approval-md 0.2.0 → 0.3.0

package/dist/src/cli/policy-apply.js

@@ -0,0 +1,573 @@
+/**
+ * `approval policy apply <proposal.md>` (APRV-343) — apply a proposal
+ * document's quoted replacements to `APPROVAL.md`, then run the amendment.
+ *
+ * ## The hand-ritual this replaces
+ *
+ * Agents may not write `APPROVAL.md`: it is `policy.core`, and this repository's
+ * policy holds that class human-only. So a policy change an agent proposes
+ * travels as a document under `docs/proposals/` that quotes each current line
+ * byte for byte beside its replacement, and the human pastes. On 2026-09-16 the
+ * paste was done by copying a prepared file over `APPROVAL.md` and running
+ * `approval policy amend`. Two things go wrong with that, and both have:
+ *
+ * - **a whole-file copy reverts what it did not know about.** The prepared file
+ *   was written against the policy as it stood when the proposal was drafted,
+ *   so anything landed in between is silently undone. This is the failure
+ *   `base-policy-diverged` catches for the COMMIT, one step too late to help;
+ * - **a paste carries its wrapper.** One paste of a proposal page took the
+ *   page's own fence with it, which hid a block from the loader (APRV-273).
+ *
+ * This verb answers both by construction. It never writes bytes that are not
+ * anchored to bytes already in the live file, and it reads fences by their
+ * backtick run, so a four-backtick wrapper around a three-backtick block is the
+ * wrapper it is rather than part of the content.
+ *
+ * ## The contract, and the three questions APRV-343 left open
+ *
+ * A proposal is markdown. Anywhere in it, a fenced block whose immediately
+ * preceding non-blank line is a LABEL is a member of a pair:
+ *
+ * - `Current:` — the bytes as they stand in the live policy;
+ * - `Replace with:` — what they become;
+ * - `Supersedes:` — optional, and the answer to the first open question.
+ *
+ * **How supersession is declared.** Explicitly, by a third block, and never by
+ * position. A later section that rewrites a line an earlier section already
+ * rewrote quotes the earlier section's RESULT under a `Supersedes:` label, and
+ * the applier looks for that text when the section's own `Current` block is no
+ * longer in the file — which is exactly the state the earlier section left
+ * behind. Position could not carry this: two sections that touch one line are
+ * not in general in the order the file needs, and a rule inferred from order is
+ * a rule nobody can read off the page. A pair whose `Current` AND `Supersedes`
+ * blocks both occur is ambiguous and refuses, because it means the file
+ * contains both spellings and no verb here will pick.
+ *
+ * **Whether a whole-file replacement is accepted.** No, and that is the
+ * decision rather than an omission. The verb's whole value is that every byte it
+ * writes is anchored to a byte it proved present, which is what makes a stale
+ * proposal a refusal instead of a silent revert. A whole-file blob has no
+ * anchor: applying one is a paste with extra steps, and `approval policy amend`
+ * over a hand-edited file is already the supported way to do that deliberately.
+ *
+ * **How the values block is treated.** Identically, and by knowing nothing
+ * about it. The applier is a byte-level replacement over the whole file; it
+ * does not parse the policy, does not locate blocks, and does not care which
+ * fence a pair lands in. The values block is inert (SPEC §11.1 invariant 10),
+ * so applying one changes no verdict, and the attestation the amend appends
+ * covers the whole file's bytes either way (SPEC §5.2, §5.3). A verb that
+ * treated the two blocks differently would be asserting a distinction the file
+ * does not make.
+ *
+ * ## Refuse before writing, always
+ *
+ * Every pair is resolved against an IN-MEMORY copy, in document order, before a
+ * byte reaches the disk. A proposal whose third pair is stale writes nothing at
+ * all, so "a stale proposal cannot half-apply" is a property of the code rather
+ * than of the order somebody wrote the sections in.
+ *
+ * ## It publishes, because one command means one command (APRV-360)
+ *
+ * The amendment runs with `--pr` unless `--no-publish` says otherwise. Before
+ * this, `apply` ran the amend with no flag: the policy was written and
+ * attested, and the operator was handed a printed procedure for getting it onto
+ * main. On 2026-09-18 that procedure opened with `git checkout -b
+ * policy-amend-<seq> origin/main`, the primary's main was fourteen commits
+ * behind, and the switch refused rather than overwrite `QUEUE.md`, the working
+ * log and six payloads. The ceremony stalled with an edited, attested,
+ * unpublished policy, which is the one state in which every gated operation on
+ * the box refuses.
+ *
+ * A verb whose whole value is that the edit and its attestation are ONE act has
+ * no business stopping one step short of the act being visible. `--no-publish`
+ * is the operator who wants it to stop at the commit; `--pr` is accepted and
+ * does nothing, because runbooks already say it.
+ *
+ * ## Human-only
+ *
+ * `approval policy apply` classifies `policy.core` (`core/command-class.ts`),
+ * which this repository's policy holds human-only, so the hook denies an agent
+ * that runs it. The verb ALSO refuses an agent identity itself, with
+ * `apply-agent-actor`: a lock that exists only in the classifier is a lock that
+ * a harness without a hook does not have. It mints no class — `policy.core`
+ * already exists and already covers the policy's own machinery (SPEC §11.1
+ * invariant 9).
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve as resolvePathSegments } from "node:path";
+import { commandPolicyAmend } from "./amend.js";
+import { EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { POLICY_APPLY_HELP } from "./help.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { preflightPolicyPath } from "./preflight.js";
+import { readLineFromStdin } from "./prompt.js";
+import { style } from "./style.js";
+import { usageErrorText } from "./usage.js";
+const FLAGS = {
+    "--policy": "string",
+    "--dir": "string",
+    "--log": "string",
+    "--as": "string",
+    "--yes": "boolean",
+    "--dry-run": "boolean",
+    "--no-amend": "boolean",
+    "--pr": "boolean",
+    // APRV-360: the opt-out from the publishing this verb now does by default.
+    // It is the same word `policy amend` uses, and it reaches the amend
+    // unchanged, so an operator who knows one knows the other.
+    "--no-publish": "boolean",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/** An agent identity, the one `--as` form this verb refuses outright. */
+const AGENT_ACTOR = /^agent:.+/u;
+/**
+ * Machine-readable refusal codes. Frozen public API, printed in the help.
+ *
+ * Distinct by repair, which is the whole test: `proposal-stale` means the live
+ * file moved and the proposal has to be rewritten against it; `proposal-
+ * ambiguous` means the quoted text is not specific enough and the proposal has
+ * to quote more; `proposal-malformed` means the page is not a proposal yet.
+ *
+ * Two outcomes are deliberately NOT in this union, because neither is this
+ * verb's refusal to make:
+ *
+ * - an operator who answers no at the confirmation gets exit 0 and `aborted:`
+ *   on stdout, exactly as `policy amend` does. Nothing failed, and an error
+ *   object at exit 0 would be a contradiction a caller has to resolve;
+ * - an amendment that refuses has already printed its OWN code, from its own
+ *   frozen union. Wrapping it in a second one would put two error objects on
+ *   one stream and make a caller guess which is the answer. What this verb adds
+ *   is the sentence naming the state that refusal leaves behind.
+ */
+export const POLICY_APPLY_REFUSAL_CODES = [
+    "usage",
+    "io",
+    "apply-agent-actor",
+    "proposal-empty",
+    "proposal-malformed",
+    "proposal-stale",
+    "proposal-ambiguous",
+];
+/**
+ * Every fenced block in `text` that declares a language.
+ *
+ * Two rules, and both are APRV-273:
+ *
+ * 1. **A fence is closed by a run of AT LEAST as many backticks as opened it.**
+ *    That is CommonMark's rule and it is the one that makes a four-backtick
+ *    wrapper work: the inner ```` ```yaml approval-values ```` lines are content,
+ *    not fences, so the block quoted is the block including its own fences.
+ * 2. **An opener with no info string is not a block this verb reads.** The
+ *    incident was a bare fence swallowing a block whose language nobody
+ *    declared; a proposal that wants a block applied says what it is.
+ */
+export function fencesOf(text) {
+    const lines = text.split("\n");
+    const found = [];
+    let label = "";
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        const opener = /^(`{3,})(.*)$/u.exec(line);
+        if (opener === null) {
+            // The label is the last non-blank line before a fence, so a blank line
+            // between the two does not lose it and a paragraph two lines up does not
+            // become one.
+            if (line.trim().length > 0)
+                label = line.trim();
+            continue;
+        }
+        const ticks = opener[1].length;
+        const info = opener[2].trim();
+        const body = [];
+        let closed = false;
+        let cursor = index + 1;
+        for (; cursor < lines.length; cursor += 1) {
+            const candidate = lines[cursor];
+            const closer = /^(`{3,})\s*$/u.exec(candidate);
+            if (closer !== null && closer[1].length >= ticks) {
+                closed = true;
+                break;
+            }
+            body.push(candidate);
+        }
+        // An unterminated fence is not a block. Reading to the end of the document
+        // would turn a typo into a replacement covering half the page.
+        if (closed && info.length > 0) {
+            found.push({ label, body: body.join("\n"), line: index + 1 });
+        }
+        label = "";
+        index = cursor;
+    }
+    return found;
+}
+/**
+ * The label vocabulary.
+ *
+ * Canonical spellings are `Current:`, `Replace with:` and `Supersedes:`. The
+ * match is on the leading keyword rather than the whole line so a page can say
+ * "Section 1's line, which this supersedes:" — which `docs/proposals/
+ * approval-md-2026-09.md` does, and which reads better than a bare label on a
+ * page a human is meant to understand before any verb does.
+ */
+function roleOf(label) {
+    const text = label.toLowerCase();
+    if (/^current\b/u.test(text))
+        return "current";
+    if (/^replace[ -]with\b/u.test(text))
+        return "replacement";
+    if (/supersede/u.test(text))
+        return "supersedes";
+    return null;
+}
+/**
+ * Read a proposal document into ordered pairs.
+ *
+ * A block whose label names no role is skipped in silence, which is what lets a
+ * proposal page carry a `bash` block of commands to run afterwards without the
+ * applier mistaking it for policy text.
+ */
+export function parseProposal(text) {
+    const lines = text.split("\n");
+    const headingAt = (line) => {
+        for (let index = line - 1; index >= 0; index -= 1) {
+            const candidate = (lines[index] ?? "").trim();
+            if (/^#{2,6}\s+/u.test(candidate))
+                return candidate.replace(/^#+\s+/u, "");
+        }
+        return "the proposal";
+    };
+    const pairs = [];
+    let current = null;
+    let supersedes = null;
+    for (const fence of fencesOf(text)) {
+        const role = roleOf(fence.label);
+        if (role === null)
+            continue;
+        if (role === "supersedes") {
+            if (supersedes !== null) {
+                return {
+                    ok: false,
+                    code: "proposal-malformed",
+                    message: `two Supersedes blocks before one Replace with (lines ${String(supersedes.line)} and ${String(fence.line)}); a pair names at most one superseded text, because two would be two claims about which bytes are in the file`,
+                };
+            }
+            supersedes = fence;
+            continue;
+        }
+        if (role === "current") {
+            if (current !== null) {
+                return {
+                    ok: false,
+                    code: "proposal-malformed",
+                    message: `two Current blocks before one Replace with (lines ${String(current.line)} and ${String(fence.line)}); every Current block needs the replacement that goes with it, or the page is stating a fact rather than proposing a change`,
+                };
+            }
+            current = fence;
+            continue;
+        }
+        if (current === null) {
+            return {
+                ok: false,
+                code: "proposal-malformed",
+                message: `the Replace with block at line ${String(fence.line)} has no Current block above it; a replacement with nothing to anchor it is a paste, and this verb writes no byte it has not proved present`,
+            };
+        }
+        pairs.push({
+            heading: headingAt(fence.line),
+            current: current.body,
+            replacement: fence.body,
+            supersedes: supersedes === null ? null : supersedes.body,
+            line: fence.line,
+        });
+        current = null;
+        supersedes = null;
+    }
+    if (current !== null) {
+        return {
+            ok: false,
+            code: "proposal-malformed",
+            message: `the Current block at line ${String(current.line)} has no Replace with block after it; nothing was applied`,
+        };
+    }
+    if (pairs.length === 0) {
+        return {
+            ok: false,
+            code: "proposal-empty",
+            message: "this document declares no Current/Replace with pairs. A pair is two fenced blocks WITH a declared language, each introduced by its label on the line above (`Current:` and `Replace with:`); a fence with no language is skipped, which is the APRV-273 hazard this parser is built around",
+        };
+    }
+    return { ok: true, pairs };
+}
+/** How many times `needle` occurs in `haystack`, counting non-overlapping hits. */
+function occurrences(haystack, needle) {
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let at = haystack.indexOf(needle);
+    while (at >= 0) {
+        count += 1;
+        at = haystack.indexOf(needle, at + needle.length);
+    }
+    return count;
+}
+/**
+ * Resolve every pair against an in-memory copy of the policy, in order.
+ *
+ * Nothing here touches the disk, which is what makes the refusals honest: a
+ * proposal is applied whole or not at all, and the caller writes only the text
+ * this function returned.
+ */
+export function planApply(live, pairs) {
+    let text = live;
+    const applied = [];
+    for (const [index, pair] of pairs.entries()) {
+        const ordinal = `pair ${String(index + 1)} (${pair.heading}, line ${String(pair.line)})`;
+        const own = occurrences(text, pair.current);
+        const carried = pair.supersedes === null ? 0 : occurrences(text, pair.supersedes);
+        if (own > 0 && carried > 0) {
+            return {
+                ok: false,
+                code: "proposal-ambiguous",
+                message: `${ordinal}: the policy contains BOTH the text this pair quotes as current and the text it says it supersedes. Two spellings of one line is a question about which of them the file means, and no verb here will pick. Nothing was written`,
+            };
+        }
+        const target = own > 0 ? pair.current : carried > 0 ? pair.supersedes : null;
+        const hits = own > 0 ? own : carried;
+        if (target === null) {
+            return {
+                ok: false,
+                code: "proposal-stale",
+                message: `${ordinal}: the text this pair quotes as current is not in the policy${pair.supersedes === null ? "" : ", and neither is the text it says it supersedes"}. The file has moved since the proposal was written, so applying it would write bytes nobody checked against what is there. Nothing was written; rewrite the proposal against the live file`,
+            };
+        }
+        if (hits > 1) {
+            return {
+                ok: false,
+                code: "proposal-ambiguous",
+                message: `${ordinal}: the text this pair quotes occurs ${String(hits)} times in the policy, so which one it means is a guess. Nothing was written; quote enough surrounding lines to make it unique`,
+            };
+        }
+        text = text.replace(target, () => pair.replacement);
+        applied.push({
+            heading: pair.heading,
+            matched: target,
+            replacement: pair.replacement,
+            superseded: own === 0,
+        });
+    }
+    return { ok: true, text, applied };
+}
+// ---------------------------------------------------------------------------
+// The verb
+// ---------------------------------------------------------------------------
+function detail(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+function refuse(streams, json, code, message, exitCode) {
+    if (json)
+        streams.err(`${JSON.stringify({ ok: false, error: { code, message } })}\n`);
+    else
+        streams.err(`approval: ${message}\n`);
+    return exitCode;
+}
+function usageRefusal(streams, json, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ ok: false, error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, POLICY_APPLY_HELP));
+    return EXIT_USAGE;
+}
+/** Every line of a block, prefixed, so a diff reads as one. */
+function block(text, marker) {
+    return text.split("\n").map((line) => `${marker} ${line}`);
+}
+export function commandPolicyApply(argv, streams, cwd) {
+    const parsed = parseFlags(argv, FLAGS);
+    if (!parsed.ok)
+        return usageRefusal(streams, wantsJson(argv), parsed.message);
+    const json = boolFlag(parsed.flags, "--json");
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${POLICY_APPLY_HELP}\n`);
+        return EXIT_OK;
+    }
+    const proposalArg = parsed.positionals[0];
+    if (proposalArg === undefined) {
+        return usageRefusal(streams, json, "missing <proposal.md>: the document whose pairs to apply");
+    }
+    const extra = parsed.positionals[1];
+    if (extra !== undefined) {
+        return usageRefusal(streams, json, `unexpected argument ${JSON.stringify(extra)}`);
+    }
+    // APRV-360. `--pr` is the default now, so passing it is a no-op kept for the
+    // runbooks that already say it; passing both asks for opposite ceremonies,
+    // and the amend refuses that pair in the same words.
+    const noPublish = boolFlag(parsed.flags, "--no-publish");
+    if (boolFlag(parsed.flags, "--pr") && noPublish) {
+        return usageRefusal(streams, json, "--pr and --no-publish ask for opposite ceremonies: --pr opens the pull request (which is what apply does anyway), --no-publish stops at the commit. Pass one of them");
+    }
+    // Identity first, as the amendment ceremony does it, and for the stricter
+    // reason: an agent may not write this file at all, so telling it after it has
+    // read a diff would be telling it too late.
+    const asFlag = stringFlag(parsed.flags, "--as");
+    if (asFlag !== null && AGENT_ACTOR.test(asFlag)) {
+        return refuse(streams, json, "apply-agent-actor", `apply is human-only: ${asFlag} may not write the policy file. APPROVAL.md is policy.core and this verb classifies as policy.core too, so the hook denies an agent that runs it; the refusal here is the same lock in a harness that has no hook. Propose the change as a document under docs/proposals/ and let a human run this verb`, EXIT_USAGE);
+    }
+    const proposalPath = isAbsolute(proposalArg) ? proposalArg : resolvePathSegments(cwd, proposalArg);
+    let proposalText;
+    try {
+        proposalText = readFileSync(proposalPath, "utf8");
+    }
+    catch (cause) {
+        return refuse(streams, json, "io", `the proposal ${proposalPath} could not be read: ${detail(cause)}`, EXIT_IO);
+    }
+    const policyPath = preflightPolicyPath(stringFlag(parsed.flags, "--policy"), stringFlag(parsed.flags, "--dir"), cwd);
+    if (policyPath === null) {
+        return refuse(streams, json, "io", `no policy file to apply to: pass --policy <path>, or run this where APPROVAL.md is`, EXIT_IO);
+    }
+    let live;
+    try {
+        live = readFileSync(policyPath, "utf8");
+    }
+    catch (cause) {
+        return refuse(streams, json, "io", `the policy ${policyPath} could not be read: ${detail(cause)}`, EXIT_IO);
+    }
+    const parsedProposal = parseProposal(proposalText);
+    if (!parsedProposal.ok) {
+        return refuse(streams, json, parsedProposal.code, parsedProposal.message, EXIT_USAGE);
+    }
+    const plan = planApply(live, parsedProposal.pairs);
+    if (!plan.ok)
+        return refuse(streams, json, plan.code, plan.message, EXIT_USAGE);
+    const dryRun = boolFlag(parsed.flags, "--dry-run");
+    if (plan.text === live) {
+        // Every pair resolved and the bytes did not move: the proposal has already
+        // been applied. A success, and a no-op, and it says which.
+        if (json) {
+            streams.out(`${JSON.stringify({
+                ok: true,
+                policy: policyPath,
+                proposal: proposalPath,
+                pairs: plan.applied.length,
+                noop: true,
+                dryRun,
+                applied: [],
+            })}\n`);
+        }
+        else {
+            streams.out(`nothing to apply: all ${String(plan.applied.length)} replacement(s) already read as the proposal asks. ${policyPath} is unchanged\n`);
+        }
+        return EXIT_OK;
+    }
+    const st = style({ json });
+    if (!json) {
+        streams.out(`${st.heading("Applying")}\n`);
+        streams.out(`  ${st.key("proposal")} ${proposalPath}\n`);
+        streams.out(`  ${st.key("policy")}   ${policyPath}\n\n`);
+        for (const [index, entry] of plan.applied.entries()) {
+            streams.out(`${st.value(`pair ${String(index + 1)} — ${entry.heading}`)}${entry.superseded ? st.muted("  (matched the text it supersedes)") : ""}\n`);
+            for (const line of block(entry.matched, "-"))
+                streams.out(`  ${st.fail(line)}\n`);
+            for (const line of block(entry.replacement, "+"))
+                streams.out(`  ${st.ok(line)}\n`);
+            streams.out("\n");
+        }
+    }
+    if (dryRun) {
+        if (json) {
+            streams.out(`${JSON.stringify({
+                ok: true,
+                policy: policyPath,
+                proposal: proposalPath,
+                pairs: plan.applied.length,
+                noop: false,
+                dryRun: true,
+                applied: plan.applied,
+            })}\n`);
+        }
+        else {
+            streams.out("--dry-run: nothing was written and nothing was attested\n");
+        }
+        return EXIT_OK;
+    }
+    // The confirmation is for the WRITE. The amendment asks its own, about the
+    // semantic diff, and the two are different questions: this one is "are these
+    // the bytes", that one is "is this the policy". `--yes` answers both, because
+    // an operator who passed it has said so once for the whole ceremony.
+    const assumeYes = boolFlag(parsed.flags, "--yes");
+    if (!assumeYes) {
+        if (json || process.stdin.isTTY !== true) {
+            return usageRefusal(streams, json, "apply needs a confirmation it cannot ask for: stdin is not a terminal (or --json was given). Re-run with --yes, or with --dry-run to see the replacements without writing anything");
+        }
+        streams.out(`write these ${String(plan.applied.length)} replacement(s) to ${policyPath}? [y/N] `);
+        const answer = (readLineFromStdin() ?? "").trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            streams.out("aborted: nothing was written and nothing was attested\n");
+            return EXIT_OK;
+        }
+    }
+    try {
+        writeFileSync(policyPath, plan.text, "utf8");
+    }
+    catch (cause) {
+        return refuse(streams, json, "io", `${policyPath} could not be written: ${detail(cause)}. Nothing was attested`, EXIT_IO);
+    }
+    if (boolFlag(parsed.flags, "--no-amend")) {
+        const owed = noPublish ? "approval policy amend --no-publish" : "approval policy amend --pr";
+        if (json) {
+            streams.out(`${JSON.stringify({
+                ok: true,
+                policy: policyPath,
+                proposal: proposalPath,
+                pairs: plan.applied.length,
+                noop: false,
+                dryRun: false,
+                amended: false,
+                owed,
+                applied: plan.applied,
+            })}\n`);
+        }
+        else {
+            streams.out(`${st.glyph("ok")} ${String(plan.applied.length)} replacement(s) written to ${policyPath}\n`);
+            streams.err(`approval: --no-amend, so the policy is EDITED AND UNATTESTED: every gated operation refuses policy-not-attested until you run \`${owed}\`\n`);
+        }
+        return EXIT_OK;
+    }
+    // And then the amendment, in this process. The edit and its attestation are
+    // one act, so a verb that wrote the file and left the operator to remember
+    // the second half would have built the interregnum it exists to close.
+    const logFlag = stringFlag(parsed.flags, "--log");
+    const amendArgv = [
+        ...(stringFlag(parsed.flags, "--policy") === null ? [] : ["--policy", policyPath]),
+        ...(stringFlag(parsed.flags, "--dir") === null
+            ? []
+            : ["--dir", stringFlag(parsed.flags, "--dir")]),
+        ...(logFlag === null ? [] : ["--log", logFlag]),
+        ...(asFlag === null ? [] : ["--as", asFlag]),
+        ...(assumeYes ? ["--yes"] : []),
+        ...(json ? ["--json"] : []),
+        // APRV-360: the ceremony finishes its own job. This verb exists to be ONE
+        // command for the human, and a run that attested the policy and then
+        // printed a procedure for publishing it is not one command; on 2026-09-18
+        // the procedure it printed was a branch switch the primary refused, and the
+        // ceremony stalled with an edited, attested, unpublished policy. So `--pr`
+        // is passed unless the operator asked for the quiet form, and `--pr` on
+        // this verb's own argv is now a no-op that changes nothing.
+        ...(noPublish ? ["--no-publish"] : ["--pr"]),
+    ];
+    const code = commandPolicyAmend(amendArgv, streams, cwd);
+    if (code !== EXIT_OK) {
+        // The write happened and the amendment did not. Said plainly, on stderr,
+        // because the operator is now holding an edited policy no attestation
+        // covers and the next gate operation will tell them so in a worse place.
+        const owed = noPublish ? "approval policy amend --no-publish" : "approval policy amend --pr";
+        streams.err(`approval: the replacements ARE written to ${policyPath}, and \`approval policy amend\` exited ${String(code)}: the policy is edited and unattested until it succeeds. Fix what it reported and run \`${owed}\`\n`);
+    }
+    return code;
+}
+/** `--json` before the flags are parsed, so a parse error can honour it. */
+function wantsJson(argv) {
+    return argv.includes("--json");
+}
+//# sourceMappingURL=policy-apply.js.map

package/dist/src/cli/policy-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-apply.js","sourceRoot":"","sources":["../../../src/cli/policy-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAA6B;IACtC,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,SAAS;IACvB,MAAM,EAAE,SAAS;IACjB,2EAA2E;IAC3E,oEAAoE;IACpE,2DAA2D;IAC3D,cAAc,EAAE,SAAS;IACzB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO;IACP,IAAI;IACJ,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,oBAAoB;CACZ,CAAC;AAkBX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAW,CAAC;QACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,uEAAuE;YACvE,yEAAyE;YACzE,cAAc;YACd,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAY,CAAC,MAAM,CAAC;QAC3C,MAAM,IAAI,GAAI,MAAM,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;QACvB,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,IAAI,IAAK,MAAM,CAAC,CAAC,CAAY,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC7D,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,2EAA2E;QAC3E,+DAA+D;QAC/D,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,GAAG,EAAE,CAAC;QACX,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;QACzC,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAiB,IAAI,CAAC;IACjC,IAAI,UAAU,GAAiB,IAAI,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,wDAAwD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gHAAgH;iBACnO,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,qDAAqD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,8HAA8H;iBAC3O,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kCAAkC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,4IAA4I;aAC1M,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9B,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,WAAW,EAAE,KAAK,CAAC,IAAI;YACvB,UAAU,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI;YACxD,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;QACf,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,6BAA6B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,0DAA0D;SACrH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,4RAA4R;SAC/R,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAoBD,mFAAmF;AACnF,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,CAAC;QACX,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAA8B;IACpE,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACzF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAElF,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,OAAO,iOAAiO;aACrP,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,OAAO,8DACjB,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iDAClC,6LAA6L;aAC9L,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,GAAG,OAAO,sCAAsC,MAAM,CAAC,IAAI,CAAC,+HAA+H;aACrM,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,GAAG,KAAK,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CACb,OAAgB,EAChB,IAAa,EACb,IAA4B,EAC5B,OAAe,EACf,QAAgB;IAEhB,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QACjF,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IACpE,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC1F,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,IAAY,EAAE,MAAc;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,IAAI,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAChD,OAAO,YAAY,CACjB,OAAO,EACP,IAAI,EACJ,sKAAsK,CACvK,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,mBAAmB,EACnB,wBAAwB,MAAM,ySAAyS,EACvU,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACnG,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,gBAAgB,YAAY,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,EAClE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CACpC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,EACpC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EACjC,GAAG,CACJ,CAAC;IACF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,oFAAoF,EACpF,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,cAAc,UAAU,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9D,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC1B,IAAI,EAAE,IAAI;gBACV,MAAM;gBACN,OAAO,EAAE,EAAE;aACZ,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,yBAAyB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sDAAsD,UAAU,iBAAiB,CACtI,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,UAAU,MAAM,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,GACzD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,EACtE,IAAI,CACL,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC1B,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,YAAY,CACjB,OAAO,EACP,IAAI,EACJ,oLAAoL,CACrL,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,UAAU,UAAU,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CACX,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,GAAG,UAAU,0BAA0B,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAC5E,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAC7F,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC1B,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,8BAA8B,UAAU,IAAI,CAC7F,CAAC;YACF,OAAO,CAAC,GAAG,CACT,mIAAmI,IAAI,MAAM,CAC9I,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClF,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAW,CAAC,CAAC;QAC3D,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;KAC7C,CAAC;IACF,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAC7F,OAAO,CAAC,GAAG,CACT,6CAA6C,UAAU,0CAA0C,MAAM,CAAC,IAAI,CAAC,2FAA2F,IAAI,MAAM,CACnN,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,IAAuB;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/cli/policy.js

@@ -30,9 +30,11 @@ import { isAbsolute, join, resolve as resolvePathSegments } from "node:path";
 import { explain, isActionClass } from "../core/policy-explain.js";
 import { loadPolicy, POLICY_FILENAMES } from "../core/policy-load.js";
 import { commandPolicyAmend } from "./amend.js";
+import { commandPolicyApply } from "./policy-apply.js";
 import { boolFlag, parseFlags, stringFlag } from "./args.js";
 import { commandPolicyAttest } from "./attest.js";
 import { EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { resolveScratchRoots } from "./hook.js";
 import { POLICY_CHECK_HELP, POLICY_HELP, POLICY_TEST_HELP } from "./help.js";
 import { relPath, style } from "./style.js";
 import { usageErrorText } from "./usage.js";
@@ -189,7 +191,13 @@ function runVerb(argv, streams, cwd, helpText) {
         if (!check.ok)
             return ioError(streams, json, check.message);
     }
-    const explanation = explain(loadPolicy(options), actionClass, reversibleFlag === null ? {} : { reversible: reversibleFlag === "true" });
+    const explanation = explain(loadPolicy(options), actionClass, {
+        ...(reversibleFlag === null ? {} : { reversible: reversibleFlag === "true" }),
+        // APRV-347. Resolved HERE, where the process may touch a disk, so the read
+        // scope a reader is shown is the one this machine would actually enforce
+        // rather than a description of the key.
+        systemReadRoots: resolveScratchRoots(cwd),
+    });
     if (json) {
         streams.out(`${JSON.stringify(explanation)}\n`);
     }
@@ -222,6 +230,11 @@ export function commandPolicy(argv, streams, cwd) {
         // It writes too, and for the same reason it lives in its own file.
         case "amend":
             return commandPolicyAmend(rest, streams, cwd);
+        // APRV-343. It writes the policy FILE, which nothing else in this CLI does,
+        // and then hands over to the amendment above so the edit and its
+        // attestation stay one act.
+        case "apply":
+            return commandPolicyApply(rest, streams, cwd);
         default:
             return usageError(streams, wantsJson(argv), `unknown subcommand ${JSON.stringify(sub)} for \`approval policy\``, POLICY_HELP);
     }