approval-md 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (266) hide show
  1. package/README.md +584 -553
  2. package/SPEC.md +42 -13
  3. package/dist/src/adapters/agentmail.d.ts +426 -0
  4. package/dist/src/adapters/agentmail.js +2 -2
  5. package/dist/src/adapters/conformance.d.ts +149 -0
  6. package/dist/src/adapters/contract.d.ts +628 -0
  7. package/dist/src/adapters/contract.js +110 -16
  8. package/dist/src/adapters/contract.js.map +1 -1
  9. package/dist/src/adapters/email.d.ts +324 -0
  10. package/dist/src/adapters/env-passphrase.d.ts +93 -0
  11. package/dist/src/adapters/public.d.ts +11 -0
  12. package/dist/src/adapters/public.js +11 -0
  13. package/dist/src/adapters/public.js.map +1 -0
  14. package/dist/src/adapters/registry.d.ts +59 -0
  15. package/dist/src/adapters/registry.js +2 -1
  16. package/dist/src/adapters/registry.js.map +1 -1
  17. package/dist/src/adapters/smtp.d.ts +213 -0
  18. package/dist/src/adapters/vault-provider.d.ts +114 -0
  19. package/dist/src/adapters/vault-provider.js +3 -3
  20. package/dist/src/adapters/zzz.d.ts +66 -0
  21. package/dist/src/adapters/zzz.js +299 -0
  22. package/dist/src/adapters/zzz.js.map +1 -0
  23. package/dist/src/channels/batch.d.ts +109 -0
  24. package/dist/src/channels/cli.d.ts +193 -0
  25. package/dist/src/channels/conformance.d.ts +92 -0
  26. package/dist/src/channels/contract.d.ts +623 -0
  27. package/dist/src/channels/payload-view.d.ts +35 -0
  28. package/dist/src/channels/render-queue.d.ts +149 -0
  29. package/dist/src/channels/tagging.d.ts +196 -0
  30. package/dist/src/channels/telegram.d.ts +1832 -0
  31. package/dist/src/channels/web.d.ts +341 -0
  32. package/dist/src/cli/adapter.d.ts +90 -0
  33. package/dist/src/cli/adapter.js +25 -15
  34. package/dist/src/cli/adapter.js.map +1 -1
  35. package/dist/src/cli/amend.d.ts +59 -0
  36. package/dist/src/cli/args.d.ts +43 -0
  37. package/dist/src/cli/attest.d.ts +41 -0
  38. package/dist/src/cli/audit-card.d.ts +62 -0
  39. package/dist/src/cli/audit.d.ts +59 -0
  40. package/dist/src/cli/channel-telegram.d.ts +806 -0
  41. package/dist/src/cli/channel-web.d.ts +131 -0
  42. package/dist/src/cli/channel.d.ts +71 -0
  43. package/dist/src/cli/checkpoint-tap.d.ts +169 -0
  44. package/dist/src/cli/codex.d.ts +2 -0
  45. package/dist/src/cli/codex.js +172 -0
  46. package/dist/src/cli/codex.js.map +1 -0
  47. package/dist/src/cli/coverage.d.ts +61 -0
  48. package/dist/src/cli/daemon.d.ts +120 -0
  49. package/dist/src/cli/doctor.d.ts +129 -0
  50. package/dist/src/cli/doctor.js +119 -5
  51. package/dist/src/cli/doctor.js.map +1 -1
  52. package/dist/src/cli/env.d.ts +65 -0
  53. package/dist/src/cli/execute.d.ts +202 -0
  54. package/dist/src/cli/exit-codes.d.ts +73 -0
  55. package/dist/src/cli/feedback.d.ts +60 -0
  56. package/dist/src/cli/gate-window.d.ts +40 -0
  57. package/dist/src/cli/gate.d.ts +68 -0
  58. package/dist/src/cli/git-scope.d.ts +190 -0
  59. package/dist/src/cli/gloss-attach.d.ts +85 -0
  60. package/dist/src/cli/gloss-codex-child.d.ts +9 -0
  61. package/dist/src/cli/gloss-codex.d.ts +24 -0
  62. package/dist/src/cli/gloss-options.d.ts +42 -0
  63. package/dist/src/cli/gloss.d.ts +265 -0
  64. package/dist/src/cli/help.d.ts +103 -0
  65. package/dist/src/cli/help.js +173 -51
  66. package/dist/src/cli/help.js.map +1 -1
  67. package/dist/src/cli/hook-codex.d.ts +78 -0
  68. package/dist/src/cli/hook-codex.js +167 -0
  69. package/dist/src/cli/hook-codex.js.map +1 -0
  70. package/dist/src/cli/hook.d.ts +331 -0
  71. package/dist/src/cli/hook.js +186 -80
  72. package/dist/src/cli/hook.js.map +1 -1
  73. package/dist/src/cli/import.d.ts +35 -0
  74. package/dist/src/cli/init.d.ts +84 -0
  75. package/dist/src/cli/init.js +2 -2
  76. package/dist/src/cli/init.js.map +1 -1
  77. package/dist/src/cli/instructions.d.ts +23 -0
  78. package/dist/src/cli/journal.d.ts +41 -0
  79. package/dist/src/cli/log-advance.d.ts +287 -0
  80. package/dist/src/cli/log-advance.js +102 -11
  81. package/dist/src/cli/log-advance.js.map +1 -1
  82. package/dist/src/cli/log-anchor.d.ts +176 -0
  83. package/dist/src/cli/log-checkpoint.d.ts +22 -0
  84. package/dist/src/cli/log-sync.d.ts +243 -0
  85. package/dist/src/cli/log-verbs.d.ts +16 -0
  86. package/dist/src/cli/log-verbs.js +7 -1
  87. package/dist/src/cli/log-verbs.js.map +1 -1
  88. package/dist/src/cli/long-help.d.ts +70 -0
  89. package/dist/src/cli/main.d.ts +77 -0
  90. package/dist/src/cli/main.js +155 -5
  91. package/dist/src/cli/main.js.map +1 -1
  92. package/dist/src/cli/mcp.d.ts +52 -0
  93. package/dist/src/cli/paths.d.ts +56 -0
  94. package/dist/src/cli/payload.d.ts +58 -0
  95. package/dist/src/cli/policy.d.ts +43 -0
  96. package/dist/src/cli/preflight.d.ts +363 -0
  97. package/dist/src/cli/preflight.js +294 -7
  98. package/dist/src/cli/preflight.js.map +1 -1
  99. package/dist/src/cli/progress.d.ts +78 -0
  100. package/dist/src/cli/prompt.d.ts +209 -0
  101. package/dist/src/cli/quickstart.d.ts +46 -0
  102. package/dist/src/cli/quickstart.js +297 -0
  103. package/dist/src/cli/quickstart.js.map +1 -0
  104. package/dist/src/cli/records.d.ts +34 -0
  105. package/dist/src/cli/render.d.ts +22 -0
  106. package/dist/src/cli/sandbox.d.ts +51 -0
  107. package/dist/src/cli/scaffold.d.ts +79 -0
  108. package/dist/src/cli/setup-adapter.d.ts +137 -0
  109. package/dist/src/cli/setup-adapter.js +38 -4
  110. package/dist/src/cli/setup-adapter.js.map +1 -1
  111. package/dist/src/cli/setup-channel.d.ts +117 -0
  112. package/dist/src/cli/setup-checkpoint.d.ts +57 -0
  113. package/dist/src/cli/setup-common.d.ts +275 -0
  114. package/dist/src/cli/setup-flow.d.ts +287 -0
  115. package/dist/src/cli/setup-service.d.ts +96 -0
  116. package/dist/src/cli/setup.d.ts +202 -0
  117. package/dist/src/cli/style.d.ts +320 -0
  118. package/dist/src/cli/token.d.ts +39 -0
  119. package/dist/src/cli/up.d.ts +155 -0
  120. package/dist/src/cli/up.js +4 -2
  121. package/dist/src/cli/up.js.map +1 -1
  122. package/dist/src/cli/usage.d.ts +37 -0
  123. package/dist/src/cli/values.d.ts +40 -0
  124. package/dist/src/cli/vault.d.ts +59 -0
  125. package/dist/src/cli/vault.js +2 -2
  126. package/dist/src/cli/vault.js.map +1 -1
  127. package/dist/src/cli/verb-registry.d.ts +76 -0
  128. package/dist/src/cli/verb-registry.js +176 -8
  129. package/dist/src/cli/verb-registry.js.map +1 -1
  130. package/dist/src/cli/wordmark.d.ts +31 -0
  131. package/dist/src/cli/wordmark.js +2 -2
  132. package/dist/src/codex/doctor.d.ts +13 -0
  133. package/dist/src/codex/doctor.js +41 -0
  134. package/dist/src/codex/doctor.js.map +1 -0
  135. package/dist/src/codex/manifest.d.ts +49 -0
  136. package/dist/src/codex/manifest.js +103 -0
  137. package/dist/src/codex/manifest.js.map +1 -0
  138. package/dist/src/codex/templates.d.ts +41 -0
  139. package/dist/src/codex/templates.js +319 -0
  140. package/dist/src/codex/templates.js.map +1 -0
  141. package/dist/src/codex/trust.d.ts +19 -0
  142. package/dist/src/codex/trust.js +183 -0
  143. package/dist/src/codex/trust.js.map +1 -0
  144. package/dist/src/codex/workspace-plan.d.ts +131 -0
  145. package/dist/src/codex/workspace-plan.js +561 -0
  146. package/dist/src/codex/workspace-plan.js.map +1 -0
  147. package/dist/src/core/actor.d.ts +2 -0
  148. package/dist/src/core/actor.js +5 -0
  149. package/dist/src/core/actor.js.map +1 -0
  150. package/dist/src/core/advance-cycle.d.ts +170 -0
  151. package/dist/src/core/agents-md.d.ts +276 -0
  152. package/dist/src/core/apply-patch.d.ts +49 -0
  153. package/dist/src/core/apply-patch.js +266 -0
  154. package/dist/src/core/apply-patch.js.map +1 -0
  155. package/dist/src/core/attest.d.ts +420 -0
  156. package/dist/src/core/attest.js +13 -1
  157. package/dist/src/core/attest.js.map +1 -1
  158. package/dist/src/core/audit.d.ts +492 -0
  159. package/dist/src/core/budgets.d.ts +238 -0
  160. package/dist/src/core/checkpoint.d.ts +500 -0
  161. package/dist/src/core/child-env.d.ts +88 -0
  162. package/dist/src/core/clock.d.ts +52 -0
  163. package/dist/src/core/command-class.d.ts +543 -0
  164. package/dist/src/core/command-class.js +43 -8
  165. package/dist/src/core/command-class.js.map +1 -1
  166. package/dist/src/core/coverage-sources/adapter.d.ts +40 -0
  167. package/dist/src/core/coverage-sources/gh.d.ts +48 -0
  168. package/dist/src/core/coverage-sources/git.d.ts +101 -0
  169. package/dist/src/core/coverage.d.ts +217 -0
  170. package/dist/src/core/credential-spec.d.ts +72 -0
  171. package/dist/src/core/dark-session.d.ts +331 -0
  172. package/dist/src/core/decision-refusal.d.ts +185 -0
  173. package/dist/src/core/env-file.d.ts +450 -0
  174. package/dist/src/core/execute.d.ts +858 -0
  175. package/dist/src/core/execute.js +44 -6
  176. package/dist/src/core/execute.js.map +1 -1
  177. package/dist/src/core/frontmatter.d.ts +78 -0
  178. package/dist/src/core/gate-window.d.ts +312 -0
  179. package/dist/src/core/gate.d.ts +1364 -0
  180. package/dist/src/core/gate.js +68 -13
  181. package/dist/src/core/gate.js.map +1 -1
  182. package/dist/src/core/git-run.d.ts +73 -0
  183. package/dist/src/core/harness-version.d.ts +157 -0
  184. package/dist/src/core/harness-version.js +2 -1
  185. package/dist/src/core/harness-version.js.map +1 -1
  186. package/dist/src/core/harness-wait.d.ts +55 -0
  187. package/dist/src/core/head-retry.d.ts +107 -0
  188. package/dist/src/core/instance.d.ts +253 -0
  189. package/dist/src/core/intake-limits.d.ts +247 -0
  190. package/dist/src/core/jcs.d.ts +52 -0
  191. package/dist/src/core/journal.d.ts +144 -0
  192. package/dist/src/core/live-draw.d.ts +436 -0
  193. package/dist/src/core/log-reconcile.d.ts +89 -0
  194. package/dist/src/core/log-subscribe.d.ts +36 -0
  195. package/dist/src/core/log-subscribe.js +162 -0
  196. package/dist/src/core/log-subscribe.js.map +1 -0
  197. package/dist/src/core/log.d.ts +278 -0
  198. package/dist/src/core/loop.d.ts +274 -0
  199. package/dist/src/core/loop.js +11 -0
  200. package/dist/src/core/loop.js.map +1 -1
  201. package/dist/src/core/md-fence.d.ts +41 -0
  202. package/dist/src/core/money.d.ts +147 -0
  203. package/dist/src/core/payload-census.d.ts +74 -0
  204. package/dist/src/core/payload-store.d.ts +175 -0
  205. package/dist/src/core/payload.d.ts +71 -0
  206. package/dist/src/core/policy-diff.d.ts +292 -0
  207. package/dist/src/core/policy-diff.js +27 -4
  208. package/dist/src/core/policy-diff.js.map +1 -1
  209. package/dist/src/core/policy-expectations.d.ts +199 -0
  210. package/dist/src/core/policy-explain.d.ts +150 -0
  211. package/dist/src/core/policy-explain.js +31 -3
  212. package/dist/src/core/policy-explain.js.map +1 -1
  213. package/dist/src/core/policy-load.d.ts +527 -0
  214. package/dist/src/core/policy-load.js +15 -3
  215. package/dist/src/core/policy-load.js.map +1 -1
  216. package/dist/src/core/policy-match.d.ts +281 -0
  217. package/dist/src/core/policy-match.js +20 -9
  218. package/dist/src/core/policy-match.js.map +1 -1
  219. package/dist/src/core/policy-proposal.d.ts +265 -0
  220. package/dist/src/core/prompt-layout.d.ts +221 -0
  221. package/dist/src/core/protected-path-guard.d.ts +453 -0
  222. package/dist/src/core/protected-path-guard.js +514 -35
  223. package/dist/src/core/protected-path-guard.js.map +1 -1
  224. package/dist/src/core/registration.d.ts +25 -0
  225. package/dist/src/core/reindex.d.ts +99 -0
  226. package/dist/src/core/sampler.d.ts +313 -0
  227. package/dist/src/core/sandbox.d.ts +290 -0
  228. package/dist/src/core/seal.d.ts +165 -0
  229. package/dist/src/core/state.d.ts +505 -0
  230. package/dist/src/core/task-file.d.ts +185 -0
  231. package/dist/src/core/telegram-config.d.ts +93 -0
  232. package/dist/src/core/token.d.ts +409 -0
  233. package/dist/src/core/token.js +21 -38
  234. package/dist/src/core/token.js.map +1 -1
  235. package/dist/src/core/validate.d.ts +138 -0
  236. package/dist/src/core/values.d.ts +137 -0
  237. package/dist/src/core/vault.d.ts +291 -0
  238. package/dist/src/core/verified-snapshot.d.ts +204 -0
  239. package/dist/src/core/verify.d.ts +336 -0
  240. package/dist/src/core/version.d.ts +8 -0
  241. package/dist/src/core/wysiwys.d.ts +370 -0
  242. package/dist/src/daemon/advance-child.d.ts +39 -0
  243. package/dist/src/daemon/advance.d.ts +466 -0
  244. package/dist/src/daemon/audit.d.ts +87 -0
  245. package/dist/src/daemon/daemon.d.ts +1180 -0
  246. package/dist/src/daemon/dark-session.d.ts +64 -0
  247. package/dist/src/daemon/draw-child.d.ts +36 -0
  248. package/dist/src/daemon/draw.d.ts +154 -0
  249. package/dist/src/daemon/git-evidence.d.ts +173 -0
  250. package/dist/src/daemon/git-evidence.js +1 -1
  251. package/dist/src/daemon/projection.d.ts +180 -0
  252. package/dist/src/daemon/prune.d.ts +207 -0
  253. package/dist/src/mcp/http.d.ts +113 -0
  254. package/dist/src/mcp/server.d.ts +265 -0
  255. package/dist/src/mcp/server.js +9 -1
  256. package/dist/src/mcp/server.js.map +1 -1
  257. package/docs/adapter-api.md +106 -0
  258. package/docs/cli-reference.md +389 -36
  259. package/docs/codex-enforced-session.md +30 -0
  260. package/package.json +12 -2
  261. package/schema/codex-instance.schema.json +82 -0
  262. package/schema/event.schema.json +2 -1
  263. package/schema/fixtures/codex-instance/invalid/unpinned-codex-version.json +40 -0
  264. package/schema/fixtures/codex-instance/valid/canonical.json +40 -0
  265. package/schema/policy.schema.json +21 -1
  266. package/templates/codex/README.md +9 -0
@@ -36,8 +36,10 @@ Usage:
36
36
  approval log verify [--log <path>] [--json]
37
37
  approval log tail [--log <path>] [-n <count>] [--json]
38
38
  approval log export [--log <path>] [--json]
39
+ approval log follow [--log <path>] [--from <seq>] [--cursor-hash <64hex>] --json
39
40
  approval instructions [--schemas] [--json]
40
41
  approval init [--dir <path>] [--json]
42
+ approval quickstart [--dir <path>] [--api-base <url>] (interactive; no --json)
41
43
  approval policy check|test <class> [--reversible true|false] [--policy <path>] [--dir <path>] [--json]
42
44
  approval policy attest [--policy <path>] [--dir <path>] [--as human:<id>] [--json]
43
45
  approval policy amend [--policy <path>] [--dir <path>] [--log <path>]
@@ -53,9 +55,11 @@ Usage:
53
55
  approval run <action-key> [--token <t>] [--payload-hash <64hex>]
54
56
  [--as <id>] [--no-sandbox] [--json] -- <cmd…>
55
57
  approval sandbox [--allow-loopback] [--log <path>] -- <cmd…>
56
- approval adapter email <action-key> --token <t> --payload <file|->
58
+ approval adapter email <action-key> [--token <t>] --payload <file|->
57
59
  [--as <id>] [--vault <path>] [--timeout <ms>] [--json]
58
- approval adapter agentmail <action-key> --token <t> --payload <file|->
60
+ approval adapter agentmail <action-key> [--token <t>] --payload <file|->
61
+ [--as <id>] [--vault <path>] [--timeout <ms>] [--json]
62
+ approval adapter zzz <action-key> [--token <t>] --payload <file|->
59
63
  [--as <id>] [--vault <path>] [--timeout <ms>] [--json]
60
64
  approval execution resolve <action-key> --outcome completed|failed
61
65
  --note "<text>" [--as human:<id>] [--json]
@@ -114,6 +118,7 @@ Usage:
114
118
  [--log <path>] (reads preToolUse JSON)
115
119
  approval hook classify [--json] [--policy <path>] [--dir <path>] -- <command…>
116
120
  approval import agents-md <file> [--out <path>] [--json]
121
+ approval codex prepare|setup|doctor|start|serve (strict host workflow)
117
122
  approval mcp serve --as agent:<id> [--dir <path>] [--log <path>]
118
123
  [--policy <path>] (MCP over stdio; foreground)
119
124
  approval reindex [--log <path>] [--index <path>] [--force] [--json]
@@ -129,6 +134,10 @@ Set up — make this directory and this machine ready:
129
134
  atomic-write temp files. Appends
130
135
  nothing, attests nothing, overwrites nothing; a re-run writes
131
136
  nothing and reports what already exists
137
+ quickstart ask three decisions, write a solo policy with the named human as
138
+ its sole approver, configure identity and an optional Telegram
139
+ channel, show the exact bytes, then require typed \`understood\`
140
+ before attesting. HUMAN-ONLY and INTERACTIVE ONLY
132
141
  setup the WRITER for that file: "setup identity|vault|sampling" and
133
142
  "setup channel <name>" store each secret in the OS keystore and
134
143
  record where it lives, and "setup adapter <name>" fills the VAULT
@@ -145,7 +154,7 @@ Set up — make this directory and this machine ready:
145
154
  "vault set|list|remove" are HUMAN-ONLY; list shows NAMES and never
146
155
  values, and there is no "vault get" — a credential's only sanctioned
147
156
  journey is from .approval/vault.enc into an adapter, inside the
148
- verified-token window. The passphrase comes from the environment
157
+ verified execution window. The passphrase comes from the environment
149
158
  variable the policy NAMES (vault.passphrase_env), never from a flag
150
159
  env resolve .approval/env — the environment SOURCE MAP — and print an
151
160
  export block for your shell to evaluate. THE ONLY VERB THAT READS
@@ -182,13 +191,15 @@ Ask — an agent declares an action and acts on the answer:
182
191
  run execute a command behind the gate: appends execution.started before
183
192
  spawning it, execution.completed/failed with the child's exit code
184
193
  after, and exits with that same code
185
- adapter execute an approved action through a side-effect adapter, the hard
194
+ adapter execute an action through a side-effect adapter, the hard
186
195
  boundary of SPEC.md §10.4. "adapter email" sends one RFC 5322
187
196
  message over SMTP for a communicate.email.external action: the
188
- credentials come from the vault inside the verified-token window,
189
- the payload is the bytes the grant bound to, and the runtime — not
190
- the adapter — recomputes the hash, spends the token, and writes both
191
- execution events around the send. "adapter agentmail" serves the
197
+ credentials come from the vault inside the execution window, the
198
+ payload is the bytes the declaration or grant bound to, and the
199
+ runtime recomputes the hash, applies policy, and writes both
200
+ execution events around the send. Manual and selected-live paths
201
+ require --token; policy-authorized supervised/autonomous paths do
202
+ not mint one. "adapter agentmail" serves the
192
203
  same class over the AgentMail API: a direct send, or the send of a
193
204
  draft the agent composed, refused if the draft changed after the
194
205
  snapshot a human approved
@@ -395,6 +406,7 @@ Usage:
395
406
  approval log verify [--log <path>] [--json]
396
407
  approval log tail [--log <path>] [-n <count>] [--json]
397
408
  approval log export [--log <path>] [--json]
409
+ approval log follow [--log <path>] [--from <seq>] [--cursor-hash <64hex>] --json
398
410
  approval log sync [--remote <name>] [--branch <name>] [--json]
399
411
  approval log advance [--branch <name>] [--pr] [--dry-run] [--json]
400
412
  approval log checkpoint --as human:<id> [--key-file <path>] [--json]
@@ -402,17 +414,40 @@ Usage:
402
414
  Subcommands:
403
415
  verify walk the hash chain end to end; clean | torn-tail | corrupt
404
416
  tail / export the last N records (default 10) / every line, verbatim
417
+ follow verified records after an exclusive cursor, then verified appends
405
418
  sync fast-forward pull, with a snapshot and a chain reconcile
406
419
  advance commit the log's new records onto a records branch
407
420
  checkpoint sign the current head with your own key (human-only)
408
421
 
409
- verify, tail and export only read. sync and advance move the FILE and append no
410
- record; checkpoint appends one. Default log: .approval/log/events.jsonl
411
- JSON shapes: docs/cli-reference.md
412
-
413
- ${EXIT_CODES_POINTER}
422
+ verify, tail, export and follow only read. sync and advance move the FILE and append no record;
423
+ checkpoint appends one. Default log: .approval/log/events.jsonl
424
+ JSON shapes: docs/cli-reference.md; ${EXIT_CODES_POINTER}
414
425
  ${JSON_ERRORS}
415
426
  ${why("log")}`;
427
+ export const FOLLOW_HELP = `approval log follow — follow verified records after a cursor
428
+
429
+ Usage:
430
+ approval log follow [--log <path>] [--from <seq>] [--cursor-hash <64hex>] --json
431
+
432
+ Flags:
433
+ --log <path> log file to read (default .approval/log/events.jsonl)
434
+ --from <seq> exclusive sequence cursor (default 0)
435
+ --cursor-hash <hex> hash of record --from, retained by the consumer
436
+ --json required; one complete event object per stdout line
437
+ -h, --help this text
438
+
439
+ The complete chain is verified before each emitted batch. Notifications only
440
+ wake another verification. Corrupt, torn, unreadable, truncated or cursor-
441
+ mismatched logs stop the stream before any record from that batch is printed.
442
+
443
+ Persist seq and hash after the external effect succeeds. Reconnecting from that
444
+ cursor is at-least-once across a crash between the effect and cursor storage;
445
+ exactly-once external effects require the consumer's own idempotency mechanism.
446
+
447
+ ${EXIT_CODES_POINTER} (0 on signal or broken-pipe cancellation; 1 corrupt or cursor
448
+ mismatch; 2 usage; 3 torn tail; 4 I/O)
449
+ ${JSON_ERRORS}
450
+ ${why("log-follow")}`;
416
451
  export const LOG_SYNC_HELP = `approval log sync — fast-forward the committed log, safely
417
452
 
418
453
  Usage:
@@ -441,12 +476,12 @@ export const LOG_ADVANCE_HELP = `approval log advance — commit and push the lo
441
476
 
442
477
  Usage:
443
478
  approval log advance [--remote <n>] [--branch <n>] [--base <n>] [--pr]
444
- [--no-auto-merge] [--dry-run] [--json]
445
-
479
+ [--co-author "Name <email>"] [--no-auto-merge] [--dry-run] [--json]
446
480
  Flags:
447
481
  --remote <name> remote to push to (default origin)
448
482
  --branch <name> records branch (default records-log-<date>); never main
449
483
  --base <name> branch to parent the commit on (default: the one you are on)
484
+ --co-author <id> append Name <email> display credit to commit and PR body
450
485
  --pr / --dry-run open the PR through gh and ARM its merge / write nothing
451
486
  --no-auto-merge / --json / -h, --help do not arm / JSON output / this text
452
487
 
@@ -1346,28 +1381,51 @@ JSON shape (one object on stdout):
1346
1381
  ${EXIT_CODES_POINTER}
1347
1382
  ${JSON_ERRORS}
1348
1383
  ${why("init")}`;
1384
+ export const QUICKSTART_HELP = `approval quickstart — make a small solo gate operative
1385
+
1386
+ Usage:
1387
+ approval quickstart [--dir <path>]
1388
+
1389
+ Asks three decisions: your human id, terminal or Telegram, and which five class
1390
+ families always ask. It refuses a directory that already has policy or .approval
1391
+ state, writes a fresh policy, configures identity, and runs doctor before showing
1392
+ the exact bytes. The one expected unattested row is ignored at that point; every
1393
+ other failed row stops setup before attestation. Typed \`understood\` attests only
1394
+ if the file still has the displayed digest. A Telegram token uses the existing
1395
+ OS-keystore setup path and is resolved explicitly for that preflight.
1396
+
1397
+ Interactive only. Piped stdin and --json exit 2 and print the manual sequence.
1398
+ The generated default applies only to classified reversible actions; protected
1399
+ controls, fail-closed policy loading and unclassified-command refusal remain.
1400
+
1401
+ Flags:
1402
+ --dir <path> project directory (default: current directory)
1403
+ --api-base <url> Telegram API base passed to channel setup and doctor
1404
+ -h, --help this text
1405
+
1406
+ ${EXIT_CODES_POINTER} (0 success; 1 doctor failure; 2 usage; 4 filesystem failure)
1407
+ ${why("quickstart")}`;
1349
1408
  export const HOOK_HELP = `approval hook — put the gate in front of an agent harness
1350
1409
 
1351
1410
  Usage:
1352
- approval hook claude-code|cursor [--as agent:<id>] [--timeout <d>] [--interval <d>]
1353
- [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1411
+ approval hook claude-code|cursor|codex [--as agent:<id>] [--timeout <d>] [--interval <d>] [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1354
1412
  approval hook classify [--json] [--policy <p>] [--dir <p>] -- <command…>
1355
1413
 
1356
1414
  Commands:
1357
1415
  claude-code Claude Pre/PostToolUse JSON in; decision JSON out. REGISTER BOTH
1358
1416
  cursor Cursor preToolUse JSON in; native {permission} JSON out
1417
+ codex Codex synchronous Pre/Post JSON; Bash denied, direct apply_patch experimentally gated
1359
1418
  classify print what the classifier makes of a command line and exit
1360
1419
 
1361
- Flags (claude-code, cursor):
1362
- --as <id> proposing identity (default agent:claude-code / agent:cursor)
1363
- --timeout/--interval/--retry-grace <d> wait / poll / hold for a retry (55s/1s/5m)
1420
+ --as <id> proposing identity (default agent:claude-code / agent:cursor / agent:codex)
1421
+ --timeout/--interval/--retry-grace <d> wait / poll / hold for a retry (9m/1s/5m)
1364
1422
  --dir/--policy/--log <p> policy+log root; --dir sets BOTH, default primary
1365
1423
  -h, --help this text
1366
1424
 
1367
- Deny: hook-unclassified, hook-class-human-only, hook-opaque, hook-unparseable,
1368
- hook-rejected, hook-revoked, hook-expired, hook-withdrawn, hook-timeout,
1369
- hook-gate-refused:<c>, hook-grant-unverified, hook-sandbox-required,
1370
- hook-policy-unavailable, hook-log-unreachable, hook-io.
1425
+ Codex opt-in: register exact Bash|apply_patch synchronously with timeout 600s (default wait 9m). Bash is denied because native events hide per-call workdir; direct apply_patch is experimental. PostToolUse is diagnostic.
1426
+
1427
+ Deny: hook-unclassified, hook-class-human-only, hook-opaque, hook-unparseable, hook-rejected, hook-revoked, hook-expired, hook-withdrawn, hook-timeout,
1428
+ hook-gate-refused:<c>, hook-grant-unverified, hook-sandbox-required, hook-policy-unavailable, hook-log-unreachable, hook-io.
1371
1429
 
1372
1430
  ${EXIT_CODES_POINTER} (harness verbs use 0 and 2 only; 0 is a verdict, never "ask")
1373
1431
  ${why("hook")}`;
@@ -1755,7 +1813,7 @@ ${why("up")}`;
1755
1813
  // ---------------------------------------------------------------------------
1756
1814
  /** One line, not a paragraph: the rest of the reasoning is in the reference. */
1757
1815
  const VAULT_NO_GET = `THERE IS NO "approval vault get": a credential's only sanctioned journey is from
1758
- the vault into an adapter, inside the verified-token window.`;
1816
+ the vault into an adapter, inside the verified execution window.`;
1759
1817
  export const VAULT_HELP = `approval vault — the encrypted credential store adapters read from
1760
1818
 
1761
1819
  Usage:
@@ -1849,39 +1907,39 @@ JSON shape: docs/cli-reference.md#vault-remove
1849
1907
  ${EXIT_CODES_POINTER}
1850
1908
  ${JSON_ERRORS}
1851
1909
  ${why("vault-remove")}`;
1852
- export const ADAPTER_HELP = `approval adapter — execute an approved action through a side-effect adapter
1910
+ export const ADAPTER_HELP = `approval adapter — execute an action through a side-effect adapter
1853
1911
 
1854
1912
  Usage:
1855
- approval adapter email|agentmail <action-key> --token <t> --payload <file|->
1856
- [--as human:<id>|agent:<id>] [--vault <path>]
1857
- [--policy|--dir|--log <path>] [--timeout <ms>] [--json]
1913
+ approval adapter email|agentmail|zzz <action-key> [--token <t>] --payload <file|->
1914
+ [--as human:<id>|agent:<id>] [--vault <path>] [--policy|--dir|--log <path>]
1915
+ [--timeout <ms>] [--json]
1858
1916
 
1859
1917
  Adapters:
1860
- email send one RFC 5322 message over SMTP, for actions declared under
1861
- communicate.email.external (SPEC.md §6.1's canonical example)
1862
- agentmail send the same class over the AgentMail API: a direct message, or
1863
- a draft the agent composed, re-read and refused if it drifted
1918
+ email send SMTP for communicate.email.external (SPEC.md §6.1)
1919
+ agentmail send that class through AgentMail, directly or from a re-read draft
1920
+ zzz create a thread or reply for communicate.zzz.external
1921
+
1922
+ An adapter is the HARD BOUNDARY of SPEC.md §10.4: it holds credentials while the
1923
+ runtime checks the payload and attested policy. Manual and selected-live actions
1924
+ require a valid, single-use --token bound to the action and payload. An explicitly
1925
+ policy-authorized nonmanual action has no token; its process must already hold the
1926
+ vault passphrase, and the token-scoped .approval/env fallback stays unavailable.
1864
1927
 
1865
- An adapter is the HARD BOUNDARY of SPEC.md §10.4: it holds the credentials and
1866
- refuses to act without a valid, unexpired, single-use execution token bound to
1867
- the action's idempotency_key AND its payload_hash. The runtime, not the adapter,
1868
- owns the sequence: recompute the hash, resolve the credentials the adapter
1869
- declared, run its pre-token check, verify and consume the token, append
1870
- execution.started, call the adapter, append the outcome. The two steps before
1871
- the spend refuse without appending or spending, so the token stays live.
1928
+ A no-token supervised-live call runs intake; selected/unavailable draws stop before
1929
+ credentials. An unselected draw proceeds. Existing approval cycles are not redrawn.
1872
1930
 
1873
- ${EXIT_CODES_POINTER} (5 when no valid token was presented; 1 for every refusal)
1931
+ ${EXIT_CODES_POINTER} (5 when a manual path needs a token; 1 for every refusal)
1874
1932
  ${JSON_ERRORS}
1875
1933
  ${why("adapter")}`;
1876
1934
  export const ADAPTER_EMAIL_HELP = `approval adapter email — send one approved message over SMTP
1877
1935
 
1878
1936
  Usage:
1879
- approval adapter email <action-key> --token <t> --payload <file|->
1937
+ approval adapter email <action-key> [--token <t>] --payload <file|->
1880
1938
  [--as <id>] [--vault <path>] [--policy <path>]
1881
1939
  [--dir <path>] [--log <path>] [--timeout <ms>] [--json]
1882
1940
 
1883
1941
  Flags:
1884
- --token <t> the single-use token "approval grant" printed. REQUIRED
1942
+ --token <t> REQUIRED for manual or selected-live; omit on authorized nonmanual
1885
1943
  --payload <file|-> the JSON payload the grant bound to. REQUIRED (a body on
1886
1944
  a command line is a body in the shell history)
1887
1945
  --as <id> / --vault <path> executing identity / the SMTP credential store
@@ -1894,17 +1952,17 @@ it, and a non-ASCII body goes quoted-printable. The VAULT holds smtp.host,
1894
1952
  smtp.port, smtp.security, smtp.user, smtp.password; failure codes add smtp-<NNN>.
1895
1953
 
1896
1954
  JSON shapes and failure codes: docs/cli-reference.md#adapter-email
1897
- ${EXIT_CODES_POINTER} (5 when no valid token was presented; 1 for every refusal)
1955
+ ${EXIT_CODES_POINTER} (5 when a manual path needs a token; 1 for every refusal)
1898
1956
  ${JSON_ERRORS}
1899
1957
  ${why("adapter-email")}`;
1900
1958
  export const ADAPTER_AGENTMAIL_HELP = `approval adapter agentmail — send one approved message through AgentMail
1901
1959
 
1902
1960
  Usage:
1903
- approval adapter agentmail <action-key> --token <t> --payload <file|->
1961
+ approval adapter agentmail <action-key> [--token <t>] --payload <file|->
1904
1962
  [--as <id>] [--vault|--policy|--dir|--log <p>] [--timeout <ms>] [--json]
1905
1963
 
1906
1964
  Flags:
1907
- --token <t> / --payload <file|-> the token and the bytes. BOTH REQUIRED
1965
+ --token <t> / --payload <file|-> token: manual or selected-live; payload: always
1908
1966
  --as <id> / --vault <p> / --policy <p> / --dir <p> / --log <p> as email
1909
1967
  --timeout <ms> / --json / -h, --help 15000 / machine-readable / this text
1910
1968
 
@@ -1918,9 +1976,33 @@ TWO PAYLOAD MODES, told apart by shape and never inferred between:
1918
1976
  The VAULT holds agentmail.inbox_id and agentmail.api_key, and that key is the one
1919
1977
  WITH draft_send and message_send; the agent's own key must not have them.
1920
1978
 
1921
- ${EXIT_CODES_POINTER} (5 when no valid token was presented; 1 for every refusal)
1979
+ ${EXIT_CODES_POINTER} (5 when a manual path needs a token; 1 for every refusal)
1922
1980
  ${JSON_ERRORS}
1923
1981
  ${why("adapter-agentmail")}`;
1982
+ export const ADAPTER_ZZZ_HELP = `approval adapter zzz — send one approved zzz.bot message
1983
+
1984
+ Usage:
1985
+ approval adapter zzz <action-key> [--token <t>] --payload <file|->
1986
+ [--as <id>] [--vault|--policy|--dir|--log <p>] [--timeout <ms>] [--json]
1987
+
1988
+ The tagged payload chooses create_thread or create_reply and production or
1989
+ preview. Both destinations are fixed in the adapter; the payload cannot supply
1990
+ an arbitrary URL. The runtime binds the complete payload, including metadata,
1991
+ tags and references, and derives ZZZ's retry-safe Idempotency-Key from the
1992
+ action key and payload hash. Actions use communicate.zzz.external. The VAULT
1993
+ holds zzz.agent_token.
1994
+
1995
+ --token is required for manual or selected-live and omitted for explicitly
1996
+ authorized nonmanual execution; then the process must already hold the passphrase.
1997
+
1998
+ A public-room write needs an invited token with write scope. A private-room
1999
+ write also needs current room membership and accepted, unexpired approval.md
2000
+ workflow evidence. zzz.bot intentionally hides missing private access as 404.
2001
+
2002
+ JSON shapes and failure codes: docs/cli-reference.md#adapter-zzz
2003
+ ${EXIT_CODES_POINTER} (5 when a manual path needs a token; 1 for every refusal)
2004
+ ${JSON_ERRORS}
2005
+ ${why("adapter-zzz")}`;
1924
2006
  export const ENV_HELP = `approval env — resolve .approval/env into an export block for your shell
1925
2007
 
1926
2008
  Usage:
@@ -2059,10 +2141,11 @@ Usage:
2059
2141
  [--policy <path>]
2060
2142
 
2061
2143
  Known adapters:
2062
- email the SMTP settings \`approval adapter email\` reads: smtp.host,
2063
- smtp.port, smtp.security, smtp.user, smtp.password
2144
+ email smtp.host, smtp.port, smtp.security, smtp.user, smtp.password
2064
2145
  agentmail the two values \`approval adapter agentmail\` reads:
2065
2146
  agentmail.inbox_id and agentmail.api_key
2147
+ zzz the invited write credential \`approval adapter zzz\` reads:
2148
+ zzz.agent_token
2066
2149
 
2067
2150
  Asks for each credential the named adapter DECLARES, validates every answer with
2068
2151
  the adapter's own rules, stores them in .approval/vault.enc, and offers to prove
@@ -2081,7 +2164,7 @@ Usage:
2081
2164
  approval setup adapter email [--as human:<id>] [--log <path>] [--dir <path>]
2082
2165
  [--policy <path>]
2083
2166
 
2084
- The five names the email adapter reads inside the verified-token window:
2167
+ The five names the email adapter reads inside the verified execution window:
2085
2168
 
2086
2169
  smtp.host the submission server
2087
2170
  smtp.port 587 for STARTTLS submission, 465 for implicit TLS
@@ -2104,7 +2187,7 @@ Usage:
2104
2187
  approval setup adapter agentmail [--as human:<id>] [--log <path>]
2105
2188
  [--dir <path>] [--policy <path>]
2106
2189
 
2107
- The two names the AgentMail adapter reads inside the verified-token window:
2190
+ The two names the AgentMail adapter reads inside the verified execution window:
2108
2191
  agentmail.inbox_id the inbox this runtime sends from; the inbox IS the sender
2109
2192
  agentmail.api_key the key carrying draft_send and message_send, no echo
2110
2193
 
@@ -2122,6 +2205,23 @@ says so rather than claiming the key can send. A FAILED PROBE KEEPS THE VALUES:
2122
2205
  ${EXIT_CODES_POINTER} (1 means AgentMail refused, or the vault would not open)
2123
2206
  ${JSON_ERRORS}
2124
2207
  ${why("setup-adapter-agentmail")}`;
2208
+ export const SETUP_ADAPTER_ZZZ_HELP = `approval setup adapter zzz — the zzz.bot credential (HUMAN-ONLY)
2209
+
2210
+ Usage:
2211
+ approval setup adapter zzz [--as human:<id>] [--log <path>]
2212
+ [--dir <path>] [--policy <path>]
2213
+
2214
+ The vault name is zzz.agent_token: an invited principal token with write scope.
2215
+ Keep it out of the agent environment, so publication remains behind the adapter.
2216
+
2217
+ THE PROBE POSTS NOTHING. It performs one authenticated GET /api/v1/rooms. A
2218
+ success proves only that zzz.bot accepted the active credential. It does not
2219
+ prove write scope, room membership, or private-room workflow evidence; zzz.bot
2220
+ checks those when the approved message is sent.
2221
+
2222
+ ${EXIT_CODES_POINTER} (1 means zzz.bot refused, or the vault would not open)
2223
+ ${JSON_ERRORS}
2224
+ ${why("setup-adapter-zzz")}`;
2125
2225
  export const SETUP_CHANNEL_HELP = `approval setup channel — configure one channel's transport credential (HUMAN-ONLY)
2126
2226
 
2127
2227
  Usage:
@@ -2190,6 +2290,28 @@ ${why("setup-service")}`;
2190
2290
  // ---------------------------------------------------------------------------
2191
2291
  // The MCP wrapper (APRV-87)
2192
2292
  // ---------------------------------------------------------------------------
2293
+ export const CODEX_HELP = `approval codex — prepare and inspect a constrained Codex host bundle (INERT)
2294
+
2295
+ Usage:
2296
+ approval codex prepare --instance <id> --workspace <abs> --primary <abs>
2297
+ --install-root <abs> --output <new-dir> --codex <abs> --node <abs> [--json]
2298
+ approval codex setup --check <bundle-dir> [--json]
2299
+ approval codex doctor --strict --manifest <abs> [--json]
2300
+ approval codex start|serve --manifest <abs> [--json]
2301
+
2302
+ prepare writes a fresh review bundle only. setup --check verifies its closed file
2303
+ set, hashes, manifest and generated templates. Neither installs a package, edits
2304
+ Codex configuration, creates principals, loads services, reads credentials, or
2305
+ changes policy. doctor fails closed on unknown custody, executes no manifest
2306
+ binary in this slice, and reports runtime versions as unchecked.
2307
+
2308
+ start and serve currently refuse with codex-not-ready. The policy-bound broker
2309
+ and confined runner arrive in APRV-325.2 and APRV-325.3. An npm or project
2310
+ installation alone is never reported as enforcement.
2311
+
2312
+ ${EXIT_CODES_POINTER} (1 means the strict boundary is absent or invalid)
2313
+ ${JSON_ERRORS}
2314
+ why: docs/cli-reference.md#constrained-codex-preparation`;
2193
2315
  export const MCP_HELP = `approval mcp serve — the MCP wrapper of SPEC.md §10.5 (FOREGROUND)
2194
2316
 
2195
2317
  Usage:
@@ -1 +1 @@
1
- {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoSvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;EAiBzB,qBAAqB;;EAErB,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;EAc1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;EAiB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;6DACwC,CAAC;AAE9D,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC"}
1
+ {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+SvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;sCAqBc,kBAAkB;EACtD,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;EAoBzB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;EAiBzB,qBAAqB;;EAErB,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB7B,kBAAkB;EAClB,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;EAc1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;EAiB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;iEAC4C,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;EAcpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,kBAAkB;EAClB,WAAW;yDAC4C,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC"}
@@ -0,0 +1,78 @@
1
+ /**
2
+ * The Codex-specific edge of `approval hook codex` (APRV-311).
3
+ *
4
+ * Codex currently uses the same outer hook envelope as Claude Code, but its
5
+ * input and outcome contracts are independent. Keeping the readings here
6
+ * prevents a Claude event name or a Claude tool-response shape from becoming
7
+ * evidence about a Codex execution.
8
+ */
9
+ /** The only Codex events this adapter understands. */
10
+ export declare const CODEX_PRE_TOOL_EVENT = "PreToolUse";
11
+ export declare const CODEX_POST_TOOL_EVENT = "PostToolUse";
12
+ export interface CodexHookInput {
13
+ sessionId: string;
14
+ sessionIdPresent: boolean;
15
+ cwd: string;
16
+ toolName: string;
17
+ toolInput: Record<string, unknown>;
18
+ toolUseId: string | null;
19
+ hookEventName: string | null;
20
+ /** Preserved verbatim so a future native reading does not inherit Claude's object-only parse. */
21
+ toolResponseRaw: unknown;
22
+ }
23
+ export type CodexInputCheck = {
24
+ ok: true;
25
+ phase: "pre" | "post";
26
+ } | {
27
+ ok: false;
28
+ detail: string;
29
+ };
30
+ /**
31
+ * Validate the closed Codex hook surface before it reaches shared gate code.
32
+ *
33
+ * The process directory is the directory the hook can establish itself. The
34
+ * event's `cwd` is self-reported, so it may agree with that directory but may
35
+ * not select a different payload binding. Both paths are resolved through the
36
+ * filesystem so a symlink spelling of the same directory does not create a
37
+ * false mismatch.
38
+ */
39
+ export declare function checkCodexHookInput(input: CodexHookInput, processCwd: string): CodexInputCheck;
40
+ export type CodexOutcomeReading = {
41
+ ok: true;
42
+ outcome: "completed" | "failed";
43
+ } | {
44
+ ok: false;
45
+ detail: string;
46
+ };
47
+ /**
48
+ * Read a Codex outcome only from a native-observed, closed contract.
49
+ *
50
+ * The native 0.152.1 probe observed the same empty-string `tool_response` for
51
+ * successful and non-zero Bash calls, and the documented value remains
52
+ * arbitrary JSON with no stable status key. Its raw value is intentionally
53
+ * accepted and ignored. Until a native probe records a discriminating
54
+ * contract, appending either outcome would fabricate it.
55
+ */
56
+ export declare function readCodexReportedOutcome(_input: CodexHookInput): CodexOutcomeReading;
57
+ export interface CodexBinding {
58
+ /** Exact bytes the gate and a future counterpart both bind. */
59
+ payload: {
60
+ tool: "Bash" | "apply_patch";
61
+ command: string;
62
+ cwd: string;
63
+ };
64
+ /** Passed to the legacy finish helper; reconstructs the four-segment task. */
65
+ finishSessionId: string;
66
+ finishToolUseId: string;
67
+ task: string;
68
+ }
69
+ /**
70
+ * Build the one Codex tool-call identity used by both pre and post phases.
71
+ *
72
+ * Native ids may contain colons, so they never enter the colon-delimited task
73
+ * directly. The session digest preserves per-session loop scope; the call
74
+ * digest additionally binds tool semantics, command bytes, and established
75
+ * process directory. Fixed-width digests make the encoding injective at the
76
+ * task grammar boundary.
77
+ */
78
+ export declare function codexBinding(input: CodexHookInput, processCwd: string): CodexBinding;