ctxr-cli 0.24.0 → 0.26.0

package/dist/config/schema.d.ts

@@ -39,6 +39,29 @@ declare const GraphSettingsSchema: z.ZodObject<{
     bridge_top: z.ZodDefault<z.ZodNumber>;
     orphan_exempt_clusters: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+/**
+ * approve-from-the-review-page (change-approval spec): the opt-in block that
+ * turns on the approval page and the landing path. No shipped default and
+ * `.optional()`, like `serve`, so a store that never opts in never carries
+ * the key. Tokens never live here — serve and `ctxr land` read their forge
+ * credential from their own environments (design.md D10).
+ */
+declare const ChangeApprovalSchema: z.ZodObject<{
+    identity: z.ZodObject<{
+        header: z.ZodString;
+        issuer: z.ZodString;
+        audience: z.ZodString;
+        jwks_url: z.ZodString;
+    }, z.core.$strip>;
+    deciders: z.ZodArray<z.ZodString>;
+    recording_login: z.ZodString;
+    resolver: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    merge_method: z.ZodOptional<z.ZodEnum<{
+        merge: "merge";
+        rebase: "rebase";
+        squash: "squash";
+    }>>;
+}, z.core.$strip>;
 declare const AdapterDeclarationSchema: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodEnum<{
@@ -96,6 +119,22 @@ export declare const StoreConfigSchema: z.ZodObject<{
             none: "none";
         }>>;
     }, z.core.$strip>>;
+    change_approval: z.ZodOptional<z.ZodObject<{
+        identity: z.ZodObject<{
+            header: z.ZodString;
+            issuer: z.ZodString;
+            audience: z.ZodString;
+            jwks_url: z.ZodString;
+        }, z.core.$strip>;
+        deciders: z.ZodArray<z.ZodString>;
+        recording_login: z.ZodString;
+        resolver: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        merge_method: z.ZodOptional<z.ZodEnum<{
+            merge: "merge";
+            rebase: "rebase";
+            squash: "squash";
+        }>>;
+    }, z.core.$strip>>;
     templates: z.ZodPrefault<z.ZodObject<{
         path: z.ZodDefault<z.ZodString>;
         installed: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -167,5 +206,6 @@ export type StoreConfig = z.infer<typeof StoreConfigSchema>;
 export type TaxonomyLayerConfig = z.infer<typeof TaxonomyLayerSchema>;
 export type GraphSettingsConfig = z.infer<typeof GraphSettingsSchema>;
 export type AdapterDeclaration = z.infer<typeof AdapterDeclarationSchema>;
+export type ChangeApprovalConfig = z.infer<typeof ChangeApprovalSchema>;
 export {};
 //# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAYH;;;;;;GAMG;AACH,QAAA,MAAM,mBAAmB;;;;;iBAKvB,CAAC;AAuTH,QAAA,MAAM,wBAAwB;;;;;;;iBAM5B,CAAC;AAiBH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgD1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAYH;;;;;;GAMG;AACH,QAAA,MAAM,mBAAmB;;;;;iBAKvB,CAAC;AA6GH;;;;;;GAMG;AACH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;iBAwBxB,CAAC;AA4MH,QAAA,MAAM,wBAAwB;;;;;;;iBAM5B,CAAC;AAiBH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyD1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/config/schema.js

@@ -149,6 +149,36 @@ const ServeSchema = z.object({
      */
     previews: z.enum(['local', 'none']).optional(),
 });
+/**
+ * approve-from-the-review-page (change-approval spec): the opt-in block that
+ * turns on the approval page and the landing path. No shipped default and
+ * `.optional()`, like `serve`, so a store that never opts in never carries
+ * the key. Tokens never live here — serve and `ctxr land` read their forge
+ * credential from their own environments (design.md D10).
+ */
+const ChangeApprovalSchema = z.object({
+    /** design.md D2: the signed assertion the access proxy in front forwards on every request. */
+    identity: z.object({
+        header: z.string().min(1),
+        issuer: z.string().min(1),
+        audience: z.string().min(1),
+        jwks_url: z.string().min(1).refine(isAbsoluteHttpBase, { message: 'must be an absolute http(s) URL' }),
+    }),
+    /** Each entry is an exact email address or an `@domain` suffix. */
+    deciders: z
+        .array(z
+        .string()
+        .min(2)
+        .refine((entry) => /^@[^@\s]+$/.test(entry) || /^[^@\s]+@[^@\s]+$/.test(entry), {
+        message: 'must be an email address or an @domain entry',
+    }))
+        .min(1),
+    /** design.md D4: the forge login whose reviews count as decisions; never the login that opens pull requests. */
+    recording_login: z.string().min(1),
+    /** design.md D6: the argument vector `ctxr land` runs on a conflict; absent means a conflict blocks. */
+    resolver: z.array(z.string().min(1)).min(1).optional(),
+    merge_method: z.enum(['squash', 'merge', 'rebase']).optional(),
+});
 /**
  * harness-portability spec (vendored-craft-skills): which vendored
  * third-party skills a store wants, defaulting to the shipped set so a
@@ -386,6 +416,7 @@ export const StoreConfigSchema = z
     // records only the store's own decisions. Absent, it stays absent through
     // parse, render and reparse.
     serve: ServeSchema.optional(),
+    change_approval: ChangeApprovalSchema.optional(),
     templates: TemplatesSchema.prefault({}),
     skills: SkillsSchema.prefault({}),
     update_check: UpdateCheckSchema.prefault({}),
@@ -396,6 +427,14 @@ export const StoreConfigSchema = z
 })
     .passthrough()
     .superRefine((value, ctx) => {
+    // change-approval spec: the decision route checks a request's Origin against the base URL (design.md D9).
+    if (value.change_approval !== undefined && value.serve?.base_url === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['change_approval'],
+            message: 'change_approval requires serve.base_url, which the decision route checks each request\'s Origin against',
+        });
+    }
     /**
      * retain-captures-as-provenance (D7): one prefix has to serve both the
      * retrieval exclusion and the write-path gate, which only holds while the

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;CACxE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACtF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5F,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;CAClH,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACzF;;;;;;;;;;OAUG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvF,kGAAkG;IAClG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,CAAC;IAClG,gIAAgI;IAChI,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC;CACxG,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC;CACnF,CAAC,CAAC;AAEH,iKAAiK;AACjK,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,uBAAuB,CAAC;IACtH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC;CACnG,CAAC,CAAC;AAEH;;;;;;GAMG;AACH;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;AACrH,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,kBAAkB,EAAE;QAC1B,OAAO,EAAE,8HAA8H;KACxI,CAAC;SACD,QAAQ,EAAE;IACb;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;;;GAKG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC;CAClF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;CAC7E,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;IAC7E,iKAAiK;IACjK,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1F;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,uKAAuK;IACvK,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtG;;;;;;;OAOG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,qHAAqH;IACrH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;CACpG,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxB;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACrD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EACL,0IAA0I;SAC7I,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,kBAAkB;QACvC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,yFAAyF;QACzF,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACxG;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAChH,0GAA0G;IAC1G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9E,uGAAuG;IACvG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,CAAC;CACvH,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACnB;;;OAGG;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7E,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;IACnF,2EAA2E;IAC3E,wFAAwF;IACxF,wEAAwE;IACxE,+EAA+E;IAC/E,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uEAAuE;QACvE,sEAAsE;QACtE,gDAAgD;QAChD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,GAAG,CAAC,KAAK,CAAC,2BAA2B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/H,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEzD,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,8KAA8K;IAC9K,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,cAAc;IACxB,yEAAyE;IACzE,mEAAmE;IACnE,uEAAuE;IACvE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;IAC7B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;KACD,WAAW,EAAE;KACb,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B;;;;;;;;OAQG;IACH,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,+CAA+C,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI;SACjH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;CACxE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;IACtF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5F,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;CAClH,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACzF;;;;;;;;;;OAUG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvF,kGAAkG;IAClG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,CAAC;IAClG,gIAAgI;IAChI,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC;CACxG,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,cAAc,CAAC;CACnF,CAAC,CAAC;AAEH,iKAAiK;AACjK,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,uBAAuB,CAAC;IACtH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC;CACnG,CAAC,CAAC;AAEH;;;;;;GAMG;AACH;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;AACrH,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,kBAAkB,EAAE;QAC1B,OAAO,EAAE,8HAA8H;KACxI,CAAC;SACD,QAAQ,EAAE;IACb;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;KACvG,CAAC;IACF,mEAAmE;IACnE,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC9E,OAAO,EAAE,8CAA8C;KACxD,CAAC,CACL;SACA,GAAG,CAAC,CAAC,CAAC;IACT,gHAAgH;IAChH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,wGAAwG;IACxG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAEH;;;;;GAKG;AACH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC;CAClF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;CAC7E,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;IAC7E,iKAAiK;IACjK,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1F;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,uKAAuK;IACvK,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACtG;;;;;;;OAOG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,qHAAqH;IACrH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvE,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;CACpG,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxB;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACrD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EACL,0IAA0I;SAC7I,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,kBAAkB;QACvC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,yFAAyF;QACzF,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C;;;;;;;;OAQG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACxG;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAChH,0GAA0G;IAC1G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9E,uGAAuG;IACvG,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,CAAC;CACvH,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACnB;;;OAGG;IACH,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7E,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC;IACnF,2EAA2E;IAC3E,wFAAwF;IACxF,wEAAwE;IACxE,+EAA+E;IAC/E,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,uEAAuE;QACvE,sEAAsE;QACtE,gDAAgD;QAChD,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,KAAK,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,GAAG,CAAC,KAAK,CAAC,2BAA2B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/H,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEzD,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,8KAA8K;IAC9K,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,cAAc;IACxB,yEAAyE;IACzE,mEAAmE;IACnE,uEAAuE;IACvE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,eAAe,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;IAC7B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;KACD,WAAW,EAAE;KACb,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,0GAA0G;IAC1G,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,yGAAyG;SACnH,CAAC,CAAC;IACL,CAAC;IACD;;;;;;;;OAQG;IACH,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,+CAA+C,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI;SACjH,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/core/approval/decision.d.ts

@@ -0,0 +1,73 @@
+import type { IssueComment, Review } from '../forge/github.js';
+/**
+ * change-approval spec (design.md D3): a decision lives on the forge, as a
+ * review by the recording login whose body carries a sentence for people and
+ * a marker for this module. The landing path's own records (a block, a
+ * resolved conflict awaiting a new decision) are comments by the same login
+ * with a marker of their own. Nothing else — no local file — holds either.
+ *
+ * Marker values never contain spaces (commit ids, emails, ISO times, slugs),
+ * so a marker is `key=value` tokens separated by single spaces.
+ */
+export declare const DECISION_MARKER = "ctxr-decision";
+export declare const LANDING_MARKER = "ctxr-land";
+export type DecisionKind = 'approve' | 'request-changes';
+export interface Decision {
+    decision: DecisionKind;
+    head: string;
+    by: string;
+    at: string;
+    /** Set on a carry-over (design.md D5): the head the person approved, which this head carries over from. */
+    carriedFrom: string | null;
+    /** The comment of a request for changes; null for an approval. */
+    comment: string | null;
+}
+export type LandingRecordState = 'blocked' | 'needs-reapproval';
+export interface LandingMark {
+    state: LandingRecordState;
+    reason: string;
+    head: string;
+    at: string;
+}
+/** The review body for a decision: one sentence, the comment when there is one, then the marker. */
+export declare function decisionBody(decision: Decision): string;
+export declare function parseDecision(body: string): Decision | null;
+/** The comment body for a landing record: a sentence for people, then the marker. */
+export declare function landingBody(mark: LandingMark, sentence: string): string;
+export declare function parseLandingMark(body: string): LandingMark | null;
+export type ReviewStateName = 'awaiting' | 'approved' | 'changes-requested' | 'needs-reapproval' | 'blocked';
+export interface ReviewState {
+    state: ReviewStateName;
+    /** The latest decision by the recording login, if any. */
+    decision: Decision | null;
+    /** The latest landing record by the recording login, when it is what decides the state. */
+    landing: LandingMark | null;
+    /**
+     * True when the latest decision approves a head other than the current one and no landing record
+     * overrides it: the caller decides, by patch identity, whether the current head carries it over.
+     */
+    approvalNeedsCarryCheck: boolean;
+}
+/**
+ * change-approval spec ("Only reviews by the recording identity count"): the
+ * latest well-formed decision by `recordingLogin` decides, and the latest
+ * landing record by the same login overrides it when it was posted later and
+ * is about the current head. Anything by any other login is not read at all.
+ *
+ * "Latest" is the forge's own posting time (stable-sorted, so the forge's order
+ * breaks ties), never the marker's `at`: a carry-over keeps the time the person
+ * decided (design.md D5) while being the newer record.
+ *
+ * An approval of a different head is reported as `needs-reapproval` with
+ * `approvalNeedsCarryCheck` set; whether a clean rebase carries it over is a
+ * git question this module does not ask (write-lifecycle spec).
+ */
+export declare function resolveReviewState(input: {
+    reviews: readonly Review[];
+    comments: readonly IssueComment[];
+    recordingLogin: string;
+    head: string;
+}): ReviewState;
+/** change-approval spec: an exact email, or an `@domain` entry matching that domain exactly. */
+export declare function isDecider(email: string, deciders: readonly string[]): boolean;
+//# sourceMappingURL=decision.d.ts.map

package/dist/core/approval/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../../src/core/approval/decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAC/C,eAAO,MAAM,cAAc,cAAc,CAAC;AAG1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,2GAA2G;IAC3G,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAgCD,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAevD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAe3D;AAED,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAOjE;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,SAAS,CAAC;AAE7G,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,WAAW,CAiCd;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAS7E"}

package/dist/core/approval/decision.js

@@ -0,0 +1,166 @@
+/**
+ * change-approval spec (design.md D3): a decision lives on the forge, as a
+ * review by the recording login whose body carries a sentence for people and
+ * a marker for this module. The landing path's own records (a block, a
+ * resolved conflict awaiting a new decision) are comments by the same login
+ * with a marker of their own. Nothing else — no local file — holds either.
+ *
+ * Marker values never contain spaces (commit ids, emails, ISO times, slugs),
+ * so a marker is `key=value` tokens separated by single spaces.
+ */
+export const DECISION_MARKER = 'ctxr-decision';
+export const LANDING_MARKER = 'ctxr-land';
+const MARKER_VERSION = 'v1';
+function marker(name, fields) {
+    const tokens = Object.entries(fields).map(([key, value]) => `${key}=${value}`);
+    return `<!-- ${name} ${MARKER_VERSION} ${tokens.join(' ')} -->`;
+}
+/**
+ * Only a marker that ends the body counts. The body is built with the marker
+ * last, and a comment above it is the decider's own text — which must never be
+ * able to carry a marker that reads as a different decision, head or decider.
+ */
+function parseMarker(name, body) {
+    const pattern = new RegExp(`<!-- ${name} ${MARKER_VERSION} ([^>]*?) -->\\s*$`);
+    const found = pattern.exec(body);
+    if (found === null)
+        return null;
+    const fields = {};
+    for (const token of found[1].split(' ')) {
+        const eq = token.indexOf('=');
+        if (eq <= 0)
+            return null;
+        fields[token.slice(0, eq)] = token.slice(eq + 1);
+    }
+    return fields;
+}
+const SHA = /^[0-9a-f]{40}$/;
+const NO_SPACE = /^\S+$/;
+function neutralizeComment(comment) {
+    return comment.replace(/<!--/g, '<! --').replace(/-->/g, '-- >');
+}
+/** The review body for a decision: one sentence, the comment when there is one, then the marker. */
+export function decisionBody(decision) {
+    const short = decision.head.slice(0, 7);
+    const sentence = decision.carriedFrom !== null
+        ? `Carried over from ${decision.carriedFrom.slice(0, 7)} to ${short} by a clean rebase (patches unchanged). Approved by ${decision.by}.`
+        : decision.decision === 'approve'
+            ? `Approved by ${decision.by} on the review page, for commit ${short}.`
+            : `Changes requested by ${decision.by} on the review page, for commit ${short}.`;
+    const fields = { decision: decision.decision, head: decision.head, by: decision.by, at: decision.at };
+    if (decision.carriedFrom !== null)
+        fields['carried-from'] = decision.carriedFrom;
+    const parts = [sentence];
+    // A comment cannot open an HTML comment of its own, so it can neither hide text on the forge nor imitate a marker.
+    if (decision.comment !== null)
+        parts.push(neutralizeComment(decision.comment.trim()));
+    parts.push(marker(DECISION_MARKER, fields));
+    return parts.join('\n\n');
+}
+export function parseDecision(body) {
+    const fields = parseMarker(DECISION_MARKER, body);
+    if (fields === null)
+        return null;
+    const { decision, head, by, at } = fields;
+    if (decision !== 'approve' && decision !== 'request-changes')
+        return null;
+    if (head === undefined || !SHA.test(head))
+        return null;
+    if (by === undefined || !NO_SPACE.test(by) || at === undefined || !NO_SPACE.test(at))
+        return null;
+    const carriedFrom = fields['carried-from'] ?? null;
+    if (carriedFrom !== null && !SHA.test(carriedFrom))
+        return null;
+    let comment = null;
+    if (decision === 'request-changes') {
+        const paragraphs = body.slice(0, body.lastIndexOf(`<!-- ${DECISION_MARKER}`)).split('\n\n');
+        comment = paragraphs.slice(1).join('\n\n').trim();
+    }
+    return { decision, head, by, at, carriedFrom, comment };
+}
+/** The comment body for a landing record: a sentence for people, then the marker. */
+export function landingBody(mark, sentence) {
+    return `${sentence}\n\n${marker(LANDING_MARKER, { state: mark.state, reason: mark.reason, head: mark.head, at: mark.at })}`;
+}
+export function parseLandingMark(body) {
+    const fields = parseMarker(LANDING_MARKER, body);
+    if (fields === null)
+        return null;
+    const { state, reason, head, at } = fields;
+    if (state !== 'blocked' && state !== 'needs-reapproval')
+        return null;
+    if (reason === undefined || head === undefined || !SHA.test(head) || at === undefined)
+        return null;
+    return { state, reason, head, at };
+}
+function timeOf(value) {
+    const t = value === null ? Number.NaN : Date.parse(value);
+    return Number.isNaN(t) ? 0 : t;
+}
+/**
+ * change-approval spec ("Only reviews by the recording identity count"): the
+ * latest well-formed decision by `recordingLogin` decides, and the latest
+ * landing record by the same login overrides it when it was posted later and
+ * is about the current head. Anything by any other login is not read at all.
+ *
+ * "Latest" is the forge's own posting time (stable-sorted, so the forge's order
+ * breaks ties), never the marker's `at`: a carry-over keeps the time the person
+ * decided (design.md D5) while being the newer record.
+ *
+ * An approval of a different head is reported as `needs-reapproval` with
+ * `approvalNeedsCarryCheck` set; whether a clean rebase carries it over is a
+ * git question this module does not ask (write-lifecycle spec).
+ */
+export function resolveReviewState(input) {
+    let decision = null;
+    let decisionTime = -1;
+    for (const review of input.reviews) {
+        if (review.author !== input.recordingLogin)
+            continue;
+        const parsed = parseDecision(review.body);
+        if (parsed === null)
+            continue;
+        const t = timeOf(review.submittedAt);
+        if (t >= decisionTime) {
+            decision = parsed;
+            decisionTime = t;
+        }
+    }
+    let landing = null;
+    let landingTime = -1;
+    for (const comment of input.comments) {
+        if (comment.author !== input.recordingLogin)
+            continue;
+        const parsed = parseLandingMark(comment.body);
+        if (parsed === null)
+            continue;
+        const t = timeOf(comment.createdAt);
+        if (t >= landingTime) {
+            landing = parsed;
+            landingTime = t;
+        }
+    }
+    if (landing !== null && landing.head === input.head && landingTime >= decisionTime) {
+        return { state: landing.state, decision, landing, approvalNeedsCarryCheck: false };
+    }
+    if (decision === null)
+        return { state: 'awaiting', decision, landing: null, approvalNeedsCarryCheck: false };
+    if (decision.decision === 'request-changes')
+        return { state: 'changes-requested', decision, landing: null, approvalNeedsCarryCheck: false };
+    if (decision.head === input.head)
+        return { state: 'approved', decision, landing: null, approvalNeedsCarryCheck: false };
+    return { state: 'needs-reapproval', decision, landing: null, approvalNeedsCarryCheck: true };
+}
+/** change-approval spec: an exact email, or an `@domain` entry matching that domain exactly. */
+export function isDecider(email, deciders) {
+    const normalized = email.toLowerCase();
+    const at = normalized.lastIndexOf('@');
+    if (at <= 0)
+        return false;
+    const domain = normalized.slice(at);
+    return deciders.some((entry) => {
+        const e = entry.toLowerCase();
+        return e.startsWith('@') ? domain === e : normalized === e;
+    });
+}
+//# sourceMappingURL=decision.js.map

package/dist/core/approval/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../../src/core/approval/decision.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAC1C,MAAM,cAAc,GAAG,IAAI,CAAC;AAwB5B,SAAS,MAAM,CAAC,IAAY,EAAE,MAA8B;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/E,OAAO,QAAQ,IAAI,IAAI,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,cAAc,oBAAoB,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC;AAEzB,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GACZ,QAAQ,CAAC,WAAW,KAAK,IAAI;QAC3B,CAAC,CAAC,qBAAqB,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,uDAAuD,QAAQ,CAAC,EAAE,GAAG;QACxI,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,CAAC,eAAe,QAAQ,CAAC,EAAE,mCAAmC,KAAK,GAAG;YACvE,CAAC,CAAC,wBAAwB,QAAQ,CAAC,EAAE,mCAAmC,KAAK,GAAG,CAAC;IACvF,MAAM,MAAM,GAA2B,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9H,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;QAAE,MAAM,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,mHAAmH;IACnH,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5F,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,QAAgB;IAC7D,OAAO,GAAG,QAAQ,OAAO,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACrC,CAAC;AAiBD,SAAS,MAAM,CAAC,KAAoB;IAClC,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;YAAE,SAAS;QACrD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACtB,QAAQ,GAAG,MAAM,CAAC;YAClB,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAuB,IAAI,CAAC;IACvC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;YAAE,SAAS;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACrB,OAAO,GAAG,MAAM,CAAC;YACjB,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IAC7G,IAAI,QAAQ,CAAC,QAAQ,KAAK,iBAAiB;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IAC5I,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC;IACxH,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,QAA2B;IAClE,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/approval/file-diff.d.ts

@@ -0,0 +1,32 @@
+import type { GitRunner } from '../git/exec.js';
+/**
+ * change-approval spec ("The approval page shows the change itself"): every
+ * file under the store root that differs between the base and the pull
+ * request's head, as removed and added lines. Read from git's object store
+ * with a three-dot range, so the base is the merge base and the worktree's
+ * uncommitted work never enters it; derived cache paths are excluded.
+ */
+export interface DiffLine {
+    kind: 'add' | 'del' | 'ctx';
+    text: string;
+}
+export interface FileDiff {
+    path: string;
+    /** Set when git detected a rename. */
+    oldPath: string | null;
+    status: 'added' | 'removed' | 'modified' | 'moved';
+    binary: boolean;
+    hunks: {
+        header: string;
+        lines: DiffLine[];
+    }[];
+}
+export declare function readFileDiffs(git: GitRunner, storeRoot: string, base: string, head: string, derivedPaths: readonly string[]): Promise<FileDiff[]>;
+/** Parses `git diff` output. Exported for tests. */
+export declare function parseUnifiedDiff(text: string): FileDiff[];
+/** Each file as a heading and a block of marked lines — readable with no script and no colour. */
+export declare function renderFileDiffs(files: readonly FileDiff[], labels: {
+    binary: string;
+    noFiles: string;
+}): string;
+//# sourceMappingURL=file-diff.d.ts.map

package/dist/core/approval/file-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-diff.d.ts","sourceRoot":"","sources":["../../../src/core/approval/file-diff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;IACnD,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;KAAE,EAAE,CAAC;CAChD;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAOvJ;AAOD,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAoCzD;AAKD,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkB/G"}

package/dist/core/approval/file-diff.js

@@ -0,0 +1,83 @@
+import { escapeHtml } from '../browse/render.js';
+export async function readFileDiffs(git, storeRoot, base, head, derivedPaths) {
+    const excludes = derivedPaths.map((p) => `:(exclude)${p.replace(/\/+$/, '')}`);
+    const { stdout } = await git.run(['diff', '--no-color', '--no-ext-diff', '-M', '--relative', `${base}...${head}`, '--', '.', ...excludes], { cwd: storeRoot });
+    return parseUnifiedDiff(stdout);
+}
+function unquote(raw) {
+    if (!raw.startsWith('"'))
+        return raw;
+    return JSON.parse(raw.replace(/\\([0-7]{3})/g, (_m, oct) => `\\u00${Number.parseInt(oct, 8).toString(16).padStart(2, '0')}`));
+}
+/** Parses `git diff` output. Exported for tests. */
+export function parseUnifiedDiff(text) {
+    const files = [];
+    let current = null;
+    let hunk = null;
+    for (const line of text.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            const match = /^diff --git a\/(.*) b\/(.*)$/.exec(line);
+            current = { path: unquote(match?.[2] ?? line), oldPath: null, status: 'modified', binary: false, hunks: [] };
+            hunk = null;
+            files.push(current);
+            continue;
+        }
+        if (current === null)
+            continue;
+        if (hunk === null) {
+            if (line.startsWith('new file mode'))
+                current.status = 'added';
+            else if (line.startsWith('deleted file mode'))
+                current.status = 'removed';
+            else if (line.startsWith('rename from ')) {
+                current.oldPath = unquote(line.slice('rename from '.length));
+                current.status = 'moved';
+            }
+            else if (line.startsWith('rename to '))
+                current.path = unquote(line.slice('rename to '.length));
+            else if (line.startsWith('Binary files '))
+                current.binary = true;
+            else if (line.startsWith('@@')) {
+                hunk = { header: line, lines: [] };
+                current.hunks.push(hunk);
+            }
+            continue;
+        }
+        if (line.startsWith('@@')) {
+            hunk = { header: line, lines: [] };
+            current.hunks.push(hunk);
+        }
+        else if (line.startsWith('+'))
+            hunk.lines.push({ kind: 'add', text: line.slice(1) });
+        else if (line.startsWith('-'))
+            hunk.lines.push({ kind: 'del', text: line.slice(1) });
+        else if (line.startsWith(' '))
+            hunk.lines.push({ kind: 'ctx', text: line.slice(1) });
+        // "" and the trailing empty line carry nothing to show.
+    }
+    return files;
+}
+const MARK = { add: '+', del: '−', ctx: ' ' };
+const LABEL = { add: 'added', del: 'removed', ctx: 'unchanged' };
+/** Each file as a heading and a block of marked lines — readable with no script and no colour. */
+export function renderFileDiffs(files, labels) {
+    if (files.length === 0)
+        return `<p class="ctxr-empty">${escapeHtml(labels.noFiles)}</p>`;
+    return files
+        .map((file) => {
+        const title = file.oldPath === null ? file.path : `${file.oldPath} → ${file.path}`;
+        const body = file.binary
+            ? `<p class="ctxr-empty">${escapeHtml(labels.binary)}</p>`
+            : file.hunks
+                .map((h) => {
+                const rows = h.lines
+                    .map((l) => `<span class="ctxr-diff-${l.kind}" title="${LABEL[l.kind]}">${MARK[l.kind]} ${escapeHtml(l.text)}</span>`)
+                    .join('\n');
+                return `<pre class="ctxr-diff"><span class="ctxr-diff-hunk">${escapeHtml(h.header)}</span>\n${rows}</pre>`;
+            })
+                .join('\n');
+        return `<section class="ctxr-diff-file"><h3><code>${escapeHtml(title)}</code> <span class="ctxr-diff-status">${escapeHtml(file.status)}</span></h3>\n${body}</section>`;
+    })
+        .join('\n');
+}
+//# sourceMappingURL=file-diff.js.map

package/dist/core/approval/file-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-diff.js","sourceRoot":"","sources":["../../../src/core/approval/file-diff.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAuBjD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,SAAiB,EAAE,IAAY,EAAE,IAAY,EAAE,YAA+B;IAChI,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAC9B,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EACxG,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAW,CAAC;AAClJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAoB,IAAI,CAAC;IACpC,IAAI,IAAI,GAAqC,IAAI,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC7G,IAAI,GAAG,IAAI,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;iBAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;iBACrE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;YAC3B,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC7F,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;iBAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAClF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAChF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrF,mFAAmF;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAA+C,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1F,MAAM,KAAK,GAA+C,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAE7G,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,KAA0B,EAAE,MAA2C;IACrG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,yBAAyB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACzF,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;YACtB,CAAC,CAAC,yBAAyB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;YAC1D,CAAC,CAAC,IAAI,CAAC,KAAK;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK;qBACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;qBACrH,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,uDAAuD,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC;YAC7G,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,6CAA6C,UAAU,CAAC,KAAK,CAAC,0CAA0C,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,YAAY,CAAC;IAC1K,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/core/approval/identity.d.ts

@@ -0,0 +1,34 @@
+import type { ChangeApprovalConfig } from '../../config/schema.js';
+/**
+ * change-approval spec ("Every approval route requires a verified identity
+ * assertion", design.md D2): the signed token the access proxy in front of
+ * `ctxr serve` forwards on every request, verified here for every request —
+ * signature against the configured key set, then issuer, audience, expiry and
+ * an email claim. It fails closed: a missing header, an unknown key, a key set
+ * that cannot be fetched, or any claim out of line is a refusal, never a pass.
+ *
+ * Only RS256 and ES256, the algorithms access proxies sign with. `none` and
+ * every HMAC algorithm are refused outright, so a token cannot choose to be
+ * checked against a secret this server does not hold.
+ */
+export type IdentityResult = {
+    ok: true;
+    email: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface IdentityVerifier {
+    verify(headerValue: string | string[] | undefined): Promise<IdentityResult>;
+}
+type FetchLike = (url: string) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export declare function createIdentityVerifier(identity: ChangeApprovalConfig['identity'], opts?: {
+    fetch?: FetchLike;
+    now?: () => Date;
+}): IdentityVerifier;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/core/approval/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/core/approval/identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7E;AAED,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAgBrG,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,CAAC,EAC1C,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,GACjD,gBAAgB,CA+ElB"}