approval-md 0.1.0 → 0.3.0

package/dist/src/cli/quickstart.js

@@ -0,0 +1,297 @@
+/**
+ * `approval quickstart` (APRV-309): one human ceremony for a small, operative
+ * policy. The command is terminal-only, displays the exact bytes it will
+ * attest, and leaves any interrupted setup unattested.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute, join, resolve as resolvePathSegments } from "node:path";
+import { fileURLToPath } from "node:url";
+import { appendAttestation, HUMAN_ACTOR_ENV, policyBytesHash } from "../core/attest.js";
+import { SECRET_ENV_PREFIXES } from "../core/child-env.js";
+import { defaultSourceRunner, envFilePathFor, resolveEnvironment, upsertEnvFileEntries, } from "../core/env-file.js";
+import { loadPolicy, loadPolicyText } from "../core/policy-load.js";
+import { parseFlags, boolFlag, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_TORN_TAIL, EXIT_USAGE } from "./exit-codes.js";
+import { QUICKSTART_HELP } from "./help.js";
+import { commandInit } from "./init.js";
+import { DEFAULT_LOG_PATH } from "./paths.js";
+import { askUntil, createPrompter } from "./prompt.js";
+import { commandSetupChannel } from "./setup-channel.js";
+import { identityFromAnswer } from "./setup.js";
+import { usageErrorText } from "./usage.js";
+const FLAGS = {
+    "--dir": "string",
+    "--api-base": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+export const QUICKSTART_CLASSES = [
+    { pattern: "communicate.*", label: "send a message or email" },
+    { pattern: "financial.*", label: "spend money" },
+    { pattern: "files.delete.*", label: "delete files" },
+    { pattern: "public.*", label: "post publicly" },
+    { pattern: "vcs.push.main", label: "push to main" },
+];
+const DOCTOR_TIMEOUT_MS = 20_000;
+const DOCTOR_OUTPUT_LIMIT_BYTES = 256 * 1024;
+function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+function refusal(streams, message) {
+    streams.err(usageErrorText(message, QUICKSTART_HELP));
+    return EXIT_USAGE;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function nonInteractive(streams, json) {
+    const message = "quickstart needs a human at a terminal and has no JSON mode. Non-interactive equivalent: run `approval init`, write and review APPROVAL.md, run `approval setup identity`, optionally run `approval setup channel telegram`, then run `approval policy attest --as human:<id>`.";
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, QUICKSTART_HELP));
+    return EXIT_USAGE;
+}
+function channelAnswer(answer) {
+    switch (answer.trim().toLowerCase()) {
+        case "1":
+        case "terminal":
+        case "cli":
+            return { ok: true, value: "cli" };
+        case "2":
+        case "telegram":
+            return { ok: true, value: "telegram" };
+        default:
+            return { ok: false, reason: "choose 1 for this terminal or 2 for Telegram" };
+    }
+}
+function classesAnswer(answer) {
+    const typed = answer.trim().toLowerCase();
+    if (typed.length === 0 || typed === "all") {
+        return { ok: true, value: QUICKSTART_CLASSES.map((entry) => entry.pattern) };
+    }
+    if (typed === "none")
+        return { ok: true, value: [] };
+    const indexes = typed.split(",").map((part) => Number(part.trim()));
+    if (indexes.some((index) => !Number.isInteger(index) || index < 1 || index > QUICKSTART_CLASSES.length)) {
+        return { ok: false, reason: "enter comma-separated numbers 1-5, all, none, or press Enter for all" };
+    }
+    return {
+        ok: true,
+        value: [...new Set(indexes)].map((index) => QUICKSTART_CLASSES[index - 1]?.pattern),
+    };
+}
+function quickstartIdentity(answer) {
+    const parsed = identityFromAnswer(answer);
+    if (!parsed.ok)
+        return parsed;
+    const humanId = parsed.value.slice("human:".length);
+    return /^[a-z0-9][a-z0-9_-]*$/u.test(humanId)
+        ? parsed
+        : { ok: false, reason: "the id must start with a lowercase letter or digit and contain only lowercase letters, digits, _ or -" };
+}
+export function renderSoloPolicy(humanId, channel, patterns) {
+    const rules = patterns
+        .map((pattern) => `  ${pattern}:\n    autonomy: manual\n    approvers: [${humanId}]`)
+        .join("\n");
+    const channelBlock = channel === "telegram"
+        ? "\nchannels:\n  telegram:\n    chat_id_env: APPROVAL_TG_CHAT\n    token_env: APPROVAL_TG_TOKEN\n"
+        : "";
+    return `# Approval Policy\n\nThis is a solo policy. The selected class families ask the person below.\nOther classified reversible actions use the autonomous default. Runtime safety\nfloors and unclassified-command refusals still apply.\n\n\`\`\`yaml approval-policy\nversion: "0.1"\n\ndefaults:\n  autonomy: autonomous       # Tighten to manual to make every unnamed class ask.\n  channel: ${channel}\n  approval_ttl: 24h\n  on_expiry: reject\n\napprovers:\n  ${humanId}:\n    channels: [${channel}]\n\nclasses:\n${rules.length === 0 ? "  {}" : rules}\n${channelBlock}\`\`\`\n\nNo audit block means retrospective sampling is off. Add one only through a\nhuman-reviewed policy amendment; see \`approval policy amend --help\`.\n`;
+}
+function appendBounded(current, chunk, limit) {
+    const remaining = limit - Buffer.byteLength(current);
+    if (remaining <= 0)
+        return { text: current, overflow: true };
+    const bytes = Buffer.from(chunk);
+    if (bytes.byteLength <= remaining)
+        return { text: current + chunk, overflow: false };
+    return { text: current + bytes.subarray(0, remaining).toString("utf8"), overflow: true };
+}
+export function runQuickstartDoctor(dir, actor, resolvedEnv, apiBase, options = {}) {
+    return new Promise((resolve) => {
+        const env = { ...process.env };
+        // The check must not borrow identity or credentials from another instance.
+        // Only values explicitly resolved from this quickstart's source map return.
+        for (const name of Object.keys(env)) {
+            if (SECRET_ENV_PREFIXES.some((prefix) => name.startsWith(prefix)))
+                delete env[name];
+        }
+        Object.assign(env, resolvedEnv, { [HUMAN_ACTOR_ENV]: actor });
+        const cliEntry = fileURLToPath(new URL("./main.js", import.meta.url));
+        const childArgs = [cliEntry, "doctor", "--json", "--dir", dir];
+        if (apiBase !== null)
+            childArgs.push("--api-base", apiBase);
+        const child = (options.spawnChild ?? spawn)(process.execPath, childArgs, {
+            cwd: dir,
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const outputLimit = options.outputLimitBytes ?? DOCTOR_OUTPUT_LIMIT_BYTES;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        const abortForOutput = () => {
+            child.kill("SIGTERM");
+            finish({ code: EXIT_IO, stdout, stderr: `${stderr}approval doctor output exceeded ${String(outputLimit)} bytes and was stopped\n` });
+        };
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (text) => {
+            const next = appendBounded(stdout, text, outputLimit);
+            stdout = next.text;
+            if (next.overflow)
+                abortForOutput();
+        });
+        child.stderr.on("data", (text) => {
+            const next = appendBounded(stderr, text, outputLimit);
+            stderr = next.text;
+            if (next.overflow)
+                abortForOutput();
+        });
+        child.once("error", (cause) => finish({ code: EXIT_IO, stdout, stderr: `${stderr}${cause.message}\n` }));
+        child.once("close", (code) => finish({ code: code ?? EXIT_IO, stdout, stderr }));
+        const timer = setTimeout(() => {
+            child.kill("SIGTERM");
+            finish({ code: EXIT_IO, stdout, stderr: `${stderr}approval doctor exceeded ${String(options.timeoutMs ?? DOCTOR_TIMEOUT_MS)}ms and was stopped\n` });
+        }, options.timeoutMs ?? DOCTOR_TIMEOUT_MS);
+        timer.unref();
+    });
+}
+function doctorPreflight(run) {
+    if (run.code === EXIT_OK)
+        return { ok: true };
+    if (run.code === EXIT_INTEGRITY) {
+        try {
+            const report = JSON.parse(run.stdout);
+            const failed = report.checks?.filter((check) => check.status === "fail") ?? [];
+            if (failed.length === 1 &&
+                failed[0]?.check === "attestation" &&
+                typeof failed[0].detail === "string" &&
+                failed[0].detail.includes("has never been attested"))
+                return { ok: true };
+        }
+        catch {
+            // The diagnostic's malformed output is reported below with its exit.
+        }
+    }
+    return {
+        ok: false,
+        code: run.code,
+        message: `approval doctor preflight reported a setup problem; the policy remains unattested:\n${run.stderr}${run.stdout}`,
+    };
+}
+export async function commandQuickstart(argv, streams, cwd, deps = {}) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, FLAGS);
+    if (!parsed.ok)
+        return refusal(streams, parsed.message);
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${QUICKSTART_HELP}\n`);
+        return EXIT_OK;
+    }
+    if (parsed.positionals.length > 0)
+        return refusal(streams, `unexpected argument ${JSON.stringify(parsed.positionals[0])}`);
+    const prompter = deps.prompter === undefined ? createPrompter(streams) : deps.prompter;
+    if (json || prompter === null)
+        return nonInteractive(streams, json);
+    const dirFlag = stringFlag(parsed.flags, "--dir");
+    const dir = dirFlag === null ? cwd : absolute(dirFlag, cwd);
+    const apiBase = stringFlag(parsed.flags, "--api-base");
+    if (existsSync(join(dir, "APPROVAL.md")) ||
+        existsSync(join(dir, "APPROVALS.md")) ||
+        existsSync(join(dir, ".approval"))) {
+        streams.err(`approval: setup artifacts already exist in ${dir}; quickstart only initializes a fresh instance and changed nothing\n`);
+        return EXIT_IO;
+    }
+    streams.out("approval quickstart — three decisions to make a solo gate operative.\n\n");
+    const identity = askUntil(streams, prompter, "1/3 your name (for human:<id>): ", quickstartIdentity);
+    if (!identity.ok)
+        return refusal(streams, "no valid human identity was entered; nothing was written");
+    const actor = identity.value;
+    const humanId = actor.slice("human:".length);
+    const channel = askUntil(streams, prompter, "2/3 button location (1 terminal, 2 Telegram): ", channelAnswer);
+    if (!channel.ok)
+        return refusal(streams, "no channel was chosen; nothing was written");
+    streams.out(`${QUICKSTART_CLASSES.map((entry, index) => `  ${String(index + 1)}. ${entry.label}`).join("\n")}\n`);
+    const selected = askUntil(streams, prompter, "3/3 always ask (numbers, Enter for all): ", classesAnswer);
+    if (!selected.ok)
+        return refusal(streams, "no valid checklist was entered; nothing was written");
+    const policy = renderSoloPolicy(humanId, channel.value, selected.value);
+    const loaded = loadPolicyText(join(dir, "APPROVAL.md"), policy);
+    if (!loaded.ok) {
+        streams.err(`approval: generated policy failed validation: ${loaded.message}\n`);
+        return EXIT_IO;
+    }
+    let initOut = "";
+    let initErr = "";
+    const initCode = commandInit([], { out: (text) => { initOut += text; }, err: (text) => { initErr += text; } }, dir, { policyText: policy });
+    if (initCode !== EXIT_OK) {
+        streams.err(`${initErr}${initOut}`);
+        return initCode;
+    }
+    const envPath = envFilePathFor(join(dir, DEFAULT_LOG_PATH));
+    const envWrite = upsertEnvFileEntries(envPath, [{ key: HUMAN_ACTOR_ENV, value: actor }]);
+    if (!envWrite.ok) {
+        streams.err(`approval: ${envWrite.message}\n`);
+        return EXIT_IO;
+    }
+    if (channel.value === "telegram") {
+        const setupArgs = ["telegram", "--as", actor, "--dir", dir];
+        if (apiBase !== null)
+            setupArgs.push("--api-base", apiBase);
+        const setupCode = await commandSetupChannel(setupArgs, streams, dir, { ...deps.setup, prompter });
+        if (setupCode !== EXIT_OK)
+            return setupCode;
+    }
+    const onDisk = loadPolicy({ dir });
+    if (!onDisk.ok) {
+        streams.err(`approval: generated policy could not be reloaded for preflight: ${onDisk.message}\n`);
+        return EXIT_IO;
+    }
+    const resolution = resolveEnvironment(onDisk, envPath, deps.sourceRunner ?? defaultSourceRunner, {});
+    if (!resolution.ok) {
+        streams.err(`approval: quickstart environment could not be resolved: ${resolution.message}\n`);
+        return EXIT_IO;
+    }
+    const resolvedEnv = {};
+    for (const variable of resolution.variables) {
+        if (variable.value !== undefined)
+            resolvedEnv[variable.name] = variable.value;
+        else if (variable.declared) {
+            streams.err(`approval: ${variable.name} could not be resolved from this instance (${variable.source}); the policy remains unattested\n`);
+            return EXIT_IO;
+        }
+    }
+    const doctor = await (deps.doctor ?? runQuickstartDoctor)(dir, actor, resolvedEnv, apiBase);
+    const preflight = doctorPreflight(doctor);
+    if (!preflight.ok) {
+        streams.err(preflight.message);
+        return preflight.code;
+    }
+    streams.out(`\nReview the exact policy that will become operative:\n\n${policy}\n`);
+    const understood = askUntil(streams, prompter, "type understood to attest these exact bytes: ", (answer) => answer.trim() === "understood"
+        ? { ok: true, value: true }
+        : { ok: false, reason: "type understood exactly, or Ctrl-D to leave the policy unattested" });
+    if (!understood.ok)
+        return refusal(streams, "policy left unattested");
+    const attestation = appendAttestation(join(dir, DEFAULT_LOG_PATH), join(dir, "APPROVAL.md"), actor, { expectedSha256: policyBytesHash(Buffer.from(policy, "utf8")) });
+    if (!attestation.ok) {
+        streams.err(`approval: ${attestation.error.message}\n`);
+        return attestation.error.code === "corrupt-tail" ? EXIT_TORN_TAIL : EXIT_IO;
+    }
+    streams.out(`ready: ${String(selected.value.length)} selected class families ask ${actor} on ${channel.value}; other classified reversible actions use the autonomous default\n`);
+    streams.out(`activate: eval "$(approval env --dir ${shellQuote(dir)})"\n`);
+    streams.out("try: approval hook classify -- curl -X POST https://api.example.com/apply\n");
+    return EXIT_OK;
+}
+//# sourceMappingURL=quickstart.js.map

package/dist/src/cli/quickstart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quickstart.js","sourceRoot":"","sources":["../../../src/cli/quickstart.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAqC,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAA6B;IACtC,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAC9D,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IAChD,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE;IACpD,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE;IAC/C,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE;CAC3C,CAAC;AAkBX,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE7C,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,OAAe;IAChD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB,EAAE,IAAa;IACrD,MAAM,OAAO,GACX,iRAAiR,CAAC;IACpR,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,KAAK,GAAG,CAAC;QACT,KAAK,UAAU,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpC,KAAK,GAAG,CAAC;QACT,KAAK,UAAU;YACb,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACzC;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QACxG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sEAAsE,EAAE,CAAC;IACvG,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,OAAiB,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uGAAuG,EAAE,CAAC;AACrI,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAgB,EAAE,QAA2B;IAC7F,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,4CAA4C,OAAO,GAAG,CAAC;SACpF,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,YAAY,GAAG,OAAO,KAAK,UAAU;QACzC,CAAC,CAAC,iGAAiG;QACnG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,kYAAkY,OAAO,+DAA+D,OAAO,qBAAqB,OAAO,kBAAkB,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,gKAAgK,CAAC;AAC3tB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IAClE,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,UAAU,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrF,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,KAAa,EACb,WAA6C,EAC7C,OAAsB,EACtB,OAAO,GAIH,EAAE;IAEN,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,2EAA2E;QAC3E,4EAA4E;QAC5E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE;YACvE,GAAG,EAAE,GAAG;YACR,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,MAAiB,EAAQ,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,GAAS,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,mCAAmC,MAAM,CAAC,WAAW,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACvI,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtD,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ;gBAAE,cAAc,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtD,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ;gBAAE,cAAc,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,4BAA4B,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,iBAAiB,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACvJ,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,GAAc;IACrC,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAEnC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/E,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;gBACnB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,aAAa;gBAClC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACpC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC;gBACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,uFAAuF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;KAC1H,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAc,EAAE,OAAgB,EAAE,GAAW,EAAE,IAAI,GAAmB,EAAE;IAExE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACvF,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAClC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,8CAA8C,GAAG,sEAAsE,CAAC,CAAC;QACrI,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,kCAAkC,EAAE,kBAAkB,CAAC,CAAC;IACrG,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,0DAA0D,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,gDAAgD,EAAE,aAAa,CAAC,CAAC;IAC7G,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,2CAA2C,EAAE,aAAa,CAAC,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5I,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClG,IAAI,SAAS,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,mEAAmE,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACnG,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CACnC,MAAM,EACN,OAAO,EACP,IAAI,CAAC,YAAY,IAAI,mBAAmB,EACxC,EAAE,CACH,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,2DAA2D,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/F,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;aACzE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,8CAA8C,QAAQ,CAAC,MAAM,oCAAoC,CAAC,CAAC;YACzI,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,4DAA4D,MAAM,IAAI,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,+CAA+C,EAAE,CAAC,MAAM,EAAE,EAAE,CACzG,MAAM,CAAC,IAAI,EAAE,KAAK,YAAY;QAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAEtE,MAAM,WAAW,GAAG,iBAAiB,CACnC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAC3B,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EACxB,KAAK,EACL,EAAE,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CACjE,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACxD,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,gCAAgC,KAAK,OAAO,OAAO,CAAC,KAAK,oEAAoE,CAAC,CAAC;IAClL,OAAO,CAAC,GAAG,CAAC,wCAAwC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/cli/records.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Reading stored lines back out of the log, for `tail` and `export`.
+ *
+ * Read-only in the strictest sense: this module opens the file once for
+ * reading and returns the *stored bytes* of each complete line. It never
+ * re-serializes, never normalizes, never repairs. `export` is required to be
+ * byte-faithful, and the cheapest way to guarantee that is never to have a
+ * parsed object on the write path at all.
+ *
+ * Called only after {@link verify} has passed over the same file, so `count` is
+ * the number of complete lines verification vouched for. If the file no longer
+ * has that many lines, something is writing underneath us; that is reported as
+ * an I/O condition rather than papered over.
+ */
+export type ReadResult = {
+    ok: true;
+    lines: string[];
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * The first `count` complete (newline-terminated) lines of the log, exactly as
+ * stored, without their terminators.
+ */
+export declare function readCompleteLines(logPath: string, count: number): ReadResult;
+/** Parse stored lines back into records for `--json` output. */
+export declare function parseLines(logPath: string, lines: string[]): {
+    ok: true;
+    records: unknown[];
+} | {
+    ok: false;
+    message: string;
+};

package/dist/src/cli/render.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `approval render` — regenerate `.approval/QUEUE.md` from the log (SPEC.md
+ * §9.1, §10.1).
+ *
+ * As everywhere else in this CLI, no logic lives here. The projection is
+ * `channels/render-queue.ts`; this file splits argv, resolves paths, reads the
+ * clock **once at the edge** and hands the instant to core, and maps a result
+ * onto the frozen exit table.
+ *
+ * The clock is the point worth stating. The renderer is a pure function of
+ * (verified log, policy, `now`), which is what makes an identical log render to
+ * identical bytes. That property survives only if exactly one place reads a real
+ * clock, and this is it.
+ *
+ * `render` writes one file and never the log. A corrupt log refuses (exit 1)
+ * rather than producing a queue: a projection of a log that does not verify
+ * would be a screenshot of something nobody should be reading.
+ */
+import type { Streams } from "./main.js";
+/** SPEC.md §9.1: where the queue projection lives. */
+export declare const DEFAULT_QUEUE_PATH = ".approval/QUEUE.md";
+export declare function commandRender(argv: string[], streams: Streams, cwd: string): number;

package/dist/src/cli/sandbox.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `approval sandbox` — run a command with no way out to the network (APRV-193).
+ *
+ * ## Why a verb, when `approval run` already sandboxes
+ *
+ * `approval run` covers the actions the gate SEES: it holds a grant or it does
+ * not, it appends `execution.started`, and since APRV-193 it puts an ungranted
+ * child in a room with no doors. It does not cover the commands the harness
+ * runs on its own — `npm test`, `node scripts/whatever.mjs` — which the hook
+ * classifies `files.write.workspace`, allows, and then never touches again,
+ * because the hook DECIDES and the harness EXECUTES. Those are the commands that
+ * run code an agent wrote a minute ago, and they are the whole of the
+ * laundering hole this task exists to close.
+ *
+ * The hook cannot close it: a `PreToolUse` verdict is allow or deny, and it
+ * cannot rewrite the command into a wrapper. So the wrapper is a verb the
+ * command is written with, `approval sandbox -- npm test`, and two things make
+ * that more than a convention an agent could simply not type:
+ *
+ * 1. `core/command-class.ts` classifies the wrapper as its INNER argv, so
+ *    running something safely is no longer punished with `hook-unclassified`
+ *    (before this task, `sandbox-exec …` was denied while the bare command was
+ *    allowed — the hook actively penalised the safe spelling), and the wrapper
+ *    cannot launder anything either, because the class the hook resolves is the
+ *    inner command's own.
+ * 2. `APPROVAL_HOOK_REQUIRE_SANDBOX=1` makes the hook DENY an allowed-class
+ *    exec that is not written this way, with a message naming the spelling that
+ *    works. It is off by default and turning it on can only ever refuse more,
+ *    which is why an environment variable is an acceptable home for it.
+ *
+ * ## What it does
+ *
+ * Builds the profile (`core/sandbox.ts`), scrubs the credential-bearing
+ * variables out of the child's environment (`core/child-env.ts`, APRV-205),
+ * spawns, and exits with the child's own exit code. It appends NOTHING: this
+ * verb removes a capability, it does not authorize anything, and a log entry
+ * per `npm test` would be the transparency log inheriting a database's problem
+ * (SPEC.md §2, and the reason gate-routed editing was rejected on this task).
+ *
+ * ## What it fails at, stated plainly
+ *
+ * An agent HARNESS cannot run under this. `claude` and `cursor-agent` talk to a
+ * model over the network, and this verb denies exactly that, so
+ * `approval sandbox -- claude` is a session that cannot think. Sandboxing a
+ * whole session needs an egress allowlist reaching one host, which Seatbelt
+ * cannot express by hostname and which the prior art (Claude Code's own sandbox
+ * mode) solves with a local proxy. That is a follow-up, and until it exists the
+ * unit this verb protects is the COMMAND rather than the session.
+ */
+import type { Streams } from "./main.js";
+export declare function commandSandbox(argv: string[], streams: Streams, cwd: string): number;

package/dist/src/cli/sandbox.js

@@ -50,11 +50,13 @@
 import { spawnSync } from "node:child_process";
 import { rmSync } from "node:fs";
 import { constants as osConstants } from "node:os";
+import { dirname } from "node:path";
 import { childEnvironment } from "../core/child-env.js";
 import { loadPolicy } from "../core/policy-load.js";
 import { credentialPathsFor, detectSandbox, resolveExecutable, wrapForSandbox, } from "../core/sandbox.js";
 import { passphraseEnvFor } from "../core/vault.js";
 import { parseFlags, boolFlag, stringFlag } from "./args.js";
+import { resolveReadRoots } from "./hook.js";
 import { EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
 import { SANDBOX_HELP } from "./help.js";
 import { DEFAULT_LOG_PATH } from "./paths.js";
@@ -63,6 +65,7 @@ import { usageErrorText } from "./usage.js";
 const EXIT_COMMAND_NOT_RUN = 127;
 const FLAGS = {
     "--allow-loopback": "boolean",
+    "--read-jail": "boolean",
     "--log": "string",
     "--long": "boolean",
     "--help": "boolean",
@@ -107,7 +110,8 @@ export function commandSandbox(argv, streams, cwd) {
         return EXIT_COMMAND_NOT_RUN;
     }
     const logPath = stringFlag(parsed.flags, "--log") ?? DEFAULT_LOG_PATH;
-    const child = childEnvironment({ passphraseEnv: passphraseEnvFor(loadPolicy({ dir: cwd })) });
+    const policy = loadPolicy({ dir: cwd });
+    const child = childEnvironment({ passphraseEnv: passphraseEnvFor(policy) });
     const resolved = resolveExecutable(command, child.env);
     if (resolved === null) {
         // Resolved HERE rather than left to the wrapper: `sandbox-exec` execs
@@ -116,9 +120,21 @@ export function commandSandbox(argv, streams, cwd) {
         streams.err(`approval: ${JSON.stringify(command)} is not on PATH; the command was NOT run.\n`);
         return EXIT_COMMAND_NOT_RUN;
     }
+    // APRV-347. The read jail, from the same two sources `approval run` reads it
+    // from: the policy declaring a `read_scope` block turns it on for every
+    // command this verb wraps, and `--read-jail` turns it on for one command
+    // whether the policy declares one or not. There is no flag that turns it OFF
+    // where the policy asked for it — a flag an agent can pass must only ever be
+    // able to make the room smaller.
+    const declared = policy.ok ? policy.policy.read_scope : undefined;
+    const wantJail = declared !== undefined || boolFlag(parsed.flags, "--read-jail");
+    const readJail = wantJail
+        ? resolveReadRoots(cwd, policy.ok ? dirname(policy.source.path) : cwd, declared?.roots)
+        : [];
     const wrapped = wrapForSandbox(detection.mechanism, resolved, childArgv.slice(1), {
         loopback: boolFlag(parsed.flags, "--allow-loopback"),
         denyRead: credentialPathsFor(logPath),
+        ...(readJail.length === 0 ? {} : { allowRead: readJail }),
     });
     try {
         const result = spawnSync(wrapped.command, wrapped.args, {

package/dist/src/cli/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,KAAK,GAA6B;IACtC,kBAAkB,EAAE,SAAS;IAC7B,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CACV,OAAO,EACP,uBAAuB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,wCAAwC,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,EAAE,kEAAkE,CAAC,CAAC;IAC5F,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CACT,gDAAgD,SAAS,CAAC,MAAM,2DAA2D,CAC5H,CAAC;QACF,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,gBAAgB,CAAC;IACtE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,sEAAsE;QACtE,yEAAyE;QACzE,oCAAoC;QACpC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC;QAC/F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChF,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACpD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACtD,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;YACnF,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,wEAAwE;YACxE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAwD,CAAC;YACrF,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAgB,EAAE,OAAe;IAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,KAAK,GAA6B;IACtC,kBAAkB,EAAE,SAAS;IAC7B,aAAa,EAAE,SAAS;IACxB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CACV,OAAO,EACP,uBAAuB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,wCAAwC,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,EAAE,kEAAkE,CAAC,CAAC;IAC5F,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CACT,gDAAgD,SAAS,CAAC,MAAM,2DAA2D,CAC5H,CAAC;QACF,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,gBAAgB,CAAC;IACtE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,sEAAsE;QACtE,yEAAyE;QACzE,oCAAoC;QACpC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC;QAC/F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,gBAAgB,CACd,GAAG,EACH,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAC7C,QAAQ,EAAE,KAAK,CAChB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChF,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACpD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACtD,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;YACnF,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,wEAAwE;YACxE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAwD,CAAC;YACrF,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,IAAI,oBAAoB,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAgB,EAAE,OAAe;IAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/cli/scaffold.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The bytes `approval init` scaffolds, and the one-line rationale for each.
+ *
+ * These constants live apart from both `init.ts` and `help.ts` because both
+ * need them: the verb writes them and the help text quotes them, and a help text
+ * that quoted a stale copy would be the second-worst kind of documentation — the
+ * confident kind. One definition, two readers, no cycle.
+ */
+/**
+ * SPEC.md §5.1's canonical example, byte for byte.
+ *
+ * This constant and `schema/fixtures/policy-md/valid/canonical.md` are the same
+ * bytes, and `tests/cli-init.test.ts` asserts it: the fixture is frozen (every
+ * policy-loading test descends from it) and the spec section it transcribes is
+ * what a reader compares the scaffolded file against. A copy that drifted from
+ * either would hand a new user a policy the documentation does not describe.
+ *
+ * It is embedded here rather than read from `schema/` because the published
+ * package ships the CLI and the spec, not the test fixtures, and a scaffolding
+ * verb that fails on an installed copy is a verb that only ever worked in this
+ * checkout.
+ *
+ * The closing sentence is not in SPEC.md §5.1's fence — it is the fixture's own
+ * trailing prose, kept because it says the one thing a first-time reader of this
+ * file needs to know: the prose is not the policy.
+ */
+export declare const CANONICAL_POLICY = "# Approval Policy\n\nAgents working in this project handle my life admin. Anything that leaves\nthe machine gets declared, and the classes below say what I sign off on.\n\n```yaml approval-policy\nversion: \"0.1\"\n\ndefaults:\n  autonomy: manual          # unknown/undeclared classes require sign-off\n  channel: telegram\n  approval_ttl: 24h         # pending requests expire\n  on_expiry: reject\n\napprovers:\n  alice:\n    channels: [telegram, cli]\n\nclasses:\n  read.*:                       { autonomy: autonomous }\n  files.write.workspace:        { autonomy: autonomous }\n  calendar.write.own:           { autonomy: supervised-retro }\n  communicate.email.draft:      { autonomy: autonomous }\n  communicate.email.external:\n    autonomy: manual\n    approvers: [alice]\n  financial.spend:\n    autonomy: manual\n    approvers: [alice]\n    limits: { per_action_usd: 25, daily_usd: 100 }\n  public.post:                  { autonomy: manual }\n  data.delete:                  { autonomy: manual }\n  account.auth:                 { autonomy: manual }\n\nbudgets:\n  global: { daily_usd: 100, daily_actions: 200 }\n\naudit:\n  supervised_sample_rate: 0.10   # fraction of supervised actions escalated\n                                 # for retrospective human review\n\nchannels:\n  telegram:\n    chat_id_env: APPROVAL_TG_CHAT\n    token_env: APPROVAL_TG_TOKEN\n  web:\n    port: 4680\n```\n\nEverything after the block is prose again and is ignored by the parser.\n";
+/**
+ * The comment the merged `.gitignore` lines live under.
+ *
+ * A marker rather than a bare append, so a second `init` can tell its own lines
+ * from the operator's and add only what is missing, and so a human reading the
+ * file knows which lines they are allowed to delete.
+ */
+export declare const GITIGNORE_MARKER = "# approval.md";
+/**
+ * The ignore lines, and why each one is there.
+ *
+ * - `.approval/*.sqlite` — the index is a projection (SPEC.md §9.2). It rebuilds
+ *   from the log with `approval reindex`; committing it would put a cache in the
+ *   history of the thing it caches.
+ * - `.approval/vault.enc` — the encrypted credential store (M7). Encrypted or
+ *   not, the vault is the one file in the layout whose contents are secrets, and
+ *   secrets do not go in a repository.
+ * - `.approval/env` — the environment source map (APRV-73). Usually it holds
+ *   only keychain service names, and it is ignored anyway: the format permits a
+ *   plaintext literal, an operator will eventually paste one in, and the day
+ *   they do must not be the day a bot token lands in a commit. Ignoring it also
+ *   states the intent — the environment is per-machine, not per-repository.
+ * - `.approval/keys/` — the per-request X25519 private keys of sealed token
+ *   delivery (APRV-105). Per-machine by construction: the whole design is that
+ *   the log, which IS shared, carries only ciphertext, and a key committed to a
+ *   shared history would hand every reader of that history the ability to open
+ *   an unspent token inside its TTL. Written whether or not a policy has opted
+ *   into `token_delivery: sealed`, because the line an operator needs is the one
+ *   that is already there on the day they turn the knob.
+ * - `.approval/**\/*.tmp-*` — the atomic-write temp files. Both writers that
+ *   rename into place (`channels/render-queue.ts`, `core/payload-store.ts`) name
+ *   their temp `.<basename>.tmp-<pid>-<counter>`, so this pattern is written to
+ *   match what those two actually produce, at both levels of the tree. A crashed
+ *   write leaves one behind; nobody should be asked to review it.
+ *
+ * - `.approval-journal/` — the ungated free-text channel of `approval journal`
+ *   (APRV-195). Ignored rather than tracked because it is not truth and not
+ *   evidence: the log is the record of what happened and it is committed, while
+ *   the journal is what an agent said about working here, which the operator
+ *   reads locally. Committing it would also turn an outlet into a publication,
+ *   and an agent writing for a public repository is an agent writing for an
+ *   audience — the pressure this channel exists to be free of. An operator who
+ *   wants the history keeps it by deleting the line.
+ *
+ * `.approval/log/` is deliberately absent: the log is the truth and belongs in
+ * the history. So is `.approval/payloads/`, which holds the bytes each approval
+ * bound to — evidence defaults to tracked, and the next steps `init` prints say
+ * so, along with the one line that reverses the choice.
+ */
+export declare const GITIGNORE_ENTRIES: readonly string[];
+/** The same entries, indented for the help text so the two cannot disagree. */
+export declare const GITIGNORE_ENTRY_LINES: string;

package/dist/src/cli/scaffold.js

@@ -45,7 +45,7 @@ approvers:
 classes:
   read.*:                       { autonomy: autonomous }
   files.write.workspace:        { autonomy: autonomous }
-  calendar.write.own:           { autonomy: supervised }
+  calendar.write.own:           { autonomy: supervised-retro }
   communicate.email.draft:      { autonomy: autonomous }
   communicate.email.external:
     autonomy: manual