approval-md 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (235) hide show
  1. package/README.md +63 -24
  2. package/SPEC.md +57 -11
  3. package/dist/src/channels/contract.d.ts +34 -1
  4. package/dist/src/channels/contract.js +200 -7
  5. package/dist/src/channels/contract.js.map +1 -1
  6. package/dist/src/channels/telegram.d.ts +123 -11
  7. package/dist/src/channels/telegram.js +218 -23
  8. package/dist/src/channels/telegram.js.map +1 -1
  9. package/dist/src/channels/web.d.ts +9 -0
  10. package/dist/src/channels/web.js +17 -0
  11. package/dist/src/channels/web.js.map +1 -1
  12. package/dist/src/cli/amend.js +214 -30
  13. package/dist/src/cli/amend.js.map +1 -1
  14. package/dist/src/cli/attest.d.ts +9 -0
  15. package/dist/src/cli/attest.js +134 -7
  16. package/dist/src/cli/attest.js.map +1 -1
  17. package/dist/src/cli/channel-telegram.d.ts +99 -26
  18. package/dist/src/cli/channel-telegram.js +311 -13
  19. package/dist/src/cli/channel-telegram.js.map +1 -1
  20. package/dist/src/cli/channel.d.ts +9 -0
  21. package/dist/src/cli/channel.js +9 -0
  22. package/dist/src/cli/channel.js.map +1 -1
  23. package/dist/src/cli/codex-bridge.d.ts +819 -0
  24. package/dist/src/cli/codex-bridge.js +1607 -0
  25. package/dist/src/cli/codex-bridge.js.map +1 -0
  26. package/dist/src/cli/codex.d.ts +1 -1
  27. package/dist/src/cli/codex.js +304 -7
  28. package/dist/src/cli/codex.js.map +1 -1
  29. package/dist/src/cli/daemon.js +4 -1
  30. package/dist/src/cli/daemon.js.map +1 -1
  31. package/dist/src/cli/doctor.js +467 -12
  32. package/dist/src/cli/doctor.js.map +1 -1
  33. package/dist/src/cli/execute.js +25 -2
  34. package/dist/src/cli/execute.js.map +1 -1
  35. package/dist/src/cli/help.d.ts +6 -2
  36. package/dist/src/cli/help.js +165 -60
  37. package/dist/src/cli/help.js.map +1 -1
  38. package/dist/src/cli/hook-codex.d.ts +49 -1
  39. package/dist/src/cli/hook-codex.js +60 -1
  40. package/dist/src/cli/hook-codex.js.map +1 -1
  41. package/dist/src/cli/hook.d.ts +459 -3
  42. package/dist/src/cli/hook.js +1062 -114
  43. package/dist/src/cli/hook.js.map +1 -1
  44. package/dist/src/cli/import.js +1 -1
  45. package/dist/src/cli/import.js.map +1 -1
  46. package/dist/src/cli/main.js +5 -3
  47. package/dist/src/cli/main.js.map +1 -1
  48. package/dist/src/cli/policy-apply.d.ts +195 -0
  49. package/dist/src/cli/policy-apply.js +573 -0
  50. package/dist/src/cli/policy-apply.js.map +1 -0
  51. package/dist/src/cli/policy.js +14 -1
  52. package/dist/src/cli/policy.js.map +1 -1
  53. package/dist/src/cli/preflight.d.ts +151 -13
  54. package/dist/src/cli/preflight.js +398 -41
  55. package/dist/src/cli/preflight.js.map +1 -1
  56. package/dist/src/cli/sandbox.js +17 -1
  57. package/dist/src/cli/sandbox.js.map +1 -1
  58. package/dist/src/cli/scaffold.d.ts +1 -1
  59. package/dist/src/cli/scaffold.js +1 -1
  60. package/dist/src/cli/setup-channel.d.ts +9 -0
  61. package/dist/src/cli/setup-channel.js +28 -1
  62. package/dist/src/cli/setup-channel.js.map +1 -1
  63. package/dist/src/cli/setup-common.d.ts +3 -1
  64. package/dist/src/cli/setup-common.js +3 -2
  65. package/dist/src/cli/setup-common.js.map +1 -1
  66. package/dist/src/cli/setup.d.ts +2 -0
  67. package/dist/src/cli/setup.js +94 -2
  68. package/dist/src/cli/setup.js.map +1 -1
  69. package/dist/src/cli/up.js +115 -51
  70. package/dist/src/cli/up.js.map +1 -1
  71. package/dist/src/cli/values.js +3 -4
  72. package/dist/src/cli/values.js.map +1 -1
  73. package/dist/src/cli/verb-registry.js +174 -9
  74. package/dist/src/cli/verb-registry.js.map +1 -1
  75. package/dist/src/cli/wordmark.d.ts +2 -2
  76. package/dist/src/cli/wordmark.js +2 -2
  77. package/dist/src/codex/broker.d.ts +229 -0
  78. package/dist/src/codex/broker.js +548 -0
  79. package/dist/src/codex/broker.js.map +1 -0
  80. package/dist/src/codex/runner.d.ts +178 -0
  81. package/dist/src/codex/runner.js +231 -0
  82. package/dist/src/codex/runner.js.map +1 -0
  83. package/dist/src/codex/serve.d.ts +56 -0
  84. package/dist/src/codex/serve.js +98 -0
  85. package/dist/src/codex/serve.js.map +1 -0
  86. package/dist/src/codex/workspace-commit.d.ts +219 -0
  87. package/dist/src/codex/workspace-commit.js +549 -0
  88. package/dist/src/codex/workspace-commit.js.map +1 -0
  89. package/dist/src/core/advance-cycle.d.ts +51 -0
  90. package/dist/src/core/advance-cycle.js +66 -2
  91. package/dist/src/core/advance-cycle.js.map +1 -1
  92. package/dist/src/core/agents-md.d.ts +20 -18
  93. package/dist/src/core/agents-md.js +33 -31
  94. package/dist/src/core/agents-md.js.map +1 -1
  95. package/dist/src/core/attest.d.ts +215 -0
  96. package/dist/src/core/attest.js +317 -7
  97. package/dist/src/core/attest.js.map +1 -1
  98. package/dist/src/core/audit.d.ts +18 -0
  99. package/dist/src/core/audit.js +13 -0
  100. package/dist/src/core/audit.js.map +1 -1
  101. package/dist/src/core/channel-owner.d.ts +213 -0
  102. package/dist/src/core/channel-owner.js +358 -0
  103. package/dist/src/core/channel-owner.js.map +1 -0
  104. package/dist/src/core/command-class.d.ts +154 -0
  105. package/dist/src/core/command-class.js +673 -20
  106. package/dist/src/core/command-class.js.map +1 -1
  107. package/dist/src/core/commit-guard.d.ts +272 -0
  108. package/dist/src/core/commit-guard.js +424 -0
  109. package/dist/src/core/commit-guard.js.map +1 -0
  110. package/dist/src/core/daemon-actor.d.ts +45 -0
  111. package/dist/src/core/daemon-actor.js +54 -0
  112. package/dist/src/core/daemon-actor.js.map +1 -0
  113. package/dist/src/core/dark-session.d.ts +109 -8
  114. package/dist/src/core/dark-session.js +266 -82
  115. package/dist/src/core/dark-session.js.map +1 -1
  116. package/dist/src/core/decision-refusal.d.ts +23 -2
  117. package/dist/src/core/decision-refusal.js +24 -2
  118. package/dist/src/core/decision-refusal.js.map +1 -1
  119. package/dist/src/core/env-file.d.ts +5 -0
  120. package/dist/src/core/env-file.js +60 -1
  121. package/dist/src/core/env-file.js.map +1 -1
  122. package/dist/src/core/execute.d.ts +15 -2
  123. package/dist/src/core/execute.js +15 -2
  124. package/dist/src/core/execute.js.map +1 -1
  125. package/dist/src/core/gate.d.ts +86 -1
  126. package/dist/src/core/gate.js +81 -1
  127. package/dist/src/core/gate.js.map +1 -1
  128. package/dist/src/core/gesture-refusal.d.ts +166 -0
  129. package/dist/src/core/gesture-refusal.js +188 -0
  130. package/dist/src/core/gesture-refusal.js.map +1 -0
  131. package/dist/src/core/harness-version.d.ts +1 -1
  132. package/dist/src/core/harness-version.js +3 -1
  133. package/dist/src/core/harness-version.js.map +1 -1
  134. package/dist/src/core/instance.d.ts +59 -2
  135. package/dist/src/core/instance.js +113 -0
  136. package/dist/src/core/instance.js.map +1 -1
  137. package/dist/src/core/log.d.ts +39 -1
  138. package/dist/src/core/log.js.map +1 -1
  139. package/dist/src/core/policy-explain.d.ts +10 -0
  140. package/dist/src/core/policy-explain.js +32 -0
  141. package/dist/src/core/policy-explain.js.map +1 -1
  142. package/dist/src/core/policy-load.d.ts +41 -1
  143. package/dist/src/core/policy-load.js +21 -3
  144. package/dist/src/core/policy-load.js.map +1 -1
  145. package/dist/src/core/policy-match.d.ts +43 -0
  146. package/dist/src/core/policy-match.js +52 -0
  147. package/dist/src/core/policy-match.js.map +1 -1
  148. package/dist/src/core/policy-proposal.d.ts +52 -0
  149. package/dist/src/core/policy-proposal.js +102 -2
  150. package/dist/src/core/policy-proposal.js.map +1 -1
  151. package/dist/src/core/protected-path-guard.d.ts +117 -4
  152. package/dist/src/core/protected-path-guard.js +362 -48
  153. package/dist/src/core/protected-path-guard.js.map +1 -1
  154. package/dist/src/core/question-preempted.d.ts +141 -0
  155. package/dist/src/core/question-preempted.js +152 -0
  156. package/dist/src/core/question-preempted.js.map +1 -0
  157. package/dist/src/core/read-scope.d.ts +172 -0
  158. package/dist/src/core/read-scope.js +252 -0
  159. package/dist/src/core/read-scope.js.map +1 -0
  160. package/dist/src/core/sandbox.d.ts +81 -0
  161. package/dist/src/core/sandbox.js +190 -1
  162. package/dist/src/core/sandbox.js.map +1 -1
  163. package/dist/src/core/sender-identity.d.ts +476 -0
  164. package/dist/src/core/sender-identity.js +572 -0
  165. package/dist/src/core/sender-identity.js.map +1 -0
  166. package/dist/src/core/shlex.d.ts +102 -0
  167. package/dist/src/core/shlex.js +159 -0
  168. package/dist/src/core/shlex.js.map +1 -0
  169. package/dist/src/core/values.d.ts +18 -8
  170. package/dist/src/core/values.js +36 -1
  171. package/dist/src/core/values.js.map +1 -1
  172. package/dist/src/daemon/advance.d.ts +10 -0
  173. package/dist/src/daemon/advance.js +25 -4
  174. package/dist/src/daemon/advance.js.map +1 -1
  175. package/dist/src/daemon/daemon.js +9 -0
  176. package/dist/src/daemon/daemon.js.map +1 -1
  177. package/dist/src/daemon/git-evidence.d.ts +2 -2
  178. package/dist/src/daemon/git-evidence.js +1 -1
  179. package/dist/src/mcp/server.js +8 -0
  180. package/dist/src/mcp/server.js.map +1 -1
  181. package/docs/cli-reference.md +932 -32
  182. package/docs/codex-enforced-session.md +75 -2
  183. package/docs/codex-workspace-broker.md +118 -0
  184. package/package.json +3 -1
  185. package/schema/event.schema.json +538 -9
  186. package/schema/fixtures/event/invalid/approval-granted-sender-hashed-false.json +20 -0
  187. package/schema/fixtures/event/invalid/approval-granted-sender-hashed-raw-id.json +20 -0
  188. package/schema/fixtures/event/invalid/audit-gesture-refused-human-actor.json +16 -0
  189. package/schema/fixtures/event/invalid/audit-gesture-refused-no-actor-no-sender.json +15 -0
  190. package/schema/fixtures/event/invalid/audit-gesture-refused-unknown-gesture.json +16 -0
  191. package/schema/fixtures/event/invalid/audit-question-preempted-agent-actor.json +16 -0
  192. package/schema/fixtures/event/invalid/audit-question-preempted-no-question-id.json +16 -0
  193. package/schema/fixtures/event/invalid/audit-question-preempted-unknown-source.json +15 -0
  194. package/schema/fixtures/event/invalid/gate-path-signed-off-absolute-path.json +14 -0
  195. package/schema/fixtures/event/invalid/gate-path-signed-off-agent-actor.json +14 -0
  196. package/schema/fixtures/event/invalid/gate-path-signed-off-missing-path.json +13 -0
  197. package/schema/fixtures/event/valid/approval-granted-sender-hashed.json +20 -0
  198. package/schema/fixtures/event/valid/audit-gesture-refused-review-note.json +21 -0
  199. package/schema/fixtures/event/valid/audit-gesture-refused-sender-key-unavailable.json +19 -0
  200. package/schema/fixtures/event/valid/audit-gesture-refused.json +19 -0
  201. package/schema/fixtures/event/valid/audit-question-preempted-no-verdict.json +16 -0
  202. package/schema/fixtures/event/valid/audit-question-preempted.json +20 -0
  203. package/schema/fixtures/event/valid/gate-path-signed-off.json +14 -0
  204. package/schema/fixtures/event/valid/harness-kind-claude-code.json +23 -0
  205. package/schema/fixtures/event/valid/harness-kind-codex.json +23 -0
  206. package/schema/fixtures/event/valid/harness-kind-cursor.json +23 -0
  207. package/schema/fixtures/event/valid/harness-kind-grok.json +23 -0
  208. package/schema/fixtures/event/valid/harness-kind-muse.json +23 -0
  209. package/schema/fixtures/policy/invalid/senders-half-keyed.json +20 -0
  210. package/schema/fixtures/policy/valid/canonical.json +1 -1
  211. package/schema/fixtures/policy/valid/senders-keyed.json +24 -0
  212. package/schema/fixtures/policy-md/valid/canonical.md +1 -1
  213. package/schema/fixtures/policy-md/valid/with-values.md +5 -7
  214. package/schema/fixtures/values/invalid/class-shaped.json +1 -1
  215. package/schema/fixtures/values/invalid/duplicate-entry.json +1 -1
  216. package/schema/fixtures/values/invalid/non-string-item.json +1 -1
  217. package/schema/fixtures/values/invalid/over-cap.json +1 -1
  218. package/schema/fixtures/values/invalid/unknown-key.json +1 -1
  219. package/schema/fixtures/values/invalid/version-float.json +1 -0
  220. package/schema/fixtures/values/invalid/version-integer.json +1 -0
  221. package/schema/fixtures/values/invalid/version-wrong-string.json +1 -0
  222. package/schema/fixtures/values/valid/empty-lists.json +2 -3
  223. package/schema/fixtures/values/valid/full.json +5 -7
  224. package/schema/fixtures/values/valid/minimal.json +1 -1
  225. package/schema/fixtures/values-md/invalid/schema-invalid.md +5 -3
  226. package/schema/fixtures/values-md/invalid/two-blocks.md +3 -3
  227. package/schema/fixtures/values-md/invalid/unterminated.md +2 -2
  228. package/schema/fixtures/values-md/invalid/version-1.md +69 -0
  229. package/schema/fixtures/values-md/invalid/version-unquoted.md +64 -0
  230. package/schema/fixtures/values-md/invalid/yaml-error.md +2 -2
  231. package/schema/fixtures/values-md/valid/absent.md +1 -1
  232. package/schema/fixtures/values-md/valid/with-values.md +5 -7
  233. package/schema/policy.schema.json +54 -2
  234. package/schema/values.schema.json +7 -11
  235. package/schema/fixtures/values/invalid/version-string.json +0 -1
@@ -1 +1 @@
1
- {"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/cli/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAoB,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAA0B,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAyB,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,KAAK,GAA6B;IACtC,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,oCAAoC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,WAAwB;IACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,WAAW,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,MAAM,QAAQ,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;IACzE,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,IAAI,mBAAmB,CAAC;QACrE,OAAO,MAAM,QAAQ,wBAAwB,MAAM,KAAK,WAAW,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAwB,EACxB,GAAW,EACX,EAAE,GAAU,KAAK,EAAE;IAEnB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,EAAE,CAAC,KAAK,CACN,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACpC,CAAC,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE;QAChF,CAAC,CAAC,IAAI,CACT,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW,EAAE,QAAgB;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,+EAA+E,EAC7G,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAChE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACvF,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,2CAA2C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAC3E,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,OAAO,GACX,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IAEtE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CACzB,UAAU,CAAC,OAAO,CAAC,EACnB,WAAW,EACX,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,KAAK,MAAM,EAAE,CACzE,CAAC;IAEF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,EACf,0CAA0C,EAC1C,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACxD,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACvD,2EAA2E;QAC3E,wEAAwE;QACxE,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,2EAA2E;QAC3E,mEAAmE;QACnE,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAChD;YACE,OAAO,UAAU,CACf,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,EACf,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,0BAA0B,EACnE,WAAW,CACZ,CAAC;IACN,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/cli/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAoB,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAA0B,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAyB,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,KAAK,GAA6B;IACtC,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,oCAAoC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,IAAI,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,WAAwB;IACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,WAAW,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,MAAM,QAAQ,kBAAkB,WAAW,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;IACzE,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,IAAI,mBAAmB,CAAC;QACrE,OAAO,MAAM,QAAQ,wBAAwB,MAAM,KAAK,WAAW,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAwB,EACxB,GAAW,EACX,EAAE,GAAU,KAAK,EAAE;IAEnB,MAAM,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,EAAE,CAAC,KAAK,CACN,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACpC,CAAC,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE;QAChF,CAAC,CAAC,IAAI,CACT,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW,EAAE,QAAgB;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE3E,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,+EAA+E,EAC7G,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAChE,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QACvF,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,2CAA2C,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAC3E,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE5D,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,OAAO,GACX,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IAEtE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE;QAC5D,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,wCAAwC;QACxC,eAAe,EAAE,mBAAmB,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IAEH,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CACf,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,EACf,0CAA0C,EAC1C,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACxD,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACvD,2EAA2E;QAC3E,wEAAwE;QACxE,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,2EAA2E;QAC3E,mEAAmE;QACnE,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAChD,4EAA4E;QAC5E,iEAAiE;QACjE,4BAA4B;QAC5B,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAChD;YACE,OAAO,UAAU,CACf,OAAO,EACP,SAAS,CAAC,IAAI,CAAC,EACf,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,0BAA0B,EACnE,WAAW,CACZ,CAAC;IACN,CAAC;AACH,CAAC"}
@@ -15,19 +15,45 @@
15
15
  *
16
16
  * ## What it is allowed to do
17
17
  *
18
- * Read git, and at most three writes: a `--ff-only` merge, `npm run build`,
19
- * and, when the merge refused over an untracked file under `backlog/tasks/`
18
+ * Read git, and at most four writes: a `--ff-only` merge, `npm run build`,
19
+ * when the merge refused over an untracked file under `backlog/tasks/`
20
20
  * that main already contains, clearing that file out of the way (APRV-300, and
21
- * the rules it obeys are in {@link reconcileUntrackedTaskFiles}).
21
+ * the rules it obeys are in {@link reconcileUntrackedTaskFiles}), and the one
22
+ * `approval log sync` performs on its behalf (APRV-346, below).
22
23
  *
23
24
  * It never resets, never stashes, never checks anything out, and never touches
24
- * the working log. That list is not conservatism for its own sake — it is fork 2
25
- * of 2026-08-20 (APRV-104's notes, and the reason `approval log sync` exists at
26
- * all): a working `events.jsonl` rewound through git underneath a live appender
27
- * is two chains where there was one. `--ff-only` cannot rewind a file that
28
- * upstream did not change, and when upstream DID change it while the working
29
- * copy is dirty, this module refuses and names `approval log sync`, which is the
30
- * verb that knows how to do it safely.
25
+ * the working log ITSELF. That list is not conservatism for its own sake — it is
26
+ * fork 2 of 2026-08-20 (APRV-104's notes, and the reason `approval log sync`
27
+ * exists at all): a working `events.jsonl` rewound through git underneath a live
28
+ * appender is two chains where there was one. `--ff-only` cannot rewind a file
29
+ * that upstream did not change, and when upstream DID change it while the
30
+ * working copy is dirty, the file is moved by `cli/log-sync.ts` and by nothing
31
+ * here.
32
+ *
33
+ * ## The routine collision, and the one that is not (APRV-346)
34
+ *
35
+ * Every records advance moves `origin/main`'s `.approval/log/events.jsonl`
36
+ * while the hook keeps appending locally, so "upstream changed the log and so
37
+ * did this working copy" is the NORMAL state of the primary checkout after a
38
+ * merge rather than an edge case. Refusing it sent the operator to `approval log
39
+ * sync` and then back to `approval up` every single time, which is a two-step
40
+ * ritual for a state the preflight can already tell apart from a fork.
41
+ *
42
+ * So the collision is now a question rather than a verdict: is the working log a
43
+ * byte-for-byte EXTENSION of the committed one (main's records 1..N unchanged,
44
+ * local N+1.. following) or are they two chains that share a prefix and then
45
+ * differ? {@link planLogSync} asks `core/log-reconcile.ts` — the same comparison
46
+ * `log sync` and doctor's `log-drift` ask — and answers a plan or `null`:
47
+ *
48
+ * - a plan, and {@link runPreflight} calls `logSync` itself. Not a
49
+ * reimplementation of it: the APRV-215 ceremony (one hold of the append lock,
50
+ * snapshot, baseline, fast-forward, reconcile, rebuild the projections,
51
+ * post-verify) stays the single implementation, and this module supplies a
52
+ * caller rather than a copy;
53
+ * - `null`, and the old `up-preflight-log-diverged` refusal stands unchanged.
54
+ * A fork, a log that does not verify, a log at some path other than the
55
+ * repository's own, or any OTHER upstream-touched path locally modified all
56
+ * answer `null`. Every one of those is a judgment, and this module makes none.
31
57
  *
32
58
  * ## Refusals, not repairs
33
59
  *
@@ -38,9 +64,11 @@
38
64
  * commits exist that the remote does not have. A fast-forward is not the
39
65
  * operation for that state, and guessing which side to keep is a decision.
40
66
  * - `up-preflight-log-diverged` — the upstream range changes the working log or
41
- * the queue projection, and the working copy has uncommitted changes to them.
42
- * This is the case the human could not judge by eye, and it is `approval log
43
- * sync`'s whole subject.
67
+ * the queue projection, the working copy has uncommitted changes to them, AND
68
+ * the two chains are not in a prefix relationship (or cannot be compared at
69
+ * all). This is the case the human could not judge by eye, and it is `approval
70
+ * log sync`'s whole subject. The routine case — a working log that merely
71
+ * extends the committed one — is reconciled rather than refused (APRV-346).
44
72
  * - `up-preflight-dirty-protected` — some OTHER path the upstream range changes
45
73
  * is locally modified, so `git merge --ff-only` would refuse to overwrite it.
46
74
  * Named separately because the repair is different: look at the edit and
@@ -79,6 +107,8 @@
79
107
  * operator did not ask for, and says out loud that its answer is only as fresh
80
108
  * as the last fetch.
81
109
  */
110
+ import type { EventRecord } from "../core/log.js";
111
+ import { type LogRelation } from "../core/log-reconcile.js";
82
112
  import type { DoctorCheck } from "./doctor.js";
83
113
  import { type RunbookStep } from "./style.js";
84
114
  /**
@@ -167,6 +197,30 @@ export interface PreflightFacts {
167
197
  * answer and never this one.
168
198
  */
169
199
  reexec: boolean;
200
+ /**
201
+ * True when `approval log sync`'s reconcile ran on this preflight's behalf
202
+ * (APRV-346), which is the one write here that touches the working log.
203
+ *
204
+ * Always false from {@link inspectPreflight}, for the same reason `reexec` is:
205
+ * inspection performs nothing, so it can never be the thing that did this.
206
+ * What inspection answers instead is {@link PreflightReport}'s `sync`, which
207
+ * is the plan rather than the deed.
208
+ */
209
+ log_synced: boolean;
210
+ }
211
+ /**
212
+ * The reconcile the preflight would hand to `approval log sync`, or has.
213
+ *
214
+ * Present on a report only when the protected-path collision is the routine one
215
+ * (APRV-346): the working chain and the committed chain stand in a prefix
216
+ * relationship, so adopting the longer one extends and never rewinds. A fork,
217
+ * or a chain that cannot be verified, has no plan — it has a refusal.
218
+ */
219
+ export interface PreflightSyncPlan {
220
+ /** How the working chain stands relative to the committed one at the target. */
221
+ relation: LogRelation;
222
+ /** Records the working chain holds beyond the committed one: what is kept. */
223
+ kept: number;
170
224
  }
171
225
  /** A refusal, in the APRV-129 runbook's own vocabulary. */
172
226
  export interface PreflightRefusal {
@@ -190,6 +244,11 @@ export type PreflightReport = {
190
244
  target: string | null;
191
245
  /** Where the judgment was made. `null` when there was no repository. */
192
246
  root: string | null;
247
+ /**
248
+ * The reconcile this preflight would ask `approval log sync` for, or
249
+ * `null` when the working log needs nothing (APRV-346).
250
+ */
251
+ sync: PreflightSyncPlan | null;
193
252
  } | {
194
253
  ok: false;
195
254
  facts: PreflightFacts;
@@ -230,6 +289,16 @@ export interface PreflightInput {
230
289
  * without any risk of doctor repairing something, which doctor has never done.
231
290
  */
232
291
  export declare function inspectPreflight(input: PreflightInput): PreflightReport;
292
+ /** What the reconcile actually did, once `approval log sync` had run it. */
293
+ export interface PreflightSynced {
294
+ /** The commit the checkout ended on. */
295
+ commit: string;
296
+ /** Local records the reconcile put back on top of it. */
297
+ kept: number;
298
+ relation: LogRelation;
299
+ remote: string;
300
+ branch: string;
301
+ }
233
302
  /** What {@link runPreflight} did, with the facts as they ended up. */
234
303
  export type PreflightOutcome = {
235
304
  ok: true;
@@ -238,6 +307,8 @@ export type PreflightOutcome = {
238
307
  warning: string | null;
239
308
  /** Present when a rebuild happened: the caller must become this child. */
240
309
  reexec?: ReexecPlan;
310
+ /** Present when the reconcile ran: what it fast-forwarded and kept. */
311
+ synced?: PreflightSynced;
241
312
  } | {
242
313
  ok: false;
243
314
  facts: PreflightFacts;
@@ -303,6 +374,26 @@ export type PreflightEvent = ({
303
374
  } & PreflightFacts) | {
304
375
  event: "preflight_warning";
305
376
  message: string;
377
+ }
378
+ /**
379
+ * The reconcile, when there was one (APRV-346). A third additive shape rather
380
+ * than a field on `preflight`: a consumer that already parses that line must
381
+ * not have to learn a key to keep working, and this is a different fact —
382
+ * what `approval log sync` did, not what the preflight found.
383
+ */
384
+ | ({
385
+ event: "preflight_sync";
386
+ } & PreflightSynced)
387
+ /**
388
+ * The attested policy is not on the remote yet (APRV-342). Emitted only when
389
+ * that is TRUE: `up` reports the interregnum and never refuses on it, because
390
+ * a policy amendment waiting on a pull request is a normal state of a
391
+ * repository and not a reason to refuse to run the gate.
392
+ */
393
+ | {
394
+ event: "preflight_policy";
395
+ detail: string;
396
+ fix: string | null;
306
397
  };
307
398
  /** One preflight line as a human sentence, and where it belongs. */
308
399
  export declare function describePreflightEvent(event: PreflightEvent): {
@@ -311,9 +402,26 @@ export declare function describePreflightEvent(event: PreflightEvent): {
311
402
  };
312
403
  /** How a caller emits one line. `up` and `daemon run` route theirs identically. */
313
404
  export type PreflightEmit = (event: PreflightEvent) => void;
405
+ /**
406
+ * The policy file `--policy` names, or the one `--dir` (else `cwd`) holds.
407
+ *
408
+ * Discovery, not a load: this answers WHICH FILE, so the preflight can compare
409
+ * its attested hash against the remote's copy (APRV-342) before either caller
410
+ * has loaded a policy. The order is `core/policy-load.ts`'s own, so the file
411
+ * named here is the file the runtime will go on to enforce. `null` when there is
412
+ * no such file, which is not a finding — `approval doctor`'s `policy` rows are
413
+ * where an absent policy is somebody's problem.
414
+ */
415
+ export declare function preflightPolicyPath(policyFlag: string | null, dirFlag: string | null, cwd: string): string | null;
314
416
  export interface StartupPreflightInput {
315
417
  logPath: string;
316
418
  queuePath: string;
419
+ /**
420
+ * The policy file, for the `attested-policy-on-main` line (APRV-342). `null`
421
+ * where the caller could not name one, and the line is then not emitted:
422
+ * there is nothing to compare, which is not a finding.
423
+ */
424
+ policyPath?: string | null;
317
425
  /** The installation whose `dist/` is dated. `null` means "ask this build". */
318
426
  root: string | null;
319
427
  remote: string | null;
@@ -360,4 +468,34 @@ export declare function renderPreflightRefusal(outcome: PreflightOutcome & {
360
468
  * never `git`. That constraint predates this row and is the right one — a repair
361
469
  * line telling an operator to reset a branch would be doctor making a decision.
362
470
  */
471
+ /**
472
+ * `attested-policy-on-main`, doctor's row for the interregnum (APRV-342).
473
+ *
474
+ * Between a policy amendment and its pull request merging there is a window
475
+ * where the attestation is in the log and the amended `APPROVAL.md` is in the
476
+ * working tree, and `origin/main` carries neither. A fresh checkout of main in
477
+ * that window has the OLD policy with no attestation covering it, and every
478
+ * gate operation there refuses `policy-not-attested`.
479
+ *
480
+ * Nothing said so. On 2026-09-16 `approval up` ran its preflight in exactly that
481
+ * state and reported "already at the remote tip"; doctor's `attestation` row
482
+ * passed, because the LOCAL file is attested and that row asks a different
483
+ * question. This row asks the missing one: is the policy the log vouches for the
484
+ * policy `origin/<branch>` carries?
485
+ *
486
+ * Read-only, and networkless. The remote tip is read from the last fetch, like
487
+ * every other answer doctor gives about a remote, and the `policy-amend-<seq>`
488
+ * branch is looked for among the remote-tracking refs rather than asked of
489
+ * GitHub: a report that reached the network to be more accurate would be doing
490
+ * something on its own account.
491
+ */
492
+ export declare function checkAttestedPolicyOnMain(input: {
493
+ policyPath: string;
494
+ /** The log, verified, in append order. Doctor's own records; `up` re-reads. */
495
+ records: readonly EventRecord[];
496
+ /** The repository the policy lives in, or `null` when it is not in one. */
497
+ root: string | null;
498
+ remote?: string;
499
+ branch?: string;
500
+ }): DoctorCheck;
363
501
  export declare function checkMainBehindOrigin(logPath: string, queuePath: string, root: string): DoctorCheck;