approval-md 0.1.0 → 0.3.0

package/dist/src/cli/help.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Help text. SPEC.md §10.1 makes `--help` part of the interface rather than a
+ * courtesy: the CLI is how agents use this system, and an agent that has to
+ * guess an exit code or a JSON key is an agent that will guess wrong on the one
+ * invocation that mattered. Every command therefore documents its flags, its
+ * refusal codes and its exact `--json` shape.
+ *
+ * WHAT A PER-VERB HELP IS (APRV-91): the usage forms, a short paragraph of
+ * intent, the flags, the machine-facing contract (`--json` shape, refusal
+ * codes), and a two-line footer. What it is NOT is an essay. The frozen
+ * exit-code table is printed by `approval --help` and nowhere else, the
+ * cross-cutting stances (identity is declared not proved, a refusal is exit 1,
+ * a token is shown once, a channel is transport) are stated once at the root,
+ * and the long design rationale lives in `docs/cli-reference.md`, which every
+ * trimmed help points at by anchor. The prose was moved, not rewritten.
+ */
+export declare const ROOT_HELP = "approval \u2014 human approval for agent actions (pre-release)\n\nUsage:\n  approval log verify [--log <path>] [--json]\n  approval log tail   [--log <path>] [-n <count>] [--json]\n  approval log export [--log <path>] [--json]\n  approval log follow [--log <path>] [--from <seq>] [--cursor-hash <64hex>] --json\n  approval instructions [--schemas] [--json]\n  approval init       [--dir <path>] [--json]\n  approval quickstart [--dir <path>] [--api-base <url>]      (interactive; no --json)\n  approval policy check|test <class> [--reversible true|false] [--policy <path>] [--dir <path>] [--json]\n  approval policy attest [--policy <path>] [--dir <path>] [--as human:<id>] [--json]\n  approval policy amend  [--policy <path>] [--dir <path>] [--log <path>]\n                      [--as human:<id>] [--require-load] [--dry-run] [--commit]\n                      [--yes] [--json]\n  approval register   <task-file> [--as <id>] [--log <path>] [--json]\n  approval request    <task> --action <key> [--as <id>] [--json]\n  approval grant|reject|revoke <action-key> [--note <text>] [--as human:<id>] [--json]\n  approval expire     <action-key> [--json]\n  approval token      <action-key> [--policy <path>] [--dir <path>] [--json]\n  approval consume    <action-key> --token <t> [--payload-hash <64hex>]\n                      [--as <id>] [--json]                            (internal)\n  approval run        <action-key> [--token <t>] [--payload-hash <64hex>]\n                      [--as <id>] [--no-sandbox] [--json] -- <cmd\u2026>\n  approval sandbox    [--allow-loopback] [--read-jail] [--log <path>] -- <cmd\u2026>\n  approval adapter email <action-key> [--token <t>] --payload <file|->\n                      [--as <id>] [--vault <path>] [--timeout <ms>] [--json]\n  approval adapter agentmail <action-key> [--token <t>] --payload <file|->\n                      [--as <id>] [--vault <path>] [--timeout <ms>] [--json]\n  approval adapter zzz <action-key> [--token <t>] --payload <file|->\n                      [--as <id>] [--vault <path>] [--timeout <ms>] [--json]\n  approval execution resolve <action-key> --outcome completed|failed\n                      --note \"<text>\" [--as human:<id>] [--json]\n  approval execution reconcile <action-key>\n                      --resolution executed|not-executed\n                      --note \"<evidence>\" [--as human:<id>] [--json]\n  approval audit list|review [<seq|action-key>] [--note \"<text>\"]\n                      [--as human:<id>] [--all] [--json]\n  approval wait       <task> --timeout <duration> [--interval <d>]\n                      [--withdraw-on-timeout] [--json]\n  approval withdraw   <task> --action <key> [--reason <r>] [--note \"<text>\"]\n                      [--as <id>] [--json]\n  approval queue      [--policy <path>] [--dir <path>] [--json]\n  approval coverage   [--base <ref>] [--head <ref>] [--since <duration>]\n                      [--source git,gh,agentmail] [--json]\n  approval channel cli [--policy-dir <path>] [--payload-dir <path>]\n                      [--as human:<id>] [--interactive] [--json]\n  approval channel web [--port <n>] [--payload-dir <path>] [--as human:<id>]\n                      [--policy <path>] [--dir <path>] [--log <path>] [--json]\n  approval channel telegram listen|health [--once] [--as human:<id>] [--json]\n  approval daemon run [--tasks <dir>] [--out <path>] [--interval <duration>]\n                      [--debounce <duration>] [--once] [--with-channels] [--json]\n  approval up         [--as human:<id>] [--port <n>] [--no-telegram] [--no-web]\n                      [--restart-backoff <d>] (plus every daemon run flag)\n  approval setup service [--platform launchd|systemd] [--uninstall]\n                      [--label <name>] [--logs <dir>] [--env-file <path>]\n  approval gate open|close|status [--for <d>] [--reason \"<t>\"] [--note \"<t>\"]\n                      [--as human:<id>] [--log <path>] [--json]\n                                              (open: terminal only, no --json)\n  approval status     [--policy <path>] [--dir <path>] [--json]\n  approval doctor     [--log <path>] [--policy <path>] [--dir <path>]\n                      [--api-base <url>] [--json]\n  approval payload hash <file|-> [--json]\n  approval payload agentmail-draft <inbox-id> <draft-id> [--api-base <url>]\n                      [--json]\n  approval journal write --message \"<text>\" | - [--task <id>] [--session <id>]\n                      [--as <id>] [--journal <dir>] [--json]\n  approval journal read [--limit <n>] [--since <YYYY-MM-DD>] [--journal <dir>]\n                      [--json]\n  approval values     [--policy <path>] [--dir <path>] [--json]\n  approval feedback   [--task <id>] [--actor <agent id>] [--reaction <word>]\n                      [--source review|decision] [--since <YYYY-MM-DD>]\n                      [--limit <n>] [--log <path>] [--json]\n  approval env        [--check] [--policy <path>] [--dir <path>] [--log <path>]\n                      [--json]\n  approval setup      identity|vault|sampling|channel <name>|adapter <name>\n                      [--as human:<id>] [--api-base <url>] [--policy <path>]\n                      [--dir <path>] [--log <path>]        (interactive; no --json)\n  approval vault set <name> [--value-env <VAR>] [--as human:<id>] [--json]\n  approval vault list|remove [<name>] [--as human:<id>] [--json]\n  approval hook claude-code [--as agent:<id>] [--timeout <duration>]\n                      [--interval <d>] [--policy <path>] [--dir <path>]\n                      [--log <path>]                    (reads PreToolUse JSON)\n  approval hook cursor [--as agent:<id>] [--timeout <duration>]\n                      [--interval <d>] [--policy <path>] [--dir <path>]\n                      [--log <path>]                    (reads preToolUse JSON)\n  approval hook classify [--json] [--policy <path>] [--dir <path>] -- <command\u2026>\n  approval import agents-md <file> [--out <path>] [--json]\n  approval codex      prepare|setup|doctor|start|serve (strict host workflow)\n  approval mcp serve  --as agent:<id> [--dir <path>] [--log <path>]\n                      [--policy <path>]              (MCP over stdio; foreground)\n  approval reindex    [--log <path>] [--index <path>] [--force] [--json]\n  approval render     [--log <path>] [--out <path>] [--policy <path>]\n                      [--dir <path>] [--json]\n  approval --help\n\nSet up \u2014 make this directory and this machine ready:\n  init      scaffold a working directory: APPROVAL.md (SPEC.md \u00A75.1's canonical\n            policy, to be read and edited), the empty .approval/log/ directory,\n            .approval/QUEUE.md in its empty state, and the .gitignore lines for\n            the index, the vault, the environment source map and the\n            atomic-write temp files. Appends\n            nothing, attests nothing, overwrites nothing; a re-run writes\n            nothing and reports what already exists\n  quickstart ask three decisions, write a solo policy with the named human as\n            its sole approver, configure identity and an optional Telegram\n            channel, show the exact bytes, then require typed `understood`\n            before attesting. HUMAN-ONLY and INTERACTIVE ONLY\n  setup     the WRITER for that file: \"setup identity|vault|sampling\" and\n            \"setup channel <name>\" store each secret in the OS keystore and\n            record where it lives, and \"setup adapter <name>\" fills the VAULT\n            from the credential manifest the adapter itself declares, then\n            proves it against the service without sending anything. The two\n            nouns are SPEC.md \u00A74's: a channel holds no state and needs a\n            transport credential, an adapter holds the credentials a side\n            effect spends. INTERACTIVE ONLY \u2014 it refuses a\n            non-terminal stdin and --json, and prints the exact commands to run\n            instead, because a setup a pipe could drive would let a CI job\n            declare a human identity. It appends nothing to the log, attests\n            nothing, and never edits APPROVAL.md\n  vault     the encrypted credential store adapters read from (SPEC.md \u00A710.4).\n            \"vault set|list|remove\" are HUMAN-ONLY; list shows NAMES and never\n            values, and there is no \"vault get\" \u2014 a credential's only sanctioned\n            journey is from .approval/vault.enc into an adapter, inside the\n            verified execution window. The passphrase comes from the environment\n            variable the policy NAMES (vault.passphrase_env), never from a flag\n  env       resolve .approval/env \u2014 the environment SOURCE MAP \u2014 and print an\n            export block for your shell to evaluate. THE ONLY VERB THAT READS\n            THAT FILE: no command loads it implicitly, because human identity is\n            one of the variables it carries and a working-tree file any process\n            read on its own would let anything able to write it act as you. The\n            default output carries secrets by design; \"env --check\" prints a\n            table with no values on any path\n  policy    explain what APPROVAL.md does with an action class (check | test),\n            record a human's sign-off on the policy file (attest), or run the\n            whole amendment ceremony \u2014 semantic diff, load advisory,\n            attestation, and the two-file git commit \u2014 as one verb (amend)\n  import    \"import agents-md\" parses an AGENTS.md-style permissions section\n            into DRAFT policy classes for a human to confirm (SPEC.md \u00A712). It\n            prints; it never writes APPROVAL.md, never logs, never attests\n\nAsk \u2014 an agent declares an action and acts on the answer:\n  instructions\n            the full AGENT-FACING usage guide: what to declare before acting,\n            the register -> request -> wait -> run sequence, what a refusal\n            means, and the invariants an agent must not route around. With\n            --schemas it prints the verb registry as JSON \u2014 purpose, input and\n            output schemas, exit codes and the human-only marker for every verb\n            \u2014 which is the same source the optional MCP wrapper (SPEC.md \u00A710.5)\n            builds its tools from. Reads nothing, writes nothing\n  register  validate a task envelope and append task.registered\n  request   ask the gate to admit a declared action (manual classes append\n            approval.requested; supervised/autonomous append nothing and\n            proceed straight to execution, per amended SPEC.md \u00A76.3)\n  token     report whether a live single-use execution token exists for an\n            action (the RAW token is printed once, by grant, and stored nowhere)\n  consume   spend a token and append execution.started (internal plumbing;\n            \"approval run\" wraps it)\n  run       execute a command behind the gate: appends execution.started before\n            spawning it, execution.completed/failed with the child's exit code\n            after, and exits with that same code\n  adapter   execute an action through a side-effect adapter, the hard\n            boundary of SPEC.md \u00A710.4. \"adapter email\" sends one RFC 5322\n            message over SMTP for a communicate.email.external action: the\n            credentials come from the vault inside the execution window, the\n            payload is the bytes the declaration or grant bound to, and the\n            runtime recomputes the hash, applies policy, and writes both\n            execution events around the send. Manual and selected-live paths\n            require --token; policy-authorized supervised/autonomous paths do\n            not mint one. \"adapter agentmail\" serves the\n            same class over the AgentMail API: a direct send, or the send of a\n            draft the agent composed, refused if the draft changed after the\n            snapshot a human approved\n  wait      block until a task's requests are decided; the exit code IS the\n            decision (0 granted, 1 rejected/revoked/withdrawn, 3 expired, 6 timeout)\n  withdraw  take back your OWN pending request (timeout, cancelled, superseded);\n            terminal, requester-only, and a late grant then authorizes nothing\n  hook      put the gate in front of an agent HARNESS. \"hook claude-code\" and\n            \"hook cursor\" each read their harness's pre-tool event on stdin,\n            classify the command or protected-path edit it is about to run,\n            resolve the class against APPROVAL.md, and answer allow or deny \u2014\n            waiting on a real approval decision when the class is manual. They\n            never answer \"ask\": a decision taken outside the log is a decision\n            nothing can audit. \"hook classify\" prints what the classifier makes\n            of a command and touches nothing\n  journal   the one channel the gate does NOT stand in front of. \"journal write\"\n            appends free text to a local file \u2014 ungated, unclassified, never\n            approvable and never deniable, with no event in the log \u2014 so an\n            agent can say \"I am complying and I think this is wrong\", \"this\n            reads as odd to me\", or \"I am stuck\" even when it is complying\n            perfectly. \"journal read\" is the human side, and it labels every\n            entry as agent-authored DATA. Nothing written there changes any\n            verdict, sampling probability or budget; it is signal for the\n            operator, not a decision surface\n  values    the mirror of \"journal\", running the other way: the operator's own\n            words, in the optional values block of APPROVAL.md. What they value\n            in the work, what they want from an agent, and how they read and\n            answer. It is GUIDANCE and never policy: it grants nothing, forbids\n            nothing, and no enforcement path reads it. A file with no block says\n            so in words, because \"nothing was declared\" and \"I did not look\" are\n            different facts\n  feedback  the same channel in the other direction: what the OPERATOR said\n            about the work. Lists the reactions and notes a person wrote on a\n            grant or on a retrospective review, joined to the class, the task,\n            the action key and the agent it was about. HUMAN-AUTHORED GUIDANCE\n            and never policy \u2014 it grants nothing, forbids nothing, and changes\n            no verdict, sampling probability or budget. Reads a verified log\n            and writes nothing\n  mcp       \"mcp serve\" is the optional MCP wrapper of SPEC.md \u00A710.5: the same\n            verbs as tools, over stdio, sharing the CLI's code paths. It is\n            AGENT-FACING ONLY \u2014 grant, reject, revoke, attest, amend, vault,\n            setup, audit review, expire, execution resolve|reconcile and the\n            channels are not published, because an MCP client is an agent's\n            harness and SPEC.md \u00A711 makes the agent the untrusted policy. It\n            runs as ONE agent identity, fixed at startup, that nothing changes\n\nDecide \u2014 a human answers, and only a human can:\n  queue     the pending-decision INBOX: requests awaiting a human, inside their\n            TTL. Nothing else \u2014 exit 0 always when the log could be read\n  grant     record a human approval          (HUMAN-ONLY)\n  reject    record a human refusal           (HUMAN-ONLY)\n  revoke    withdraw an unexecuted approval  (HUMAN-ONLY)\n  expire    lapse a request whose TTL passed (system verb, actor system:gate)\n  execution recovery verbs for executions the runtime could not close itself.\n            \"execution resolve\" records the outcome a HUMAN OBSERVED for a\n            dangling execution: mandatory --note, human-only, exit_code null,\n            attested_by_human true. \"execution reconcile\" records what a human\n            ESTABLISHED about an INDETERMINATE one \u2014 a side effect that was\n            attempted and whose outcome nobody knows \u2014 from the relying party's\n            evidence, naming the record it resolves and rewriting nothing.\n            Neither requires attestation: both record a fact a human observed\n            and exercise no policy authority\n  audit     \"audit list\" is the open sampled-audit backlog and \"audit review\" is\n            the HUMAN-ONLY verb that closes one item of it. Sampling itself has\n            no verb: the daemon selects supervised actions with an operator-held\n            secret, because a caller who could sample could also decline to\n            sample itself\n  channel   put pending requests in front of a human over the channel contract.\n            \"channel cli\" renders the queue with [computed]/[claimed] markers and\n            the full payload in delimiters, and with a terminal collects\n            decisions through the same human-only gate as grant/reject.\n            \"channel telegram listen\" delivers the queue to a Telegram chat on\n            every poll cycle (including requests that arrive while it runs) and\n            long-polls for Approve/Reject taps; config is environment-only\n            (APPROVAL_TG_TOKEN, APPROVAL_TG_CHAT)\n\nInspect \u2014 what the log says, and whether anything needs repair:\n  log       inspect the append-only event log (verify | tail | export)\n  status    system HEALTH: attestation, dangling executions, budget headroom,\n            the latest chain verdict, loop escalations. Exit 1 when any of\n            those needs attention. queue is what a human must answer; status is\n            what an operator must fix, and neither carries the other's content\n  coverage  what the witnesses this project does NOT write (git, gh, a\n            provider's own record) say happened, joined to the verified log:\n            per effect, the evidence seq or none. INFORMATIONAL \u2014 exit 0 with\n            or without gaps, because a coverage measurement is not a verdict\n  doctor    is this ENVIRONMENT sane? build freshness, declared identity, policy\n            attestation, chain health, the Telegram token, the web port \u2014 each\n            with a concrete repair. status asks whether the SYSTEM needs\n            attention; doctor asks whether the machine you are typing on can run\n            the system at all. Appends nothing, sends nothing, repairs nothing\n  render    regenerate .approval/QUEUE.md, the READ-ONLY markdown queue\n            projection (SPEC.md \u00A79.1): pending requests and the sampled-audit\n            backlog, computed and claimed fields visibly distinguished. The\n            screenshot, never the truth \u2014 editing it authorizes nothing\n  reindex   rebuild the SQLite index projection from the log\n  payload   \"payload hash\" prints the payload_hash of a JSON document (SHA-256\n            over its RFC 8785 canonical serialization), the value a declaration\n            carries and a grant binds to. Most flows never need it: \"request\n            --payload\" hashes, verifies and stores the bytes in one step.\n            \"payload agentmail-draft\" snapshots one AgentMail draft with the\n            AGENT's key, so a human approves the words and not a draft id\n  daemon    \"daemon run\" is the watch loop of SPEC.md \u00A710.2, in the FOREGROUND:\n            it records envelope.drift when a task file's state: contradicts the\n            log, appends approval.expired for lapsed requests, writes the log's\n            state back into the task files, regenerates QUEUE.md, and surfaces\n            loop escalations. It holds no lock; backgrounding is the operator's\n            business in v0.1\n  up        the AMBIENT RUNTIME: that same daemon loop plus every channel the\n            policy configures, in ONE supervised foreground process. A channel\n            whose credential is unset is not started and says so in doctor's\n            vocabulary; a channel that falls over is restarted with a doubling\n            backoff and the daemon loop carries on. \"approval setup service\"\n            writes the launchd or systemd user unit that runs it at login\n\nDefaults:\n  log    .approval/log/events.jsonl   (relative to the working directory)\n  index  .approval/index.sqlite\n  queue  .approval/QUEUE.md\n  payloads .approval/payloads/<payload_hash>.json  (the bytes a request bound\n           to, written by request --payload; read by render and every channel,\n           and re-hashed on every read)\n  env    .approval/env  (the environment SOURCE MAP: KEY=keychain:<service> /\n         secret-service:<label> / env: / a plaintext literal. Mode 0600, and read\n         by exactly one command, \"approval env\". GITIGNORED by init)\n  journal .approval-journal/YYYY-MM-DD.jsonl  (the ungated free-text channel of\n         \"journal write\". OUTSIDE the approval home on purpose: everything under\n         .approval/ is the gate's own, and an outlet the gate could close is not\n         an outlet. Nothing the runtime reads is ever stored there. Gitignored)\n  vault  .approval/vault.enc  (AES-256-GCM over the named credentials; written\n         only by \"vault set|remove\", read only by an adapter inside a verified\n         token window. GITIGNORE IT \u2014 doctor fails if you have not)\n\nExit codes (frozen public API):\n  0  success\n  1  integrity failure (corrupt log)\n  2  usage error\n  3  torn tail\n  4  I/O error (unreadable/unwritable path; never reported as corruption)\n\nTwo codes are ADDITIONS to the table above, each emitted by exactly one verb:\n5 by \"approval run\" when no valid execution token was presented (nothing is\nappended), and 6 by \"approval wait\" on timeout. Nothing in 0\u20134 changed meaning.\nThis table is printed HERE and nowhere else; a verb's own --help names only the\ncodes that are peculiar to it.\n\nMachine-readable output: every command accepts --json and prints exactly one\nJSON object per invocation. Run \"approval <command> --help\" for that command's\nexact shape.\nWith --json, usage and I/O failures print {\"error\":{\"code\",\"message\"}} to\nstderr and nothing to stdout.\n\nThe stances every verb inherits, stated once:\n\n  THE LOG IS APPEND-ONLY. \"policy attest\" and the gate verbs (register, request,\n  grant, reject, revoke, expire) each append at most one event per invocation; a\n  torn tail is reported, never repaired, and nothing ever rewrites a line.\n\n  A GATE REFUSAL exits 1, NOT 2 \u2014 an illegal transition, an expired request, an\n  unattested policy, a failed budget. The command was well-formed; the answer is\n  no. With --json, error.code names the refusal, and retrying with different\n  flags is the wrong repair.\n\n  IDENTITY IS CONFIG-DECLARED (SPEC.md \u00A711). The actor comes from --as or\n  APPROVAL_HUMAN and nothing authenticates it; the trust boundary is the local\n  machine. What the log proves is that someone with local control acted, not\n  who. grant, reject, revoke and every human-only verb require human:<id>;\n  expire is the system verb and takes no identity.\n\n  APPROVAL EVENTS ARE EXCLUSIVE TO THE MANUAL PATH (amended SPEC.md \u00A76.3). An\n  action resolving to supervised or autonomous emits no approval.requested and\n  no approval.granted: \"approval request\" appends nothing and reports\n  proceed:true, and its authorization is the execution.started event. Do not\n  wait for a grant that will never come.\n\n  THE RAW EXECUTION TOKEN IS SHOWN ONCE, BY \"approval grant\". The log records\n  only its SHA-256, so nothing can recover it \u2014 not \"approval token\", not the\n  log, not the index. If it is lost, revoke the grant and request again.\n\n  A CHANNEL IS TRANSPORT. It renders what the runtime derived and reports the\n  gesture a human made; it decides nothing, holds no state, writes no log line\n  and never sees a token. Every field it shows is marked [computed] (the runtime\n  derived it) or [claimed] (the party under oversight wrote it), per SPEC.md \u00A79.\n\nThe reasoning behind each verb \u2014 threat models, the design points that surprise\npeople, the alternatives that were rejected \u2014 is in docs/cli-reference.md.";
+export declare const INSTRUCTIONS_HELP: string;
+export declare const LOG_HELP: string;
+export declare const FOLLOW_HELP: string;
+export declare const LOG_SYNC_HELP: string;
+export declare const LOG_ADVANCE_HELP: string;
+export declare const VERIFY_HELP: string;
+export declare const LOG_CHECKPOINT_HELP: string;
+export declare const TAIL_HELP: string;
+export declare const EXPORT_HELP: string;
+export declare const POLICY_HELP: string;
+export declare const POLICY_APPLY_HELP: string;
+export declare const POLICY_CHECK_HELP: string;
+export declare const POLICY_TEST_HELP: string;
+export declare const POLICY_ATTEST_HELP: string;
+export declare const POLICY_AMEND_HELP: string;
+export declare const REGISTER_HELP: string;
+export declare const REQUEST_HELP: string;
+export declare const GRANT_HELP: string;
+export declare const REJECT_HELP: string;
+export declare const REVOKE_HELP: string;
+export declare const WITHDRAW_HELP: string;
+export declare const EXPIRE_HELP: string;
+export declare const GATE_WINDOW_HELP: string;
+export declare const REINDEX_HELP: string;
+export declare const TOKEN_HELP: string;
+export declare const CONSUME_HELP: string;
+export declare const RUN_HELP: string;
+export declare const SANDBOX_HELP: string;
+export declare const WAIT_HELP: string;
+export declare const QUEUE_HELP: string;
+export declare const STATUS_HELP: string;
+export declare const COVERAGE_HELP: string;
+export declare const DOCTOR_HELP: string;
+export declare const AUDIT_HELP: string;
+export declare const AUDIT_LIST_HELP: string;
+export declare const AUDIT_REVIEW_HELP: string;
+export declare const AUDIT_OBLIGATIONS_HELP: string;
+export declare const AUDIT_RECONCILE_HELP: string;
+export declare const EXECUTION_HELP: string;
+export declare const RESOLVE_HELP: string;
+export declare const RECONCILE_HELP: string;
+export declare const CHANNEL_HELP: string;
+export declare const CHANNEL_CLI_HELP: string;
+export declare const WEB_HELP: string;
+export declare const INIT_HELP: string;
+export declare const QUICKSTART_HELP: string;
+export declare const HOOK_HELP: string;
+export declare const HOOK_GROK_HELP: string;
+export declare const HOOK_MUSE_HELP: string;
+export declare const IMPORT_HELP: string;
+export declare const IMPORT_AGENTS_MD_HELP: string;
+export declare const PAYLOAD_HELP: string;
+export declare const PAYLOAD_HASH_HELP: string;
+export declare const PAYLOAD_AGENTMAIL_DRAFT_HELP: string;
+export declare const JOURNAL_HELP: string;
+export declare const JOURNAL_WRITE_HELP: string;
+export declare const JOURNAL_READ_HELP: string;
+export declare const VALUES_HELP: string;
+export declare const FEEDBACK_HELP: string;
+export declare const RENDER_HELP: string;
+export declare const TELEGRAM_HELP: string;
+export declare const TELEGRAM_LISTEN_HELP: string;
+export declare const TELEGRAM_HEALTH_HELP: string;
+export declare const DAEMON_HELP: string;
+export declare const DAEMON_RUN_HELP: string;
+export declare const UP_HELP: string;
+export declare const VAULT_HELP: string;
+export declare const VAULT_SET_HELP: string;
+export declare const VAULT_LIST_HELP: string;
+export declare const VAULT_REMOVE_HELP: string;
+export declare const ADAPTER_HELP: string;
+export declare const ADAPTER_EMAIL_HELP: string;
+export declare const ADAPTER_AGENTMAIL_HELP: string;
+export declare const ADAPTER_ZZZ_HELP: string;
+export declare const ENV_HELP: string;
+export declare const SETUP_HELP: string;
+export declare const SETUP_IDENTITY_HELP: string;
+export declare const SETUP_VAULT_HELP: string;
+export declare const SETUP_SAMPLING_HELP: string;
+export declare const SETUP_SENDER_KEY_HELP: string;
+export declare const SETUP_CHECKPOINT_HELP: string;
+export declare const SETUP_ADAPTER_HELP: string;
+export declare const SETUP_ADAPTER_EMAIL_HELP: string;
+export declare const SETUP_ADAPTER_AGENTMAIL_HELP: string;
+export declare const SETUP_ADAPTER_ZZZ_HELP: string;
+export declare const SETUP_CHANNEL_HELP: string;
+export declare const SETUP_CHANNEL_TELEGRAM_HELP: string;
+export declare const SETUP_SERVICE_HELP: string;
+export declare const CODEX_HELP = "approval codex \u2014 prepare a constrained Codex host and broker its workspace writes\n\nUsage:\n  approval codex prepare --instance <id> --workspace <abs> --primary <abs>\n      --install-root <abs> --output <new-dir> --codex <abs> --node <abs> [--json]\n  approval codex setup --check <bundle-dir> [--json]\n  approval codex doctor --strict --manifest <abs> [--json]\n  approval codex apply --manifest <abs> --proposal <file> [--json]\n      [--token <class>=<token>]... [--require-exclusive-custody]\n  approval codex serve|recover --manifest <abs> [--json]\n  approval codex start --manifest <abs> [--timeout <dur>] [--json] [-- <cmd>...]\n\nprepare, setup --check and doctor are the inert half: a review bundle, its exact\nfile set and hashes, and host custody, executing no manifest binary. apply is the\nBROKER: a bounded create/replace/delete/move proposal, ONE ACTION PER PATH CLASS,\ngate-authorized, every leg started before any byte moves, then staged, journaled\nand applied under a workspace lock; the MANIFEST supplies actor, root, policy and\nlog. recover READS a retained journal, repairing nothing. serve is EXACTLY ONE MCP\ntool, separate from `approval mcp serve`. start CONFINES a shell: one disposable\nwritable path, read-only gate and workspace, no credentials, no egress, NO OPT-OUT.\n\nexit codes: approval --help (1: the boundary is absent, invalid, or the workspace mixed)\nWith --json, usage and I/O failures print {\"error\":{\"code\",\"message\"}} to\nstderr and nothing to stdout.\nwhy: docs/cli-reference.md#constrained-codex-preparation";
+export declare const MCP_HELP: string;