited an attested policy would be forging the sign-off. The
+ * same rule `setup sampling` already keeps for `audit.sampling_secret_env`.
+ *
+ * So the key is INERT when this verb finishes, and the verb says so: a
+ * checkpoint signed by a key the policy does not list is
+ * `checkpoint-key-unknown`, which is a refusal. The ceremony is two steps and
+ * the second one is the human's.
+ *
+ * ## Rotation appends; it never drops
+ *
+ * `--rotate` mints a second key and prints the list with BOTH in it. Retiring
+ * is a separate, deliberate act (`--retire <fingerprint>`), and it is REFUSED
+ * for any key that signed a checkpoint in the log, naming the seqs that would
+ * stop verifying. That is not caution: removing such a key turns every
+ * checkpoint it signed into `checkpoint-key-unknown` for the life of the log,
+ * which is the cost APRV-220 accepted knowingly when it made an unlisted key a
+ * refusal rather than a shrug. A key that has signed nothing may be dropped,
+ * and this verb prints the line that does it.
+ *
+ * ## Human-only, three times over
+ *
+ * The terminal check (this family's own rule), the `--as human:<id>` gate
+ * (`requireHuman`), and — since APRV-257 — the classification: `approval setup
+ * checkpoint` classifies `policy.core` in `core/command-class.ts`, which the
+ * reference policy holds human-only, so the Claude Code hook denies an agent
+ * running it with `hook-class-human-only` before a process starts. It mints no
+ * new class (SPEC.md §11.1 invariant 9): `policy.core` already exists and
+ * already covers `gate open`, `gate close` and `log checkpoint`.
+ */
+import { checkpointKeyFingerprint, checkpointPolicyOf, CHECKPOINT_KEY_CREDENTIAL, checkpointSignersIn, mintCheckpointKeypair, } from "../core/checkpoint.js";
+import { envFilePathFor, readEnvFile } from "../core/env-file.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { passphraseEnvFor, passphraseFrom, setCredential, vaultExists, vaultPathFor, } from "../core/vault.js";
+import { boolFlag, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK } from "./exit-codes.js";
+import { SETUP_CHECKPOINT_HELP } from "./help.js";
+import { absolute, front, requireHuman, usageError, } from "./setup-common.js";
+import { refusal as renderRefusal, style } from "./style.js";
+/** Flags this subcommand adds to the family's shared table. */
+const EXTRA_FLAGS = {
+    "--rotate": "boolean",
+    "--retire": "string",
+};
+const CHECKPOINT_HINT = (where) => `  # there is no non-interactive form of this ceremony, and that is the point:\n  # a checkpoint key exists to be a key no agent-launched process can mint.\n  # What a script CAN do is establish the passphrase and then leave the key to\n  # a human at a terminal:\n\n  approval setup vault --as human:<id>\n  eval "$(approval env)"        # puts ${where.passphraseEnv} in this shell\n  approval setup checkpoint --as human:<id>\n\n  # then paste the printed public key into APPROVAL.md and attest it:\n  approval policy amend`;
+/** The `audit.checkpoint_keys` block to paste, with every key that must stay. */
+function policyBlock(keys) {
+    return ["  audit:", "    checkpoint_keys:", ...keys.map((key) => `      - ${key}`)].join("\n");
+}
+/** Short form of a fingerprint, for prose. The full value is always printed too. */
+function short(fingerprint) {
+    return fingerprint.slice(0, 12);
+}
+/**
+ * The refusal for an unset passphrase, in `setup adapter`'s two shapes.
+ *
+ * Same diagnosis and the same two repairs, because it is the same fact: the
+ * vault passphrase is read from the environment under the policy's name and
+ * from nowhere else, and an operator meeting this on a second verb should meet
+ * the sentence they already know.
+ */
+function passphraseHint(variable, logPath) {
+    const envPath = envFilePathFor(logPath);
+    const file = readEnvFile(envPath);
+    const hasLine = file.ok && file.entries.some((entry) => entry.key === variable);
+    return hasLine || vaultExists(vaultPathFor(logPath))
+        ? `The passphrase is recorded but not in this shell. Establish it with:\n\n  eval "$(approval env)"`
+        : `Nobody has established a vault passphrase here. Do that first, then evaluate it:\n\n  approval setup vault --as human:<id>\n  eval "$(approval env)"`;
+}
+/**
+ * `--retire <fingerprint>`: print the line that drops a key, or refuse.
+ *
+ * Answered from the LOG and never from a memory of what was rotated when: the
+ * question is "would removing this name change a verdict", and only the records
+ * can answer it. A log that does not verify refuses the retirement too — a
+ * chain nobody can walk cannot be asked which keys signed inside it, and
+ * guessing here would be guessing about the one thing this whole mechanism
+ * exists to make unguessable.
+ */
+function retireKey(streams, fingerprint, configured, logPath, schemaDir) {
+    const wanted = fingerprint.trim().toLowerCase();
+    const matches = configured.filter((key) => {
+        const seen = checkpointKeyFingerprint(key);
+        return seen !== null && (seen === wanted || seen.startsWith(wanted));
+    });
+    if (matches.length === 0) {
+        return usageError(streams, false, `no configured checkpoint key hashes to ${JSON.stringify(fingerprint)}. audit.checkpoint_keys lists ${String(configured.length)} key(s); \`approval doctor\` names their fingerprints. Nothing was changed`, SETUP_CHECKPOINT_HELP);
+    }
+    if (matches.length > 1) {
+        return usageError(streams, false, `${JSON.stringify(fingerprint)} is a prefix of ${String(matches.length)} configured keys; give more of the fingerprint. Nothing was changed`, SETUP_CHECKPOINT_HELP);
+    }
+    const read = readVerifiedRecords(logPath, schemaDir === undefined ? {} : { schemaDir });
+    if (!read.ok) {
+        streams.err(`${renderRefusal(style(), read.code, `${read.message}. A log that does not verify cannot be asked which keys signed inside it, and retiring a key on a guess is how a checkpoint range stops verifying. Nothing was changed`)}\n`);
+        return EXIT_INTEGRITY;
+    }
+    const target = matches[0];
+    const targetFingerprint = checkpointKeyFingerprint(target);
+    const signed = checkpointSignersIn(read.records).get(targetFingerprint) ?? [];
+    if (signed.length > 0) {
+        streams.err(`${renderRefusal(style(), "checkpoint-key-in-use", `key ${targetFingerprint} signed ${String(signed.length)} checkpoint(s) in ${logPath}, at seq ${signed.join(", ")}. Removing it from audit.checkpoint_keys would turn every one of them into checkpoint-key-unknown, which is a REFUSAL and not a warning: \`approval log verify --checkpoints\` would stop passing on a log nobody has touched. Retired keys stay listed forever, which is why the field is a list. Nothing was changed`)}\n`);
+        return EXIT_INTEGRITY;
+    }
+    streams.out(`key ${targetFingerprint} has signed no checkpoint in ${logPath}, so removing it changes no\nverdict. This verb does not edit an attested policy; here is the block to leave\nbehind, through the ceremony that attests it:\n\n${policyBlock(configured.filter((key) => key !== target))}\n\n  approval policy amend\n`);
+    return EXIT_OK;
+}
+/** `approval setup checkpoint` — mint the checkpoint keypair. HUMAN-ONLY. */
+export function commandSetupCheckpoint(argv, streams, cwd, deps = {}) {
+    const outcome = front("checkpoint", argv, streams, cwd, deps, SETUP_CHECKPOINT_HELP, CHECKPOINT_HINT, EXTRA_FLAGS);
+    if (outcome.kind === "handled")
+        return outcome.code;
+    const context = outcome;
+    const extra = context.positionals[0];
+    if (extra !== undefined) {
+        return usageError(streams, false, `unexpected argument ${JSON.stringify(extra)}`, SETUP_CHECKPOINT_HELP);
+    }
+    const human = requireHuman(context.flags, streams, SETUP_CHECKPOINT_HELP, "checkpoint");
+    if (!human.ok)
+        return human.code;
+    const policyFlag = stringFlag(context.flags, "--policy");
+    const dirFlag = stringFlag(context.flags, "--dir");
+    // Resolved against the verb's `cwd` and not the process's, the way every
+    // other path in this family is: a relative `--policy` that landed on a
+    // different file than `front()` loaded would answer questions about a policy
+    // nobody chose.
+    const policyWhere = policyFlag !== null
+        ? { file: absolute(policyFlag, cwd) }
+        : { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
+    const configured = checkpointPolicyOf(policyWhere);
+    const retire = stringFlag(context.flags, "--retire");
+    if (retire !== null) {
+        return retireKey(streams, retire, configured.publicKeys, context.logPath, undefined);
+    }
+    streams.out(`approval setup checkpoint — mints the Ed25519 key you sign the log's head with.\n\nA checkpoint is the one witness an agent process is not supposed to be able to\nproduce: it says a key nobody's runtime holds saw this chain at this head. The\nPRIVATE half goes into ${vaultPathFor(context.logPath)}\nunder ${CHECKPOINT_KEY_CREDENTIAL} and is never printed. The PUBLIC half is\nprinted below for you to put in APPROVAL.md yourself.\n\n`);
+    const rotating = boolFlag(context.flags, "--rotate");
+    if (configured.publicKeys.length > 0 && !rotating) {
+        streams.out(`Your policy already lists ${String(configured.publicKeys.length)} checkpoint key(s). Minting a second one and\nstoring it under ${CHECKPOINT_KEY_CREDENTIAL} REPLACES the private half in the\nvault: checkpoints already signed keep verifying (their key stays listed), but\nthe old private half is gone and nothing in this runtime can print it back.\n\nRe-run with --rotate if that is what you mean.\n`);
+        return EXIT_OK;
+    }
+    if (rotating) {
+        streams.out(`ROTATING. The new key is ADDED to audit.checkpoint_keys and no key is removed:\nretiring one that has signed a checkpoint would de-verify the range it signed,\nwhich is why this verb refuses it (--retire tells you which seqs). The private\nhalf under ${CHECKPOINT_KEY_CREDENTIAL} is replaced, so signatures from here on\nuse the new key.\n\n`);
+        if (!context.prompter.confirm("mint a new checkpoint key and replace the stored private half?")) {
+            streams.out("aborted: nothing was minted, stored, or printed\n");
+            return EXIT_OK;
+        }
+    }
+    // The passphrase, from the SHELL environment under the policy's name. Never
+    // from `.approval/env` directly: SPEC.md §11.1 invariant 7.
+    const variable = passphraseEnvFor(context.load);
+    const passphrase = passphraseFrom(variable, deps.env ?? process.env);
+    if (passphrase === null) {
+        return usageError(streams, false, `${variable} is unset or empty: the vault passphrase is read from that environment variable and from nowhere else, and this verb mints nothing without it. No key was generated and no vault was created.\n\n${passphraseHint(variable, context.logPath)}`, SETUP_CHECKPOINT_HELP);
+    }
+    const pair = mintCheckpointKeypair();
+    const vaultPath = vaultPathFor(context.logPath);
+    const stored = setCredential(vaultPath, passphrase, CHECKPOINT_KEY_CREDENTIAL, pair.privateKey);
+    if (!stored.ok) {
+        streams.err(`${renderRefusal(style(), stored.code, stored.message)}\n`);
+        return stored.code === "vault-io" || stored.code === "vault-write-failed"
+            ? EXIT_IO
+            : EXIT_INTEGRITY;
+    }
+    const keys = [...configured.publicKeys, pair.publicKey];
+    streams.out(`stored the private half in ${vaultPath} under ${CHECKPOINT_KEY_CREDENTIAL}\n  fingerprint ${pair.fingerprint}\n  it was not printed, and there is no verb in this CLI that prints it\n\n`);
+    streams.out(`THE KEY IS INERT UNTIL THE POLICY LISTS IT. A checkpoint signed by a key\naudit.checkpoint_keys does not carry is checkpoint-key-unknown, which is a\nrefusal. This verb does not edit an attested policy — an edited policy is\ninoperative until it is re-attested, and a wizard that edited one would be\nforging the sign-off. Add this block yourself, through the ceremony that\nattests it:\n\n${policyBlock(keys)}\n\n  approval policy amend\n\n`);
+    streams.out(`Then set the cadence, if you want to be asked rather than to remember:\n\n  audit:\n    checkpoint_every: 24h\n\nWith a cadence set, the listener puts one \`CHECKPOINT DUE\` prompt in front of\nyou when one is owed — at most one outstanding, never a nag — and \`approval\ndoctor\`'s checkpoint row says how old the newest one is. A checkpoint that is\ndue is a warning at every layer and never a refusal.\n\n`);
+    streams.out(`IF YOU LOSE THIS KEY: mint another one with --rotate and add it to the list.\nLEAVE THE OLD PUBLIC KEY WHERE IT IS — every checkpoint it signed verifies\nagainst it and only against it, and removing it would refuse a range of a log\nnobody has touched. A lost key costs you future signatures, never past ones.\n`);
+    if (rotating) {
+        streams.out(`\nRotated: key ${short(pair.fingerprint)}… is new, and the ${String(configured.publicKeys.length)} key(s) already listed stay.\n`);
+    }
+    return EXIT_OK;
+}
+//# sourceMappingURL=setup-checkpoint.js.map

package/dist/src/cli/setup-checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-checkpoint.js","sourceRoot":"","sources":["../../../src/cli/setup-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACL,QAAQ,EACR,KAAK,EACL,YAAY,EACZ,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,WAAW,GAA6B;IAC5C,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAkB,EAAU,EAAE,CACrD,4VAA4V,KAAK,CAAC,aAAa,+JAA+J,CAAC;AAEjhB,iFAAiF;AACjF,SAAS,WAAW,CAAC,IAAuB;IAC1C,OAAO,CAAC,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,oFAAoF;AACpF,SAAS,KAAK,CAAC,WAAmB;IAChC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAChF,OAAO,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,kGAAkG;QACpG,CAAC,CAAC,sJAAsJ,CAAC;AAC7J,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAChB,OAAgB,EAChB,WAAmB,EACnB,UAA6B,EAC7B,OAAe,EACf,SAA6B;IAE7B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,4EAA4E,EAC3M,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qEAAqE,EAC5I,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CACd,KAAK,EAAE,EACP,IAAI,CAAC,IAAI,EACT,GAAG,IAAI,CAAC,OAAO,wKAAwK,CACxL,IAAI,CACN,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAW,CAAC;IACpC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,CAAW,CAAC;IACrE,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,GAAG,aAAa,CACd,KAAK,EAAE,EACP,uBAAuB,EACvB,OAAO,iBAAiB,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,OAAO,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wTAAwT,CAC1a,IAAI,CACN,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,OAAO,iBAAiB,gCAAgC,OAAO,kKAAkK,WAAW,CAC1O,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAC3C,+BAA+B,CACjC,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CACnB,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,qBAAqB,EACrB,eAAe,EACf,WAAW,CACZ,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,WAAW,GACf,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,6QAA6Q,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,yBAAyB,sGAAsG,CACrb,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,6BAA6B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,kEAAkE,yBAAyB,oPAAoP,CACjZ,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,8PAA8P,yBAAyB,gEAAgE,CACxV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,gEAAgE,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAwB,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,QAAQ,oMAAoM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAC1P,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,yBAAyB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB;YACvE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,cAAc,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CACT,8BAA8B,SAAS,UAAU,yBAAyB,mBAAmB,IAAI,CAAC,WAAW,6EAA6E,CAC3L,CAAC;IACF,OAAO,CAAC,GAAG,CACT,yYAAyY,WAAW,CAAC,IAAI,CAAC,iCAAiC,CAC5b,CAAC;IACF,OAAO,CAAC,GAAG,CACT,0ZAA0Z,CAC3Z,CAAC;IACF,OAAO,CAAC,GAAG,CACT,yTAAyT,CAC1T,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,kBAAkB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,gCAAgC,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/cli/setup-common.d.ts

@@ -0,0 +1,275 @@
+/**
+ * What every `approval setup` subcommand shares (SPEC.md §5.2, §10.1; APRV-79).
+ *
+ * `setup` began as one file with four subcommands in it. APRV-78 added
+ * `setup adapter <name>` in a file of its own, and it had to reach back into
+ * `cli/setup.ts` for the front matter — which made a cycle: `setup.ts` imports
+ * the adapter verb to dispatch it, and the adapter verb imports `front`,
+ * `requireHuman` and `SetupDeps` back. ESM tolerates that until the day an
+ * initialisation order changes and a `const` at module scope is `undefined` in
+ * one direction only. APRV-79 adds a THIRD such file (`setup-channel.ts`), so
+ * the cycle is broken by extraction rather than tolerated a second time.
+ *
+ * The rule this file exists to enforce, asserted in `tests/layering.test.ts`:
+ *
+ * ```
+ * setup.ts ──┬─> setup-adapter.ts ──┐
+ *            └─> setup-channel.ts ──┴─> setup-common.ts   (and no arrow back)
+ * ```
+ *
+ * What lives here is what more than one of those three needs: the dependency
+ * bag, the keystore seam, the flag table, the front matter (`--help`, the paths,
+ * the policy, the terminal check), the human-only gate, the `.approval/env`
+ * refusal mapping, the service names, and the plaintext-literal offer. What does
+ * NOT live here is anything one subcommand alone uses: the chat picker is
+ * `setup-channel.ts`'s, the manifest hint generator is `setup-adapter.ts`'s, and
+ * the generated-secret path (`storeGeneratedSecret`) stays with `vault` and
+ * `sampling` in `setup.ts`.
+ *
+ * The reasoning for each decision this file encodes — why the token is never
+ * handled by this process, why a generated value may reach an argv and an
+ * operator's own may not, why every subcommand refuses a non-terminal stdin —
+ * is in `cli/setup.ts`'s module doc, which is the family's front page. It is not
+ * repeated here; this file is the mechanism.
+ */
+import { type EnvFileRefusal } from "../core/env-file.js";
+import { type PolicyLoadResult } from "../core/policy-load.js";
+import type { CredentialProvider } from "../adapters/contract.js";
+import type { probeSmtp } from "../adapters/smtp.js";
+import { type TelegramFetch } from "../channels/telegram.js";
+import { type FlagKind } from "./args.js";
+import type { Streams } from "./main.js";
+import { type Prompter } from "./prompt.js";
+/**
+ * The keystore item names, one per secret, SCOPED TO THIS INSTANCE (APRV-178).
+ *
+ * They were three fixed strings until a demo gate in another directory stored
+ * its bot token over the production gate's item, read the production token
+ * back, and had a human's approval tap consumed by the wrong listener. A
+ * keystore is machine-global and the filesystem scoping every other part of an
+ * instance has was simply missing here; `core/instance.ts` carries the whole
+ * reasoning and the shape of the suffix.
+ *
+ * Still not a flag. An operator reading `.approval/env` sees the service name
+ * in the file itself (`keychain:approval-tg-token-3f2a9c11`), so the name is
+ * discoverable, and a `--service-prefix` would add a way for two checkouts to
+ * disagree about which item is which — which is the bug, not the fix.
+ */
+export interface ServiceNames {
+    telegramToken: string;
+    vaultPassphrase: string;
+    samplingSecret: string;
+}
+/** The three item names the instance owning `logPath` reads and writes. */
+export declare function servicesFor(logPath: string): ServiceNames;
+/**
+ * The variable a sampling secret goes into when the policy names none. The
+ * value is stored either way; what the operator is then told to do is add the
+ * `audit.sampling_secret_env` line, because until the POLICY names a variable
+ * the sampler stays off (SPEC.md §5.2) and no amount of environment fixes that.
+ */
+export declare const DEFAULT_SAMPLING_ENV = "APPROVAL_SAMPLING_SECRET";
+/** The long-poll `getUpdates` asks for, in seconds. */
+export declare const POLL_TIMEOUT_SECONDS = 10;
+/** doctor's probe timeout, for the calls that answer immediately. */
+export declare const PROBE_TIMEOUT_MS = 10000;
+/** The flags every subcommand accepts. One table, so none of them drifts. */
+export declare const FLAGS: Record<string, FlagKind>;
+/** Which credential store this machine has, as a closed set. */
+export type KeystoreKind = "keychain" | "secret-service" | "none";
+/** What a store attempt did. `viaArgv` is reported, never hidden. */
+export type StoreOutcome = {
+    ok: true;
+    /**
+     * The value passed through the helper's argv rather than its stdin. True
+     * only on the generated-secret fallback path; see `cli/setup.ts`.
+     */
+    viaArgv: boolean;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * The keystore operations `setup` needs, injectable for exactly the reason
+ * {@link defaultSourceRunner}'s seam exists: no test in this repository may
+ * touch a real Keychain or a real secret service, and the way to guarantee that
+ * is for the tests to hand over a fake rather than for the runtime to grow a
+ * test-only flag.
+ */
+export interface KeystoreRunner {
+    /** What is available here. Consulted once per run. */
+    kind(): KeystoreKind;
+    /**
+     * Store a value THIS PROCESS GENERATED. Prefers the helper's stdin; may fall
+     * back to its argv, and says which it did.
+     */
+    storeGenerated(service: string, value: string): StoreOutcome;
+    /**
+     * Have the HELPER'S OWN no-echo prompt collect the value from the terminal.
+     * The value never enters this process. macOS and `secret-tool` both support
+     * this; there is no such thing on a machine with neither.
+     */
+    storePrompted(service: string): StoreOutcome;
+    /** Read a stored value back. The value arrives on stdout, never in an argv. */
+    read(service: string): {
+        ok: true;
+        value: string;
+    } | {
+        ok: false;
+        message: string;
+    };
+}
+/** A thrown thing, as a sentence. */
+export declare function detail(cause: unknown): string;
+/** The real one. Nothing in the test suite constructs it. */
+export declare const defaultKeystoreRunner: KeystoreRunner;
+/** The `.approval/env` scheme a backend writes. */
+export declare function schemeFor(kind: KeystoreKind, service: string): string | null;
+/** The command an operator runs by hand to see that the item is really there. */
+export declare function retrievalCommand(kind: KeystoreKind, service: string): string;
+/** The command an operator runs by hand to STORE the item, with no value in it. */
+export declare function storageCommand(kind: KeystoreKind, service: string): string;
+/** Everything this verb reaches the world through. Defaults are the real ones. */
+export interface SetupDeps {
+    prompter?: Prompter | null;
+    keystore?: KeystoreRunner;
+    fetch?: TelegramFetch;
+    apiBase?: string;
+    /** Overridable so a test can assert on a value it chose. */
+    generate?: () => string;
+    /**
+     * The `getUpdates` long poll, in seconds. Overridable for one reason: the
+     * "nobody messaged the bot" path polls three times, and a suite that spent
+     * thirty seconds proving a refusal is a suite people stop running. Not a
+     * flag — no operator has a reason to change it.
+     */
+    pollTimeoutSeconds?: number;
+    /**
+     * The environment the passphrase is read from. `process.env` by default.
+     *
+     * A seam and not a back door: it is read through `passphraseFrom`, which is
+     * the same function `approval vault set` uses, and it never resolves
+     * `.approval/env` (§11.1 invariant 7). Injectable so a test can prove both
+     * the unset refusal and the happy path without mutating the suite's own
+     * environment, which is shared by every other test in the process.
+     */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * The SMTP probe `setup adapter email` verifies with. The real one by
+     * default; a test injects a wrapper so that the only TLS relaxation in this
+     * repository stays inside the test that needs it (`tests/smtp-mock.ts`'s
+     * self-signed fixture on 127.0.0.1).
+     */
+    probe?: typeof probeSmtp;
+    /**
+     * The vault read `setup adapter email` probes a partial re-run through
+     * (APRV-99). The real {@link vaultCredentialProvider} by default — the same
+     * provider `approval adapter email` hands to `act` — and injectable for one
+     * reason: the fallback for a vault that will not open is unreachable
+     * otherwise, because the flow proved the passphrase at its preflight and the
+     * writes have already landed by the time verification runs.
+     */
+    credentials?: CredentialProvider;
+}
+export declare function usageError(streams: Streams, json: boolean, message: string, helpText: string): number;
+/**
+ * A refused PROMPT, as one line and no help page (APRV-90).
+ *
+ * The distinction this function exists to draw: {@link usageError} answers a
+ * mangled command line, so it names the shape that line should have had, which
+ * is the thing the operator got wrong. A prompt that was aborted or answered
+ * wrongly five times is not a command line at all — the operator was in a
+ * conversation, the question was on screen, and a usage block under it teaches
+ * nothing. Same exit code (the frozen table is unchanged), one line of output,
+ * and not even the `--help` pointer a usage error carries.
+ */
+export declare function promptRefusal(streams: Streams, message: string): number;
+export declare function absolute(value: string, cwd: string): string;
+export declare function refusalExitCode(refusal: EnvFileRefusal): number;
+export declare function emitRefusal(streams: Streams, refusal: EnvFileRefusal): number;
+export interface Context {
+    flags: Record<string, string | boolean>;
+    positionals: string[];
+    prompter: Prompter;
+    keystore: KeystoreRunner;
+    /**
+     * Which keystore this machine has. Named `backend` rather than `kind` because
+     * the outcome union around this context already discriminates on `kind`.
+     */
+    backend: KeystoreKind;
+    load: PolicyLoadResult;
+    logPath: string;
+    envPath: string;
+    /** This instance's keystore item names (APRV-178). */
+    services: ServiceNames;
+    apiBase: string;
+    generate: () => string;
+    pollTimeoutSeconds: number;
+}
+export type FrontOutcome = {
+    kind: "handled";
+    code: number;
+} | ({
+    kind: "run";
+} & Context);
+/**
+ * What a non-interactive hint needs: where the map lives, which keystore is
+ * present, and the variable NAMES the loaded policy resolves to. The hints
+ * must print the names the interactive path would write, or an operator on a
+ * renamed policy copies a line the runtime never reads.
+ */
+export interface HintContext {
+    envPath: string;
+    kind: KeystoreKind;
+    /**
+     * The instance's item names. A hint that printed the unscoped legacy name
+     * would teach the operator to create by hand exactly the shared item
+     * APRV-178 exists to stop.
+     */
+    services: ServiceNames;
+    passphraseEnv: string;
+    samplingEnv: string;
+    tokenEnv: string;
+    chatEnv: string;
+}
+/** The policy's `audit.sampling_secret_env`, or `null`. */
+export declare function samplingEnvName(load: PolicyLoadResult): string | null;
+export declare function hintContextFor(load: PolicyLoadResult, envPath: string, kind: KeystoreKind, services: ServiceNames): HintContext;
+/**
+ * `--help`, the paths, the policy, the terminal check.
+ *
+ * The terminal check has no `process.stdin.isTTY` in it, deliberately: the real
+ * prompter refuses to construct without one ({@link createPrompter}), so "there
+ * is no prompter" IS "there is no terminal", and a test that injects one has
+ * not bypassed a check that a CI job could also bypass — it has supplied the
+ * human's side of the conversation, which is the only thing a test can honestly
+ * do here.
+ */
+export declare function front(subcommand: string, argv: string[], streams: Streams, cwd: string, deps: SetupDeps, helpText: string, nonInteractiveHint: (context: HintContext) => string, 
+/**
+ * Flags this subcommand accepts on top of the shared table (APRV-110).
+ *
+ * `setup service` is the first subcommand whose subject is not a credential,
+ * so it needs words the other four have no use for (a platform, a unit label,
+ * a log directory). They are passed in rather than added to {@link FLAGS},
+ * because a flag every subcommand silently accepts is a flag an operator will
+ * eventually pass to the one that ignores it.
+ */
+extraFlags?: Record<string, FlagKind>): FrontOutcome;
+/** The human-only rule, spelled exactly as `vault set` spells it. */
+export declare function requireHuman(flags: Record<string, string | boolean>, streams: Streams, helpText: string, verb: string): {
+    ok: true;
+    actor: string;
+} | {
+    ok: false;
+    code: number;
+};
+/**
+ * The plaintext-literal offer, for a machine with no keystore.
+ *
+ * An explicit typed `yes` — not `y`, not Enter — because the whole content of
+ * this question is that the operator understood it. The warning is worded to
+ * match what `approval env --check` will print at them on every run afterwards,
+ * so the two never read as different claims about the same file.
+ */
+export declare function offerLiteral(streams: Streams, prompter: Prompter, envPath: string, what: string): boolean;