iit-mcp-autotask 0.10.0 → 0.11.0

package/README.md

@@ -8,10 +8,10 @@ context into one call, a generic read layer for the long tail, one result envelo
 packaged playbooks, strong security boundaries, and predictable per-tenant in-process state (pooled
 client + SDK-owned TTL caches).
 
-> **Package status (2026-10-21):** the runtime dependency `node-autotask` is published to public npm
-> at `0.21.0`; the committed `pnpm-lock.yaml` pins that
+> **Package status (2026-10-22):** the runtime dependency `node-autotask` is published to public npm
+> at `0.23.0`; the committed `pnpm-lock.yaml` pins that
 > release with its integrity hash, so installs resolve deterministically. The dependency is always npm
-> (node-autotask pinned exactly at `0.21.0`) — never a `file:`, `git:`, `link:` or workspace reference
+> (node-autotask pinned exactly at `0.23.0`) — never a `file:`, `git:`, `link:` or workspace reference
 > to a local checkout.
 
 > **0.6.0 is a breaking release** (unreleased): tool names, result shapes and configuration all
@@ -21,7 +21,7 @@ client + SDK-owned TTL caches).
 
 The **core** toolset (10 tools) is always served; `AUTOTASK_TOOLSETS` adds `service`, `records` and
 `finance` (or `all`, 18 tools); the operator profile adds two. The whole tool surface (20 tools) is
-listed below. Every other operation in the SDK's 1,213-operation registry stays
+listed below. Every other operation in the SDK's 1,216-operation registry stays
 reachable through the generic layer: `autotask_catalog` finds the key, `autotask_describe` serves
 its contract, `autotask_read` runs it.
 
@@ -35,13 +35,18 @@ its contract, `autotask_read` runs it.
 
 - `autotask_resolve` turns any identifier into a record: an id or name, `by: "ticket_number"`,
   `"serial"` or `"email"`, in one `resource` or swept across the five workflow resources;
-  `match: "contains"` for companies or a sweep. Every match carries `ref`, its human reference.
+  `match: "contains"` for companies or a sweep. Every match carries `ref`, its human reference. A sweep returns compact matches (`resource`, `ref`, `id`, the human fields) unless `expand: true` (the full record under `record`); `limit` caps the TOTAL matches across resources (resource order, then the SDK's order) and a contains sweep reports `truncated` and per-resource `counts {returned, found}`.
 - `autotask_query` is the bounded filtered list over `resource`: `tickets`, `time_entries`,
   `service_calls`, `contracts`, `time_off_requests` (limit default 50, max 2500).
 - `autotask_read` runs any read by exact key, or up to 10 at once (`items`). Unbilled work
   (`companies.unbilledWork`), contract profitability (`contracts.profitability`), aggregates
   (`operations.aggregate`) and SLA health (`tickets.slaHealthCheck`) run here; `autotask_guide`
-  holds their recipes.
+  holds their recipes. `autotask_read` and `autotask_fetch_many` answer ONE envelope (the next minor,
+  breaking): `data = { results: Slot[], ok, failed, budget?, budgetWarning? }`, an array in input
+  order even for a single read (`data.results[0].result`). A slot is `{ ok: true, operation, result,
+  windowNote? }` or `{ ok: false, operation, error }`; fetch_many slots also echo `resource` and `id`
+  (`operation` is `<resource>.get`; a miss is `ok: false` with `NOT_FOUND`). A single read that fails
+  still answers the whole-call error envelope.
 - `autotask_guide` serves the packaged playbooks — the server's skill layer (below).
 
 ### `autotask_guide`: the packaged playbooks (the server's skill layer)
@@ -65,7 +70,7 @@ The playbooks are discoverable in both directions:
   `autotask_describe` for an operation answers with the `playbooks[]` that use it, so a model
   that lands on an operation is pointed at the recipe.
 
-Composites bound **each part independently** (every part reads its own declared limit argument); a
+Composites bound **each part independently** (every part reads its own declared limit argument; `autotask_company_full_profile` defaults its contact, note, open-ticket and project parts to 10 rows each, `capped: true` says more exist; `fields` projects columns per part); a
 part miss never fails the call (typed `absent`); only a missing root record fails the composite.
 
 **Every result is one envelope** (`structuredContent`, mirrored as JSON in the first text block):
@@ -141,11 +146,46 @@ What the policy can and cannot do:
   `forbidRemovals`, `requireReason`, UTC `windows`, `duplicateCheck` (required for creates) and
   `allowUnattended`. Globally: `write.scope.companyIds`, `createdHereWithinDays`, and
   `limits.writesPerHour`/`writesPerDay`.
+- Moving a time entry or ticket charge to another ticket (#107): list `time_entries.moveToTicket` or
+  `ticket_charges.moveToTicket` with an `owner` block, e.g. `{"approval": "none", "allowUnattended": true,
+  "owner": {"mode": "createdHere", "days": 7}}` (`createdHere`: this server created the source for this
+  principal within 1-14 days; or `{"mode": "resourceIDs", "ids": [..]}` for time entries, whose `resourceID`
+  must be listed; a charge has no owning resource). Preview `autotask_write {operation, args: [sourceId,
+  toTicketId]}`, then apply. The server creates the copy on the target ticket, verifies it and deletes the
+  original (the vendor ignores an update of `ticketID`): the new record gets a new id, create date and
+  creator, and notifications may fire. A move into another company or contract always needs a signed
+  approval grant; an unfinished earlier move of the same source blocks another until its ledger entry ages
+  out (14 days). Billed, attached, approved, closed-target and older-than-14-days sources are refused.
 - Hard rules no policy overrides: `authenticate.*` is never served; operations the SDK flags
   `requiresApproval`, and non-read sensitive ones (webhooks, `resources.transferOwnership`), always
-  need approval; destructive and account-wide operations need it unless `allowUnattended`. In 0.6.0
-  the approval mode is `policy` only, so an approval-required write answers `needs_approval` and is
-  never executed. There is no `autotask_delete` (D-12): deletes preview through `autotask_write`.
+  need approval; destructive and account-wide operations need it, and `allowUnattended` cannot waive
+  that for an operation the hard rules cover. In approval mode `policy` no approver
+  exists: an approval-required write answers `needs_approval` with `next: manual_action` (no plan
+  handle) and is never executed. Approval mode `external` (`approvalMode: "external"` plus an `approvals`
+  block listing ed25519 approver keys, each scoped to operations) is being added in stages (#106): a gated
+  preview stores a pending plan (`next: await_approval`, handle, hash, expiry of grant window + 5 minutes) that
+  executes only with a valid ed25519 grant file `approvals/grants/<handle>.json` signed by a listed approver
+  (apply verifies it; deny rules still win; one use per plan). A human decides with the CLI, run in their own
+  terminal as the server's OS user with `AUTOTASK_STATE_DIR` and `AUTOTASK_POLICY_FILE` set as the server has them:
+  `autotask-mcp keygen <approver-id> --ops <op,op|*>` (creates a passphrase-sealed ed25519 key, mode 0600, default
+  `~/.config/iit-mcp-autotask/approver.key` or `$AUTOTASK_APPROVER_KEY_FILE`, and prints the entry for
+  `approvals.approvers`), then `autotask-mcp approvals list|show|approve|reject <handle>`. `show` and `approve`
+  recompute the plan hash and snapshot hash from the stored plan and refuse on a mismatch or a changed policy; they
+  print only verified fields, and every agent-supplied string (arguments, the agent's reason) is JSON-encoded behind
+  `| ` inside a labelled untrusted block with control and bidi characters stripped. `approve` and `reject` need you to
+  type the first 8 characters of the plan hash and the key passphrase; the passphrase is read from `/dev/tty` only
+  (never the environment, arguments, a pipe or a file; there is no `--yes`), so the command refuses without a
+  terminal and on Windows. `approve` and `reject` refuse while any shown value was cut for display (it would be signed in full): review with `show <handle> --full`, then pass `--full`. The first decision per plan is final. This stops accidents, not an agent that can drive a
+  pty, and on stdio the sealed key file can be attacked offline by anything running as the same user. On HTTP run it
+  where the state dir lives (for example `docker exec -it` as the server's user). On stdio this is a
+  guardrail against a mistaken agent, not a boundary against an adversarial agent running as the same OS
+  user; it is a real boundary only on HTTP with the server, its key material and the policy file isolated
+  from the agent. Any edit to the policy file (including `approvals`) changes the policy hash and voids
+  every outstanding plan. `data.manual` carries a fingerprint of the record (ids, ticket,
+  start time, hours, resource — numbers and instants only, never vendor text) and, when the pinned
+  SDK provides `operations.uiLink`, a clickable Autotask deep link; a person finishes the job in
+  Autotask. A policy that sets `approval: "none"` on such an operation changes nothing: boot logs a
+  warning and `doctor` prints it. There is no `autotask_delete` (D-12): deletes preview through `autotask_write`.
 - The company scope is read from the live records the write touches (the target, its parent, the
   ticket, project, task or contract it references, and any `companyID` it sets), never from names
   or titles. A reference that cannot be read is refused.
@@ -162,7 +202,7 @@ Outcomes the caller acts on: `ok`/`proceed`; `needs_input`/`supply_input` (`miss
 field); `needs_approval`/`await_approval`; `denied`/`stop`; `STATE_DRIFT` or `PLAN_EXPIRED` →
 `repreview`; a failed write: `WRITE_FAILED` with `stop` (a deterministic rejection; it replays,
 fix the input and use a new key) or `RATE_LIMITED` with `retry` (nothing was written: apply the
-same plan again after the wait); an unknown outcome (`WRITE_OUTCOME_UNKNOWN`,
+same plan again after the wait); a vendor that accepted an update but kept the old value (`FIELD_NOT_PERSISTED` with `stop`: the apply reads the stored record back and compares every field you sent; the write itself is `succeeded`, `data.record` shows what is stored and `data.notPersisted` names the fields — do not repeat the update, the vendor does not support changing them; a replay answers the same); an unknown outcome (`WRITE_OUTCOME_UNKNOWN`,
 `verify_then_repreview`): that plan is never sent again, and re-applying it or re-previewing under
 the same key only replays `unknown`. Re-read the target; if the write is absent, preview again under
 a new `idempotency_key` (a new attempt) after the 10-minute cooldown; its duplicate query refuses
@@ -262,9 +302,13 @@ Three per-call options change the result form:
 | `untrusted_wrapper: false` | skips the `<untrusted_content>` wrapping for that call only; the result then carries `untrustedWrapper: 'disabled'` and the human text says so. Absent (the default) wraps exactly as before. |
 | `output_path: '<relative path>'` | **stdio transport only**: walks the FULL match set with the resource's own query iterator, writes the envelope JSON to a file under `AUTOTASK_OUTPUT_DIR`, and returns a summary (`outputPath`, `columns`, `rowCount`, the first rows, `bytes`) instead of the table. |
 
-`output_path` is deliberately strict: the deployment must set an **absolute** `AUTOTASK_OUTPUT_DIR`
-that already exists and is not the filesystem root (the feature refuses when it is unset or missing —
-the server never creates the root), and the value must be a path **relative** to that root that names
+`output_path` is deliberately strict: the deployment sets an **absolute** `AUTOTASK_OUTPUT_DIR`
+that already exists and is not the filesystem root (a configured root that is missing is refused —
+the server never creates it). When it is unset the root defaults to `output/` under `AUTOTASK_STATE_DIR`
+(the existing, operator-configured state dir; the server creates that one subdirectory and nothing
+above it; with neither variable set the feature refuses). `format: 'tsv'` with `output_path` writes the
+TSV table to the file (the result carries the path, never the table); `latest` and `note_chars` still
+cannot combine with it. And the value must be a path **relative** to that root that names
 a file (a trailing separator, an absolute path, a NUL byte, and a target that is an existing
 directory are all refused). **Nothing outside the root is ever created,
 file or directory**: the deepest existing ancestor of the target is canonicalised (`realpath`) and
@@ -480,7 +524,7 @@ non-zero on an invalid config (fail-fast) instead of failing at the first tool c
 | `AUTOTASK_CACHE_PRESET` | no | `on` | per-tenant in-process caches (see [Per-tenant pool & cache](#per-tenant-pool--cache)): `on` (default) sends no cache blocks — the SDK's default-on caches apply to each pooled tenant client (read ~5 min + the plan-derived reference table, field ~5 min, resource-name ~1 h); `off` opts every SDK cache channel out explicitly (every read re-dials the vendor) |
 | `AUTOTASK_COMPOSITE_NAMES` | no | `off` | opt-in name/label siblings on the four SDK-backed composites (`tickets.fullContext`, `companies.fullProfile`, `configuration_items.profile`, `projects.getContext`) — reuses the SDK's existing caches (no new cache); `off` = byte-identical output to today; `on` adds the name siblings + the top-level `names` section, bounded by the SDK name-read budget (default 20 cold wire reads, lowerable only) |
 | `AUTOTASK_FIELD_CACHE_TTL_MS` | no | unset (SDK 5 min) | pass-through to the SDK's field-metadata cache TTL (positive integer ms), sent as the scalar `fieldCache` block on the `on` preset path only — the server holds no TTL value of its own: unset or invalid (non-integer, <= 0) sends no `fieldCache` block and the SDK default (5 min) applies; `off` keeps its explicit opt-out; `fieldCatalog` `fresh: true` still bypasses the cache |
-| `AUTOTASK_OUTPUT_DIR` | no | unset | the ONE directory the `output_path` option may write into (the bounded query tools and the invoice export; stdio transport only). Unset = the feature refuses; must be absolute, must already EXIST (the server never creates the root) and must not be the filesystem root. A caller path is relative to this root, and the root and target are canonically resolved (`realpath`) so a traversal or symlink escape is refused — with nothing created outside the root. See [Query results](#query-results-tsv-output_path-and-the-saved-file-shape) |
+| `AUTOTASK_OUTPUT_DIR` | no | unset | the ONE directory the `output_path` option may write into (the bounded query tools and the invoice export; stdio transport only). Unset = defaults to `output/` under `AUTOTASK_STATE_DIR` (the feature refuses when neither is set); must be absolute, must already EXIST (the server never creates the root) and must not be the filesystem root. A caller path is relative to this root, and the root and target are canonically resolved (`realpath`) so a traversal or symlink escape is refused — with nothing created outside the root. See [Query results](#query-results-tsv-output_path-and-the-saved-file-shape) |
 | `AUTOTASK_RATE_LIMIT_PER_HOUR` | no | 8000 (agent profile) | override the SDK's local hourly budget (never above the vendor cap; `null`/off is rejected at boot — it would void the budget guard) |
 | `AUTOTASK_MAX_CONCURRENT` | no | 3 (agent profile) | override the SDK's local concurrency bound |
 | `AUTOTASK_TIMEOUT_MS` | no | 20000 (agent profile) | whole-call budget |
@@ -719,7 +763,7 @@ independent review with its resolutions, [`docs/reviews/0.6.0.md`](docs/reviews/
 
 ## SDK dependency
 
-`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.21.0`** (an exact pin —
+`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.23.0`** (an exact pin —
 no range operator; subpaths `.` / `/capabilities` / `/operations` / `/resources` / `/types` /
 `/pool`) — the only **vendor** dependency; the other two runtime dependencies are
 `@modelcontextprotocol/server` (the MCP framework) and `zod` (schema validation). It never
@@ -729,7 +773,7 @@ user — the published tarball ships no lockfile) must resolve to the release th
 reviewed against, or the plan-hash boot check refuses to start.
 
 **Publishing `node-autotask` is the maintainer's action, done manually.** It is published on the
-public registry at `0.21.0` (published 2026-10-20); the
+public registry at `0.23.0` (published 2026-10-21); the
 exact pin and the committed `pnpm-lock.yaml` (with `pnpm-workspace.yaml`) pin the real published
 tarball with its integrity hash, so installs resolve to exactly that release — the lockfile
 freezes the pnpm/git/Docker paths, the pin freezes the npm/npx paths. The docs are written against this
@@ -823,7 +867,7 @@ physical assets (Autotask models them as Configuration Items — covered).
 
 | # | Item | Status |
 |---|------|--------|
-| B1 | **Project phase & task lists** (W7 sub-capability): no `project_tasks`/`project_phases` operations in the SDK's 1,213-op registry. W7 ships with project status + context; phase/task lists excluded and documented. Classification (SDK gap vs vendor API-version limit) is decided by recon's spec-side check (A2). | blocked — documented |
+| B1 | **Project phase & task lists** (W7 sub-capability): no `project_tasks`/`project_phases` operations in the SDK's 1,216-op registry. W7 ships with project status + context; phase/task lists excluded and documented. Classification (SDK gap vs vendor API-version limit) is decided by recon's spec-side check (A2). | blocked — documented |
 | B2 | **Time-entry writes on ww29/australia-nz for API-only users**: vendor 500 (live-verified). Time-entry creation works where the API user is a real resource, through the operator profile (`log-time-entry`); on ww29 the write is classified `failed` (a 500 with a vendor `errors[]` body), never `unknown`. | zone limitation |
 | B3 | **`time_entries.getPosted`/`getUnposted` 500 on ww29** (no posted-state filter on the zone's entity). Reachable via the generic layer; `postedWithin` is the zone-robust alternative. | zone limitation |
 | B4 | **CI create on tenants without products** (ww29 product wall: `products.count = 0`): `configuration_items.create` requires an existing `productID`. No dedicated CI-create in v1; the wall is documented on the generic side. | zone limitation |

package/capabilities.json

@@ -70,7 +70,7 @@
     },
     {
       "id": "autotask.platform.catalog",
-      "description": "Find the exact operation key for anything without a dedicated tool: ranked search (q) over the 1,213 registry operations, with effect and whether this deployment serves it. No vendor call.",
+      "description": "Find the exact operation key for anything without a dedicated tool: ranked search (q) over the 1,216 registry operations, with effect and whether this deployment serves it. No vendor call.",
       "mcpPrimitive": "tool",
       "toolName": "autotask_catalog",
       "type": "read",
@@ -118,7 +118,7 @@
     },
     {
       "id": "autotask.discovery.resolve",
-      "description": "Find the record behind an identifier: id or name, ticket number, configuration item serial number, contact email (by), in one resource or swept across several. Exact by default; contains for companies or a sweep. Matches carry ref.",
+      "description": "Find the record behind an identifier: id or name, ticket number, configuration item serial number, contact email (by), in one resource or swept across several. Exact by default; contains for companies or a sweep (compact; limit = total).",
       "mcpPrimitive": "tool",
       "toolName": "autotask_resolve",
       "type": "read",
@@ -150,7 +150,7 @@
     },
     {
       "id": "autotask.discovery.fetch_many",
-      "description": "Fetch up to 500 records by numeric id across mixed resources in one call: items: [{resource, id, fields?}]. A miss is a typed error in its slot; records carry their human reference.",
+      "description": "Fetch up to 500 records by numeric id across mixed resources in one call: items: [{resource, id, fields?}]. Answers data.results[{ok, operation, result|error}], ok, failed (same as autotask_read); a miss is a typed NOT_FOUND slot.",
       "mcpPrimitive": "tool",
       "toolName": "autotask_fetch_many",
       "type": "read",
@@ -198,7 +198,7 @@
     },
     {
       "id": "autotask.company.full_profile",
-      "description": "One company with locations, contacts, notes, open tickets and projects. Open = status not 5 (always filtered, so empty is a true zero). Missing parts degrade to typed absent.",
+      "description": "One company with locations, contacts, notes, open tickets and projects, 10 rows per part (capped: true = more exist; raise the limit). fields {part:[names]} trims columns. Open = status not 5. Missing parts degrade to typed absent.",
       "mcpPrimitive": "tool",
       "toolName": "autotask_company_full_profile",
       "type": "read",
@@ -380,7 +380,7 @@
       "autotask_describe",
       "autotask_read"
     ],
-    "backingRegistryOperations": 1213,
+    "backingRegistryOperations": 1216,
     "note": "autotask_catalog finds the exact operation key (ranked search), autotask_describe serves its contract, autotask_read runs any effect=read key. Writes go through the operator profile (autotask_write then autotask_apply); authenticate.* is never served."
   },
   "schemas": {}

package/dist/approvals.d.ts

@@ -0,0 +1,112 @@
+/**
+ * approvals.ts — the `autotask-mcp approvals` and `keygen` subcommands (issue #106, approvalMode external).
+ *
+ * A human runs these in their own terminal as the server's OS user. They never start a server and never
+ * call `openStateStore` (it registers a holder, takes locks, rewrites the ledger and prunes plans): they
+ * read `state.key`, decrypt the pending plan, and write ONE file, `approvals/grants/<handle>.json`, with
+ * exclusive create so the first decision is final. The server audits the grant when it consumes it.
+ *
+ * What is shown is re-derived, never stored text: the plan hash and snapshot hash are recomputed from the
+ * stored fields and the command refuses on a mismatch or when the policy changed. Every agent- or
+ * vendor-sourced string is stripped of control/bidi characters, JSON-encoded, stripped of control/bidi characters, capped, and printed behind a
+ * `|` prefix inside a block labelled untrusted, so it cannot pose as a verified line.
+ *
+ * Guardrails, not a boundary: the passphrase is read from /dev/tty only (no env, argv, stdin, flag or file),
+ * which stops accidents, not an agent that drives a pty. On stdio the encrypted key file can be brute-forced
+ * offline by anything running as the same user.
+ */
+import { type KeyObject } from 'node:crypto';
+import { type LoadedPolicy } from './write/policy-file.js';
+import { type PlanRecord } from './write/store.js';
+/** scrypt cost floor for the approver key file: N = 2^17, r = 8 (Node's default maxmem refuses this, so it is set). */
+export declare const SCRYPT_N: number;
+export declare const SCRYPT_R = 8;
+/** How the commands talk to the human: only the real implementation touches /dev/tty. */
+export interface Prompter {
+    /** Show text to the human. */
+    say(text: string): void;
+    /** Read one line with echo. */
+    ask(question: string): string;
+    /** Read one line without echo (a passphrase). */
+    secret(question: string): string;
+}
+export declare class ApprovalsError extends Error {
+}
+/** The controlling terminal, or an error: no tty means no prompt, and the command exits non-zero. */
+export declare function ttyPrompter(): Prompter & {
+    close(): void;
+};
+interface KeyFile {
+    v: 1;
+    /** `ed25519:` + base64url of the raw public key (what goes in the policy file). */
+    publicKey: string;
+    kdf: {
+        N: number;
+        r: number;
+        p: 1;
+        salt: string;
+    };
+    iv: string;
+    tag: string;
+    ct: string;
+}
+/** The key file's default path: `AUTOTASK_APPROVER_KEY_FILE`, else `~/.config/iit-mcp-autotask/approver.key`. */
+export declare const keyFilePath: (env: Record<string, string | undefined>) => string;
+export declare function sealKey(privateKey: KeyObject, publicKey: string, passphrase: string): KeyFile;
+/** Decrypt a key file; refuses weak kdf parameters (the file is attacker-writable on stdio) and a wrong passphrase. */
+export declare function openKey(file: KeyFile, passphrase: string): KeyObject;
+/**
+ * An untrusted value for display: every string (and key) stripped of control/bidi characters, then the value JSON-encoded
+ * ONCE, so a string stays quoted while null, numbers, booleans, arrays and objects print as themselves (`null` and
+ * `"null"` are different writes and must look different). Capped; a cut value is counted in `cut`.
+ */
+export declare const untrusted: (value: unknown, cap?: number, cut?: {
+    n: number;
+}) => string;
+/** The plan's state dir files, and a pending plan checked against every hash that can be recomputed. */
+export interface Verified {
+    plan: PlanRecord;
+    loaded: LoadedPolicy;
+}
+export interface Env {
+    stateDir: string;
+    policyFile: string;
+}
+export declare function envFrom(env: Record<string, string | undefined>): Env;
+/** Load the plan and refuse unless every recomputable hash matches and the policy is the one it was previewed under. */
+export declare function verifyPlan(env: Env, handle: string, now: number): Verified;
+/** One line saying what is being decided: repeated at the confirmation prompt so it is the last thing read. */
+export declare const summaryLine: (plan: PlanRecord) => string;
+/**
+ * The hash-verified description of a plan. Order: verified header, the agent's reason, the arguments (signed content:
+ * a value cut for display counts in `truncated` and blocks signing), then the records as they stand (context).
+ * Untrusted strings are stripped, JSON-encoded and printed behind `| `.
+ */
+export declare function describePlan(v: Verified, full?: boolean): {
+    lines: string[];
+    truncated: number;
+};
+export declare function listPending(env: Env, now: number): string[];
+/** Sign and write a decision. Exclusive create: the first decision for a handle is final. */
+export declare function decide(opts: {
+    env: Env;
+    handle: string;
+    decision: 'approve' | 'reject';
+    prompt: Prompter;
+    keyFile: string;
+    now: () => number;
+    full?: boolean;
+}): string;
+/** Generate an approver key, seal it under a passphrase, and return the policy entry to paste into `approvals.approvers`. */
+export declare function keygen(opts: {
+    id: string;
+    ops: string[];
+    prompt: Prompter;
+    keyFile: string;
+}): string;
+export declare const APPROVALS_USAGE = "autotask-mcp approvals list\nautotask-mcp approvals show <handle> [--full]\nautotask-mcp approvals approve <handle> [--full]\nautotask-mcp approvals reject <handle> [--full]\nautotask-mcp keygen <approver-id> --ops <op,op|*>\n\nRun these yourself, in a terminal, as the server's OS user, with AUTOTASK_STATE_DIR and AUTOTASK_POLICY_FILE\nset as the server has them. The passphrase is read from /dev/tty only. Key file: $AUTOTASK_APPROVER_KEY_FILE,\nelse ~/.config/iit-mcp-autotask/approver.key.";
+/** Run a subcommand; returns the process exit code. `argv` is everything after `autotask-mcp`. */
+export declare function runApprovals(argv: string[], env: Record<string, string | undefined>, out: (t: string) => void, prompter?: () => Prompter & {
+    close(): void;
+}, now?: () => number): number;
+export {};