approval-md 0.1.0 → 0.3.0

package/dist/src/cli/adapter.js

@@ -1,5 +1,5 @@
 /**
- * `approval adapter <name>` — execute an approved action through the adapter
+ * `approval adapter <name>` — execute an action through the adapter
  * contract (SPEC.md §10.4; APRV-69, generalized in APRV-221).
  *
  * This is the CLI face of the adapters in {@link ADAPTER_CLIS} (`email` at
@@ -15,7 +15,7 @@
  * that reimplemented any of them would be a second implementation of the rule.
  *
  * **Why the payload is a file (or stdin) and never a flag.** The bytes are the
- * thing the grant approved, they routinely contain newlines, quotes and a
+ * thing the grant or registered declaration bound, they routinely contain newlines, quotes and a
  * £-sign, and a message body on a command line is a message body in the shell
  * history and in `ps` output. `approval payload hash <file|->` and
  * `approval request --payload <file>` take the same argument in the same form,
@@ -37,21 +37,22 @@
  * | Situation | Code |
  * |---|---|
  * | the message was accepted by the far side | 0 |
- * | usage: a missing flag, a bad identity, an unparseable payload | 2 |
+ * | usage: a missing required flag, a bad identity, an unparseable payload | 2 |
  * | I/O: the payload file or the log could not be read | 4 |
  * | `token-required` — no token was presented | 5 |
  * | `log-torn-tail`, or an append that hit a torn tail | 3 |
  * | anything else the runtime decided: `token-mismatch`, `token-consumed`, `payload-mismatch`, `adapter-class-mismatch`, `adapter-precheck-refused` (a drifted draft), `adapter-failed` (an SMTP refusal), `adapter-act-threw` | 1 |
  *
- * A refused SEND is exit 1 and not 5: the command was well-formed, the token was
- * good, and the answer from the world was no. Only the absence of a valid token
- * earns 5, which is the distinction `run` already draws and the one an agent's
- * retry logic keys on.
+ * A refused SEND is exit 1 and not 5: the command was well-formed and the
+ * answer from the world was no. Exit 5 is the manual-path redirection to obtain
+ * a grant token, which is the distinction `run` already draws and the one an
+ * agent's retry logic keys on.
  */
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve as resolvePathSegments } from "node:path";
 import { agentmailAdapter } from "../adapters/agentmail.js";
 import { emailAdapter } from "../adapters/email.js";
+import { zzzAdapter } from "../adapters/zzz.js";
 import { vaultCredentialProvider } from "../adapters/vault-provider.js";
 import { executeThroughAdapter, } from "../adapters/contract.js";
 import { HUMAN_ACTOR_ENV, resolveHumanActor } from "../core/attest.js";
@@ -61,7 +62,7 @@ import { passphraseEnvFor, vaultPathFor } from "../core/vault.js";
 import { boolFlag, parseFlags, stringFlag } from "./args.js";
 import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
 import { executeRefusalExitCode } from "./execute.js";
-import { ADAPTER_AGENTMAIL_HELP, ADAPTER_EMAIL_HELP, ADAPTER_HELP } from "./help.js";
+import { ADAPTER_AGENTMAIL_HELP, ADAPTER_EMAIL_HELP, ADAPTER_HELP, ADAPTER_ZZZ_HELP } from "./help.js";
 import { DEFAULT_LOG_PATH, resolvePath } from "./paths.js";
 import { refusal as renderRefusal, style } from "./style.js";
 import { usageErrorText } from "./usage.js";
@@ -84,6 +85,10 @@ export const ADAPTER_CLIS = {
         help: ADAPTER_AGENTMAIL_HELP,
         build: (options) => agentmailAdapter(options),
     },
+    zzz: {
+        help: ADAPTER_ZZZ_HELP,
+        build: (options) => zzzAdapter(options),
+    },
 };
 /** The known names, sorted, for a usage error and for the help text. */
 export function knownAdapterNames() {
@@ -93,7 +98,7 @@ export function knownAdapterNames() {
 const PRINCIPAL_ACTOR = /^(human|agent):.+/u;
 /**
  * The flags every adapter verb takes. One set and not one per adapter: what the
- * runtime needs in order to execute an approved action (the token, the bytes,
+ * runtime needs in order to execute an action (the optional token, the bytes,
  * the identity, the log, the vault) is the same question whoever answers it,
  * and a per-adapter flag table would be a per-adapter way to drift from
  * `approval run`. An adapter with a flag of its own adds it here, beside these.
@@ -143,7 +148,7 @@ function refusalExit(result) {
     return result.execute === undefined ? EXIT_INTEGRITY : executeRefusalExitCode(result.execute);
 }
 /**
- * `approval adapter <name> <action-key> --token <t> --payload <file|->`.
+ * `approval adapter <name> <action-key> [--token <t>] --payload <file|->`.
  *
  * One implementation for every entry in {@link ADAPTER_CLIS}: the name and the
  * entry are arguments, and everything this function does (the flags, the
@@ -170,13 +175,14 @@ export async function commandAdapterExecute(name, entry, argv, streams, cwd) {
     if (extra !== undefined) {
         return usageError(streams, json, `unexpected argument ${JSON.stringify(extra)}`, help);
     }
+    // Optional for the same reason it is optional on `approval run`: the core
+    // admits an explicitly policy-authorized supervised/autonomous execution
+    // without minting a grant. Manual and selected-live paths still reach
+    // `startExecution` and refuse `token-required`; this CLI never invents one.
     const token = stringFlag(flags, "--token");
-    if (token === null) {
-        return usageError(streams, json, "missing --token <t>: an adapter executes only against the single-use token `approval grant` printed", help);
-    }
     const payloadFlag = stringFlag(flags, "--payload");
     if (payloadFlag === null) {
-        return usageError(streams, json, "missing --payload <file|->: the bytes the grant approved. There is no flag that takes the message inline — a body on a command line is a body in the shell history", help);
+        return usageError(streams, json, "missing --payload <file|->: the bytes the grant or registered declaration bound. There is no flag that takes the message inline — a body on a command line is a body in the shell history", help);
     }
     const asFlag = stringFlag(flags, "--as");
     const actor = asFlag === null ? resolveHumanActor() : asFlag;
@@ -233,7 +239,11 @@ export async function commandAdapterExecute(name, entry, argv, streams, cwd) {
         // this and keeps the old behaviour exactly.
         envFilePath: envFilePathFor(logPath),
     });
-    const result = await executeThroughAdapter(entry.build(timeoutMs === null ? {} : { timeoutMs }), { logPath, actionKey, payload, actor }, { token, policy: policyLocation, credentials });
+    const result = await executeThroughAdapter(entry.build(timeoutMs === null ? {} : { timeoutMs }), { logPath, actionKey, payload, actor }, {
+        ...(token === null ? {} : { token }),
+        policy: policyLocation,
+        credentials,
+    });
     if (!result.ok) {
         if (json)
             streams.err(`${JSON.stringify(result)}\n`);

package/dist/src/cli/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/cli/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkB5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoC;IAC3D,KAAK,EAAE;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;KAC1C;IACD,SAAS,EAAE;QACT,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC;KAC9C;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,uEAAuE;AACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,aAAa,GAA6B;IAC9C,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAA4C;IAC/D,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,KAAsB,EACtB,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,qGAAqG,EACrG,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,oKAAoK,EACpK,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,oBAAoB,eAAe,kDAAkD;YACvF,CAAC,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAC1E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,yDAAyD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACtF,IAAI,CACL,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,gCAAgC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,2JAA2J,EACvM,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,uBAAuB,CACzC,EAAE,SAAS,EAAE,EACb;QACE,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3D,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,2DAA2D;QAC3D,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;KACrC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EACpD,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EACtC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,CAC/C,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChD,CAAC;YACJ,OAAO,CAAC,GAAG;YACT,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,GAAG,aAAa,CACd,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EACf,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,GAAG,EAAE,EACvF,MAAM,CAAC,OAAO,CACf,IAAI,CACN,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAChD,CAAC;QACJ,OAAO,CAAC,GAAG,CACT,QAAQ,SAAS,gBAAgB,IAAI,sCAAsC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpK,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,6CAA6C,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,8CAA8C,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpH,YAAY,CACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/cli/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEvG,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkB5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAoC;IAC3D,KAAK,EAAE;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC;KAC1C;IACD,SAAS,EAAE;QACT,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC;KAC9C;IACD,GAAG,EAAE;QACH,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KACxC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,uEAAuE;AACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,aAAa,GAA6B;IAC9C,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,MAA4C;IAC/D,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,KAAsB,EACtB,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,IAAI,CACL,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,2LAA2L,EAC3L,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,oBAAoB,eAAe,kDAAkD;YACvF,CAAC,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAC1E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,yDAAyD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACtF,IAAI,CACL,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,gCAAgC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,GAAG,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,2JAA2J,EACvM,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,uBAAuB,CACzC,EAAE,SAAS,EAAE,EACb;QACE,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3D,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,2DAA2D;QAC3D,uEAAuE;QACvE,sEAAsE;QACtE,4CAA4C;QAC5C,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;KACrC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EACpD,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EACtC;QACE,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACpC,MAAM,EAAE,cAAc;QACtB,WAAW;KACZ,CACF,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChD,CAAC;YACJ,OAAO,CAAC,GAAG;YACT,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,GAAG,aAAa,CACd,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EACf,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,GAAG,EAAE,EACvF,MAAM,CAAC,OAAO,CACf,IAAI,CACN,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAChD,CAAC;QACJ,OAAO,CAAC,GAAG,CACT,QAAQ,SAAS,gBAAgB,IAAI,sCAAsC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpK,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,6CAA6C,EAAE,YAAY,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,8CAA8C,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpH,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/src/cli/amend.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `approval policy amend` (APRV-30) — the one verb that owns the whole
+ * amendment ceremony: diff, advise, confirm, attest, commit.
+ *
+ * ## The two incidents this verb exists to prevent
+ *
+ * **seq 2 of this repository's own log — the seven-minute amendment.** A
+ * policy edit was attested and superseded seven minutes later (seq 2 at
+ * 11:56:07Z, seq 3 at 12:03:35Z), because the
+ * edit broke a pinned dogfood assertion and nobody found out until the test
+ * suite ran. The operator attested bytes whose *consequences* had never been
+ * shown to them. `amend` shows the semantic diff and the load advisory BEFORE
+ * asking for the sign-off, so the failure that superseded seq 2 would have been
+ * on screen while the human was deciding — and with `--require-load` it would
+ * have refused to attest at all.
+ *
+ * **The unsigned interregnum — commit `f829e6c` and its attestation.** The
+ * policy-editing commit and the attestation that made the edit operative landed
+ * as two separate commits. In between, the repository carried an inoperative
+ * policy: `checkAttestation` said `hash-mismatch` and every gate operation
+ * refused. `amend` closes that window by making the attestation and the git
+ * commit one ceremony — it prints, or with `--commit` runs, the exact two-file
+ * `git add` + `git commit` that lands the policy edit and its attestation
+ * together, and it validates the `--commit` preconditions BEFORE it attests, so
+ * a refusal can never leave a half-finished amendment behind.
+ *
+ * ## The baseline problem, stated plainly (FLAGGED FOR HUMAN REVIEW)
+ *
+ * A semantic diff needs the previously-attested policy *text*. The log does not
+ * have it. An attestation records only the SHA-256 of the bytes — deliberately,
+ * since the log is meant to be exported and copied and a policy body in it
+ * would be a second source of truth. So the attested bytes are **not
+ * recoverable from the log**, and this verb does not pretend otherwise.
+ *
+ * What it does instead, at v0.1: when the policy file lives in a git
+ * repository, it recovers `HEAD:<path>` and hashes it. **Only if that blob's
+ * hash equals the attested hash** is it used as the diff baseline — the point
+ * being that we can then prove the text we are diffing against is exactly the
+ * text that was signed for. Anything else (not a git repo, no such blob, or a
+ * blob whose hash differs from the attestation) drops to **hash-only mode**: a
+ * loud notice that the semantic diff is unavailable, followed by the load
+ * advisory and the attestation, which still work. No `--baseline` flag is
+ * offered; a baseline the operator supplies by hand is a baseline nobody can
+ * verify, which is exactly the assurance this design refuses to fake.
+ *
+ * The limitation is real and worth a human's judgment: an amendment made
+ * outside git, or one made on top of an unattested working-tree edit, gets no
+ * semantic diff. Flagged rather than smoothed over.
+ *
+ * ## What this file does and does not decide
+ *
+ * As everywhere else in the CLI: the diff is `core/policy-diff.ts`, loading is
+ * `core/policy-load.ts`, matching is `core/policy-match.ts`, hashing and the
+ * append are `core/attest.ts`. This file resolves paths and identity, shells out
+ * to git, decides exit codes, and formats output.
+ */
+import type { Streams } from "./main.js";
+/** `approval policy amend …` — the whole ceremony, in one verb. */
+export declare function commandPolicyAmend(argv: string[], streams: Streams, cwd: string): number;