opensquid 0.5.395

package/dist/setup/cli/memory.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `opensquid memory` CLI verb group (G.6 + G.7).
+ *
+ * Verbs:
+ *
+ *   import-auto    — bulk-imports Claude Code auto-memory files from
+ *                    `~/.claude/projects/<encoded-path>/memory/` into the
+ *                    libSQL memory store via the MemoryStore handle (RES-5b, engine-free).
+ *                    Dedupe by frontmatter `name` (round-tripped through the
+ *                    `origin:import:` marker tag).
+ *                    Flags:
+ *                      --dry-run                preview without writing
+ *                      --project <path>         override auto-memory project
+ *                                               (default: cwd); slash → dash
+ *                                               encoded per Claude Code
+ *                      --auto-memory-root <p>   override `~/.claude/projects/`
+ *
+ *   snapshot-auto  — incremental catch-up over import-auto. Re-imports any
+ *                    auto-memory file modified since the timestamp stored at
+ *                    `<OPENSQUID_HOME>/.last-auto-memory-snapshot`. First run
+ *                    (file absent) → imports ALL files. Reuses G.6 dedup.
+ *                    Same flags as import-auto except --dry-run is omitted
+ *                    (snapshot is a side-effecting maintenance verb).
+ *
+ * Stays harness-agnostic: the importer/snapshot module know nothing about
+ * commander or the CLI surface. This file owns argument parsing + summary
+ * formatting + the MemoryStore handle lifecycle (built + closed per verb).
+ *
+ * Imports from: commander, node:os, node:path, ../../runtime/paths.js,
+ *   ../migrate/memory_store_handle.js, ../migrate/auto_memory_importer.js,
+ *   ../migrate/auto_memory_snapshot.js.
+ * Imported by: src/cli.ts, src/setup/cli/memory.test.ts.
+ */
+import { type MemoryStore } from '../migrate/memory_store_handle.js';
+import type { Command } from 'commander';
+export interface MemoryCliDeps {
+    /** Override the memory store (tests inject a stub/tmp store). */
+    storeFactory?: () => Promise<MemoryStore>;
+    /** Override resolver for the auto-memory directory; tests use a tmp dir. */
+    resolveAutoMemoryDir?: (root: string, projectPath: string) => string;
+    /** Override opensquid-home directory (snapshot-auto target); tests use a tmp dir. */
+    opensquidHome?: () => string;
+    stdout?: (s: string) => void;
+    stderr?: (s: string) => void;
+    cwd?: () => string;
+}
+/**
+ * Encode a project path the way Claude Code does for the auto-memory
+ * directory: every `/` becomes `-` (including the leading slash, so
+ * `/Users/alice/x` → `-Users-alice-x`). Non-path inputs are passed verbatim.
+ */
+export declare function encodeProjectPath(projectPath: string): string;
+/** Register `opensquid memory` on the parent program. */
+export declare function registerMemory(parent: Command, deps?: MemoryCliDeps): Command;
+//# sourceMappingURL=memory.d.ts.map

package/dist/setup/cli/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/setup/cli/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAQtF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IACrE,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAaD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAyFD,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAkBjF"}

package/dist/setup/cli/memory.js

@@ -0,0 +1,139 @@
+/**
+ * `opensquid memory` CLI verb group (G.6 + G.7).
+ *
+ * Verbs:
+ *
+ *   import-auto    — bulk-imports Claude Code auto-memory files from
+ *                    `~/.claude/projects/<encoded-path>/memory/` into the
+ *                    libSQL memory store via the MemoryStore handle (RES-5b, engine-free).
+ *                    Dedupe by frontmatter `name` (round-tripped through the
+ *                    `origin:import:` marker tag).
+ *                    Flags:
+ *                      --dry-run                preview without writing
+ *                      --project <path>         override auto-memory project
+ *                                               (default: cwd); slash → dash
+ *                                               encoded per Claude Code
+ *                      --auto-memory-root <p>   override `~/.claude/projects/`
+ *
+ *   snapshot-auto  — incremental catch-up over import-auto. Re-imports any
+ *                    auto-memory file modified since the timestamp stored at
+ *                    `<OPENSQUID_HOME>/.last-auto-memory-snapshot`. First run
+ *                    (file absent) → imports ALL files. Reuses G.6 dedup.
+ *                    Same flags as import-auto except --dry-run is omitted
+ *                    (snapshot is a side-effecting maintenance verb).
+ *
+ * Stays harness-agnostic: the importer/snapshot module know nothing about
+ * commander or the CLI surface. This file owns argument parsing + summary
+ * formatting + the MemoryStore handle lifecycle (built + closed per verb).
+ *
+ * Imports from: commander, node:os, node:path, ../../runtime/paths.js,
+ *   ../migrate/memory_store_handle.js, ../migrate/auto_memory_importer.js,
+ *   ../migrate/auto_memory_snapshot.js.
+ * Imported by: src/cli.ts, src/setup/cli/memory.test.ts.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { OPENSQUID_HOME } from '../../runtime/paths.js';
+import { resolveRecallScope } from '../../rag/scope.js';
+import { makeMemoryStore } from '../migrate/memory_store_handle.js';
+import { fetchExistingImportIndex, importAutoMemoryDir, } from '../migrate/auto_memory_importer.js';
+import { snapshotAuto } from '../migrate/auto_memory_snapshot.js';
+/**
+ * Encode a project path the way Claude Code does for the auto-memory
+ * directory: every `/` becomes `-` (including the leading slash, so
+ * `/Users/alice/x` → `-Users-alice-x`). Non-path inputs are passed verbatim.
+ */
+export function encodeProjectPath(projectPath) {
+    return projectPath.replace(/\//g, '-');
+}
+function defaultResolve(root, projectPath) {
+    return join(root, encodeProjectPath(projectPath), 'memory');
+}
+/** Resolve + probe the auto-memory directory; return null on miss (caller exits). */
+async function resolveDir(deps, opts, verb) {
+    const root = opts.autoMemoryRoot ?? join(homedir(), '.claude', 'projects');
+    const dir = deps.resolveAutoMemoryDir(root, opts.project ?? deps.cwd());
+    const { promises: fs } = await import('node:fs');
+    try {
+        const stat = await fs.stat(dir);
+        if (!stat.isDirectory()) {
+            deps.stderr(`opensquid memory ${verb}: ${dir} is not a directory\n`);
+            process.exitCode = 1;
+            return null;
+        }
+    }
+    catch {
+        deps.stderr(`opensquid memory ${verb}: ${dir} does not exist\n`);
+        process.exitCode = 1;
+        return null;
+    }
+    return dir;
+}
+function reportResult(deps, result, prefix, dir) {
+    deps.stdout(`${prefix}Imported ${String(result.imported)}, refreshed ${String(result.refreshed)}, skipped ${String(result.skipped)}, errors ${String(result.errors.length)} (from ${dir})\n`);
+    for (const err of result.errors) {
+        deps.stderr(`  error: ${err.path}: ${err.reason}\n`);
+    }
+    if (result.errors.length > 0)
+        process.exitCode = 1;
+}
+async function actImportAuto(deps, opts) {
+    const dir = await resolveDir(deps, opts, 'import-auto');
+    if (dir === null)
+        return;
+    const store = await deps.storeFactory();
+    try {
+        const existingIndex = await fetchExistingImportIndex(store);
+        const result = await importAutoMemoryDir(dir, store, {
+            dryRun: opts.dryRun,
+            existingIndex,
+            // T-memory-scope-isolation: tag `project`-scoped imports with the current project's umbrella.
+            namespace: (await resolveRecallScope()).namespace,
+        });
+        reportResult(deps, result, opts.dryRun ? '[dry-run] ' : '', dir);
+    }
+    finally {
+        await store.close();
+    }
+}
+async function actSnapshotAuto(deps, opts) {
+    const dir = await resolveDir(deps, opts, 'snapshot-auto');
+    if (dir === null)
+        return;
+    const store = await deps.storeFactory();
+    try {
+        const result = await snapshotAuto(dir, deps.opensquidHome(), store);
+        reportResult(deps, result, 'Snapshot: ', dir);
+    }
+    finally {
+        await store.close();
+    }
+}
+function buildDeps(d) {
+    return {
+        storeFactory: d.storeFactory ?? makeMemoryStore,
+        resolveAutoMemoryDir: d.resolveAutoMemoryDir ?? defaultResolve,
+        opensquidHome: d.opensquidHome ?? OPENSQUID_HOME,
+        stdout: d.stdout ?? ((s) => void process.stdout.write(s)),
+        stderr: d.stderr ?? ((s) => void process.stderr.write(s)),
+        cwd: d.cwd ?? (() => process.cwd()),
+    };
+}
+/** Register `opensquid memory` on the parent program. */
+export function registerMemory(parent, deps = {}) {
+    const r = buildDeps(deps);
+    const m = parent.command('memory').description('Memory migration + maintenance (G.6 + G.7)');
+    m.command('import-auto')
+        .description('Bulk-import Claude Code auto-memory files into loop-engine')
+        .option('--dry-run', 'preview without writing', false)
+        .option('--project <path>', 'override which project dir to read (default: cwd)')
+        .option('--auto-memory-root <path>', 'override ~/.claude/projects/ root')
+        .action((opts) => actImportAuto(r, opts));
+    m.command('snapshot-auto')
+        .description('Incremental catch-up: re-import auto-memory files modified since last snapshot')
+        .option('--project <path>', 'override which project dir to read (default: cwd)')
+        .option('--auto-memory-root <path>', 'override ~/.claude/projects/ root')
+        .action((opts) => actSnapshotAuto(r, opts));
+    return m;
+}
+//# sourceMappingURL=memory.js.map

package/dist/setup/cli/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/setup/cli/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAoB,MAAM,mCAAmC,CAAC;AACtF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GAEpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AA2BlE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,WAAmB;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,UAAU,CACvB,IAA6B,EAC7B,IAAmD,EACnD,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,KAAK,GAAG,uBAAuB,CAAC,CAAC;YACrE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,KAAK,GAAG,mBAAmB,CAAC,CAAC;QACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CACnB,IAA6B,EAC7B,MAAoB,EACpB,MAAc,EACd,GAAW;IAEX,IAAI,CAAC,MAAM,CACT,GAAG,MAAM,YAAY,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CACjL,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAA6B,EAAE,IAAoB;IAC9E,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa;YACb,8FAA8F;YAC9F,SAAS,EAAE,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAA6B,EAC7B,IAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;QACpE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,eAAe;QAC/C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,cAAc;QAC9D,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,cAAc;QAChD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,OAAsB,EAAE;IACtE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7F,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;SACrB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,WAAW,EAAE,yBAAyB,EAAE,KAAK,CAAC;SACrD,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;SAC/E,MAAM,CAAC,2BAA2B,EAAE,mCAAmC,CAAC;SACxE,MAAM,CAAC,CAAC,IAAoB,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAE5D,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;SACvB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;SAC/E,MAAM,CAAC,2BAA2B,EAAE,mCAAmC,CAAC;SACxE,MAAM,CAAC,CAAC,IAAsB,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/setup/cli/permissions.d.ts

@@ -0,0 +1,49 @@
+/**
+ * CLI.4 — `opensquid permissions list|audit|grant|revoke`.
+ *
+ * Thin commander wiring. Verb bodies live in `./permissions_actions.ts`;
+ * persistence + denylist guard helpers in `./permissions_state.ts`. This
+ * file ONLY routes commander options/args into the action functions and
+ * resolves default paths from `OPENSQUID_HOME()`.
+ *
+ * Verb semantics (locked):
+ *
+ *   list    — show every installed pack's `manifest.permissions:` block
+ *             alongside any user overrides for that pack. JSON-on-stdout
+ *             so callers can `jq` it. `--pack <id>` scopes to one pack.
+ *
+ *   audit   — query `~/.opensquid/permission_audit.jsonl` with optional
+ *             `--since <duration>` (24h, 7d, 30m, 60s) +
+ *             `--decision <allowed|denied|prompted>` filters. Newest-
+ *             first. CLI.5 swaps this file-based sink for the libsql
+ *             `audit_log` table; the wire shape is a deliberate subset
+ *             of the CLI.5 columns so migration is `INSERT INTO ...
+ *             SELECT ...`.
+ *
+ *   grant   — append a user-side override to
+ *             `~/.opensquid/permission_overrides.yaml` (atomic write).
+ *             Built-in denylist patterns are REJECTED at the CLI layer
+ *             with an explicit error message — even if a user edits
+ *             the file directly, the gate still applies the sealed
+ *             denylist first (defense in depth). Escape hatch:
+ *             `OPENSQUID_TRUST_BUILTIN_DENY=0` disables BOTH layers
+ *             (matching the gate's env snapshot semantics).
+ *
+ *   revoke  — remove matching overrides. Without `--target`, removes
+ *             every override for `(pack, capability)`. With `--target`,
+ *             removes only the exact `(pack, capability, target)` row.
+ *
+ * Imports from: commander, ./permissions_actions, ./permissions_state.
+ * Imported by: src/cli.ts.
+ */
+import type { Command } from 'commander';
+export interface PermissionsCliDeps {
+    overridesPath?: string;
+    auditPath?: string;
+    packsDir?: string;
+    stdout?: (s: string) => void;
+    stderr?: (s: string) => void;
+    now?: () => Date;
+}
+export declare function registerPermissions(parent: Command, deps?: PermissionsCliDeps): Command;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/setup/cli/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/setup/cli/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAgBH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAiBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAmC3F"}

package/dist/setup/cli/permissions.js

@@ -0,0 +1,77 @@
+/**
+ * CLI.4 — `opensquid permissions list|audit|grant|revoke`.
+ *
+ * Thin commander wiring. Verb bodies live in `./permissions_actions.ts`;
+ * persistence + denylist guard helpers in `./permissions_state.ts`. This
+ * file ONLY routes commander options/args into the action functions and
+ * resolves default paths from `OPENSQUID_HOME()`.
+ *
+ * Verb semantics (locked):
+ *
+ *   list    — show every installed pack's `manifest.permissions:` block
+ *             alongside any user overrides for that pack. JSON-on-stdout
+ *             so callers can `jq` it. `--pack <id>` scopes to one pack.
+ *
+ *   audit   — query `~/.opensquid/permission_audit.jsonl` with optional
+ *             `--since <duration>` (24h, 7d, 30m, 60s) +
+ *             `--decision <allowed|denied|prompted>` filters. Newest-
+ *             first. CLI.5 swaps this file-based sink for the libsql
+ *             `audit_log` table; the wire shape is a deliberate subset
+ *             of the CLI.5 columns so migration is `INSERT INTO ...
+ *             SELECT ...`.
+ *
+ *   grant   — append a user-side override to
+ *             `~/.opensquid/permission_overrides.yaml` (atomic write).
+ *             Built-in denylist patterns are REJECTED at the CLI layer
+ *             with an explicit error message — even if a user edits
+ *             the file directly, the gate still applies the sealed
+ *             denylist first (defense in depth). Escape hatch:
+ *             `OPENSQUID_TRUST_BUILTIN_DENY=0` disables BOTH layers
+ *             (matching the gate's env snapshot semantics).
+ *
+ *   revoke  — remove matching overrides. Without `--target`, removes
+ *             every override for `(pack, capability)`. With `--target`,
+ *             removes only the exact `(pack, capability, target)` row.
+ *
+ * Imports from: commander, ./permissions_actions, ./permissions_state.
+ * Imported by: src/cli.ts.
+ */
+import { actAudit, actGrant, actList, actRevoke, defaultPaths, } from './permissions_actions.js';
+function buildDeps(deps) {
+    const defaults = defaultPaths();
+    const paths = {
+        overridesPath: deps.overridesPath ?? defaults.overridesPath,
+        auditPath: deps.auditPath ?? defaults.auditPath,
+        packsDir: deps.packsDir ?? defaults.packsDir,
+    };
+    return {
+        paths,
+        out: deps.stdout ?? ((s) => process.stdout.write(s)),
+        err: deps.stderr ?? ((s) => process.stderr.write(s)),
+        now: deps.now ?? (() => new Date()),
+    };
+}
+export function registerPermissions(parent, deps = {}) {
+    const ad = buildDeps(deps);
+    const p = parent.command('permissions').description('Pack capability declarations + audit');
+    p.command('list')
+        .description('Show declared permissions + user overrides per pack')
+        .option('--pack <pack>', 'limit to a single pack')
+        .action((opts) => actList(ad, opts));
+    p.command('audit')
+        .description('Recent capability-gate decisions (file-based; CLI.5 migrates to libsql)')
+        .option('--since <duration>', 'e.g. 24h, 7d, 30m, 60s')
+        .option('--decision <kind>', 'allowed|denied|prompted')
+        .option('--limit <n>', 'cap result count (default 100)')
+        .action((opts) => actAudit(ad, opts));
+    p.command('grant <pack> <capability>')
+        .description('User-side override: grant a (pack, capability, target) tuple. Built-in denylist patterns rejected unless OPENSQUID_TRUST_BUILTIN_DENY=0')
+        .requiredOption('--target <pattern>', 'e.g. "pnpm test" or "https://api.github.com/**"')
+        .action((pack, capability, opts) => actGrant(ad, pack, capability, opts));
+    p.command('revoke <pack> <capability>')
+        .description('Remove user-side override(s). Without --target, removes ALL overrides for (pack, capability)')
+        .option('--target <pattern>', 'narrow to a specific target')
+        .action((pack, capability, opts) => actRevoke(ad, pack, capability, opts));
+    return p;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/setup/cli/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/setup/cli/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,OAAO,EACP,SAAS,EACT,YAAY,GAOb,MAAM,0BAA0B,CAAC;AAalC,SAAS,SAAS,CAAC,IAAwB;IACzC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,KAAK,GAAqB;QAC9B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;QAC3D,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;KAC7C,CAAC;IACF,OAAO;QACL,KAAK;QACL,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,OAA2B,EAAE;IAChF,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAE5F,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;SACd,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC;SACjD,MAAM,CAAC,CAAC,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEjD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;SACf,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;SACtD,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACtD,MAAM,CAAC,aAAa,EAAE,gCAAgC,CAAC;SACvD,MAAM,CAAC,CAAC,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEnD,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACnC,WAAW,CACV,yIAAyI,CAC1I;SACA,cAAc,CAAC,oBAAoB,EAAE,iDAAiD,CAAC;SACvF,MAAM,CAAC,CAAC,IAAY,EAAE,UAAkB,EAAE,IAAe,EAAE,EAAE,CAC5D,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CACrC,CAAC;IAEJ,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;SACpC,WAAW,CACV,8FAA8F,CAC/F;SACA,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;SAC3D,MAAM,CAAC,CAAC,IAAY,EAAE,UAAkB,EAAE,IAAgB,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CACtC,CAAC;IAEJ,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/setup/cli/permissions_actions.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Action implementations for CLI.4 — `opensquid permissions …`.
+ *
+ * Split out of `permissions.ts` (file-size budget). Four verbs:
+ *
+ *   list     — show declared permissions per pack alongside user overrides.
+ *              When `--pack <id>` is passed, scope to that one pack;
+ *              otherwise enumerate every pack under
+ *              `~/.opensquid/packs/`. Output is JSON (one entry per
+ *              capability the pack declares OR has overrides for) so
+ *              downstream tools can pipe it; the human-readable summary
+ *              line is on stderr for ergonomics.
+ *
+ *   audit    — query `~/.opensquid/permission_audit.jsonl` (file-based;
+ *              CLI.5 migrates to the libsql `audit_log` table). Honors
+ *              `--since <duration>` (e.g. 24h, 7d) + `--decision <kind>`
+ *              (allowed|denied|prompted). Returns rows sorted newest-first.
+ *
+ *   grant    — append a user-side override to
+ *              `~/.opensquid/permission_overrides.yaml`. Rejects targets
+ *              that match the sealed built-in denylist unless
+ *              `OPENSQUID_TRUST_BUILTIN_DENY=0` is set in the environment.
+ *              Atomic file write: tmp + rename.
+ *
+ *   revoke   — remove a matching override. Without `--target`, removes
+ *              all overrides for `(pack, capability)`. With `--target`,
+ *              removes only the matching `(pack, capability, target)`.
+ *
+ * Capability-vocabulary discipline: the CLI speaks the same `(pack,
+ * capability, target)` tuple the runtime gate consumes. No translation
+ * between human + machine vocabularies — the audit-log shape and the
+ * gate's `CapabilityRequest` are literally the same triple.
+ *
+ * Imports from: ../../packs/schemas, ./permissions_state.
+ * Imported by: src/setup/cli/permissions.ts.
+ */
+import { type CapabilityType } from '../../packs/schemas/index.js';
+import { type AuditEntry } from './permissions_state.js';
+export interface PermissionsPaths {
+    overridesPath: string;
+    auditPath: string;
+    packsDir: string;
+}
+export interface ActionDeps {
+    paths: PermissionsPaths;
+    out: (s: string) => void;
+    err: (s: string) => void;
+    now: () => Date;
+}
+export declare const defaultPaths: () => PermissionsPaths;
+export declare function parseCapability(raw: string): CapabilityType | null;
+export interface ListOpts {
+    pack?: string;
+}
+export declare function actList(deps: ActionDeps, opts: ListOpts): Promise<void>;
+export interface AuditOpts {
+    since?: string;
+    decision?: string;
+    limit?: string;
+}
+export declare function parseDurationToMs(spec: string): number | null;
+export declare function actAudit(deps: ActionDeps, opts: AuditOpts): Promise<void>;
+export interface GrantOpts {
+    target: string;
+}
+export declare function actGrant(deps: ActionDeps, pack: string, capability: string, opts: GrantOpts): Promise<void>;
+export interface RevokeOpts {
+    target?: string;
+}
+export declare function actRevoke(deps: ActionDeps, pack: string, capability: string, opts: RevokeOpts): Promise<void>;
+export declare function recordAuditEntry(path: string, entry: AuditEntry): Promise<void>;
+//# sourceMappingURL=permissions_actions.d.ts.map

package/dist/setup/cli/permissions_actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions_actions.d.ts","sourceRoot":"","sources":["../../../src/setup/cli/permissions_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAUL,KAAK,UAAU,EAEhB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,gBAAgB,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,eAAO,MAAM,YAAY,QAAO,gBAI9B,CAAC;AAMH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGlE;AAMD,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,wBAAsB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B7E;AAMD,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB7D;AAID,wBAAsB,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC/E;AAMD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC,CAuCf;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAOD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF"}

package/dist/setup/cli/permissions_actions.js

@@ -0,0 +1,208 @@
+/**
+ * Action implementations for CLI.4 — `opensquid permissions …`.
+ *
+ * Split out of `permissions.ts` (file-size budget). Four verbs:
+ *
+ *   list     — show declared permissions per pack alongside user overrides.
+ *              When `--pack <id>` is passed, scope to that one pack;
+ *              otherwise enumerate every pack under
+ *              `~/.opensquid/packs/`. Output is JSON (one entry per
+ *              capability the pack declares OR has overrides for) so
+ *              downstream tools can pipe it; the human-readable summary
+ *              line is on stderr for ergonomics.
+ *
+ *   audit    — query `~/.opensquid/permission_audit.jsonl` (file-based;
+ *              CLI.5 migrates to the libsql `audit_log` table). Honors
+ *              `--since <duration>` (e.g. 24h, 7d) + `--decision <kind>`
+ *              (allowed|denied|prompted). Returns rows sorted newest-first.
+ *
+ *   grant    — append a user-side override to
+ *              `~/.opensquid/permission_overrides.yaml`. Rejects targets
+ *              that match the sealed built-in denylist unless
+ *              `OPENSQUID_TRUST_BUILTIN_DENY=0` is set in the environment.
+ *              Atomic file write: tmp + rename.
+ *
+ *   revoke   — remove a matching override. Without `--target`, removes
+ *              all overrides for `(pack, capability)`. With `--target`,
+ *              removes only the matching `(pack, capability, target)`.
+ *
+ * Capability-vocabulary discipline: the CLI speaks the same `(pack,
+ * capability, target)` tuple the runtime gate consumes. No translation
+ * between human + machine vocabularies — the audit-log shape and the
+ * gate's `CapabilityRequest` are literally the same triple.
+ *
+ * Imports from: ../../packs/schemas, ./permissions_state.
+ * Imported by: src/setup/cli/permissions.ts.
+ */
+import { Capability } from '../../packs/schemas/index.js';
+import { appendAuditEntry, defaultAuditPath, defaultOverridesPath, defaultPacksDir, denylistRejectionFor, enumerateManifests, readAuditEntries, readOverridesFile, writeOverridesFile, } from './permissions_state.js';
+export const defaultPaths = () => ({
+    overridesPath: defaultOverridesPath(),
+    auditPath: defaultAuditPath(),
+    packsDir: defaultPacksDir(),
+});
+// ---------------------------------------------------------------------------
+// Capability parser — narrow the commander string into the Zod enum.
+// ---------------------------------------------------------------------------
+export function parseCapability(raw) {
+    const parsed = Capability.safeParse(raw);
+    return parsed.success ? parsed.data : null;
+}
+export async function actList(deps, opts) {
+    const [manifests, overrides] = await Promise.all([
+        enumerateManifests(deps.paths.packsDir),
+        readOverridesFile(deps.paths.overridesPath),
+    ]);
+    const rowsByPack = new Map();
+    for (const m of manifests) {
+        if (opts.pack !== undefined && m.packId !== opts.pack)
+            continue;
+        const declared = m.manifest.permissions ?? {};
+        rowsByPack.set(m.packId, { pack: m.packId, declared, overrides: [] });
+    }
+    // Overrides may reference packs not yet installed; surface them too so
+    // the user sees "you have overrides for a pack you don't have installed".
+    for (const o of overrides) {
+        if (opts.pack !== undefined && o.pack !== opts.pack)
+            continue;
+        const existing = rowsByPack.get(o.pack);
+        const entry = { capability: o.capability, target: o.target, granted_at: o.granted_at };
+        if (existing) {
+            existing.overrides.push(entry);
+        }
+        else {
+            rowsByPack.set(o.pack, { pack: o.pack, declared: {}, overrides: [entry] });
+        }
+    }
+    const rows = [...rowsByPack.values()].sort((a, b) => a.pack.localeCompare(b.pack));
+    if (rows.length === 0) {
+        deps.out('(no packs with declared permissions or user overrides)\n');
+        return;
+    }
+    deps.out(JSON.stringify({ packs: rows }, null, 2) + '\n');
+}
+const DURATION_RE = /^(\d+)(s|m|h|d)$/;
+export function parseDurationToMs(spec) {
+    const m = DURATION_RE.exec(spec.trim());
+    if (!m)
+        return null;
+    const n = Number.parseInt(m[1] ?? '0', 10);
+    if (!Number.isFinite(n) || n < 0)
+        return null;
+    switch (m[2]) {
+        case 's':
+            return n * 1000;
+        case 'm':
+            return n * 60_000;
+        case 'h':
+            return n * 3_600_000;
+        case 'd':
+            return n * 86_400_000;
+        default:
+            return null;
+    }
+}
+const VALID_DECISIONS = new Set(['allowed', 'denied', 'prompted']);
+export async function actAudit(deps, opts) {
+    let sinceMs = null;
+    if (opts.since !== undefined) {
+        const ms = parseDurationToMs(opts.since);
+        if (ms === null) {
+            deps.err(`opensquid permissions audit: --since "${opts.since}" must be like "24h", "7d", "30m", "60s"\n`);
+            process.exitCode = 1;
+            return;
+        }
+        sinceMs = deps.now().getTime() - ms;
+    }
+    if (opts.decision !== undefined &&
+        !VALID_DECISIONS.has(opts.decision)) {
+        deps.err(`opensquid permissions audit: --decision "${opts.decision}" must be one of allowed|denied|prompted\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const entries = await readAuditEntries(deps.paths.auditPath);
+    const filtered = entries.filter((e) => {
+        if (sinceMs !== null && e.occurred_at_ms < sinceMs)
+            return false;
+        if (opts.decision !== undefined && e.decision !== opts.decision)
+            return false;
+        return true;
+    });
+    filtered.sort((a, b) => b.occurred_at_ms - a.occurred_at_ms);
+    const limit = opts.limit !== undefined ? Number.parseInt(opts.limit, 10) : 100;
+    const sliced = Number.isFinite(limit) && limit > 0 ? filtered.slice(0, limit) : filtered;
+    if (sliced.length === 0) {
+        deps.out('(no audit entries match the query)\n');
+        return;
+    }
+    deps.out(JSON.stringify({ entries: sliced }, null, 2) + '\n');
+}
+export async function actGrant(deps, pack, capability, opts) {
+    const cap = parseCapability(capability);
+    if (cap === null) {
+        deps.err(`opensquid permissions grant: unknown capability "${capability}" — must be one of ${Capability.options.join('|')}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.target === undefined || opts.target.length === 0) {
+        deps.err('opensquid permissions grant: --target <pattern> is required\n');
+        process.exitCode = 1;
+        return;
+    }
+    const rejection = denylistRejectionFor(cap, opts.target);
+    if (rejection !== null) {
+        deps.err(`opensquid permissions grant: ${rejection.message}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const existing = await readOverridesFile(deps.paths.overridesPath);
+    const duplicate = existing.find((o) => o.pack === pack && o.capability === cap && o.target === opts.target);
+    if (duplicate !== undefined) {
+        deps.err(`opensquid permissions grant: override already exists for pack="${pack}" capability="${cap}" target="${opts.target}" (granted_at ${duplicate.granted_at})\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const record = {
+        pack,
+        capability: cap,
+        target: opts.target,
+        granted_at: deps.now().toISOString(),
+    };
+    await writeOverridesFile(deps.paths.overridesPath, [...existing, record]);
+    deps.out(JSON.stringify({ granted: record }, null, 2) + '\n');
+}
+export async function actRevoke(deps, pack, capability, opts) {
+    const cap = parseCapability(capability);
+    if (cap === null) {
+        deps.err(`opensquid permissions revoke: unknown capability "${capability}" — must be one of ${Capability.options.join('|')}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const existing = await readOverridesFile(deps.paths.overridesPath);
+    const next = existing.filter((o) => {
+        if (o.pack !== pack)
+            return true;
+        if (o.capability !== cap)
+            return true;
+        if (opts.target !== undefined && o.target !== opts.target)
+            return true;
+        return false;
+    });
+    const removed = existing.length - next.length;
+    if (removed === 0) {
+        deps.err(`opensquid permissions revoke: no override matches pack="${pack}" capability="${cap}"${opts.target !== undefined ? ` target="${opts.target}"` : ''}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    await writeOverridesFile(deps.paths.overridesPath, next);
+    deps.out(JSON.stringify({ revoked: removed, pack, capability: cap, target: opts.target }, null, 2) +
+        '\n');
+}
+// ---------------------------------------------------------------------------
+// audit-log appender — exported so the runtime gate's `auditLog` callback
+// can write file-based entries until CLI.5 ships the libsql sink.
+// ---------------------------------------------------------------------------
+export async function recordAuditEntry(path, entry) {
+    await appendAuditEntry(path, entry);
+}
+//# sourceMappingURL=permissions_actions.js.map

package/dist/setup/cli/permissions_actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions_actions.js","sourceRoot":"","sources":["../../../src/setup/cli/permissions_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAuB,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GAGnB,MAAM,wBAAwB,CAAC;AAehC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAqB,EAAE,CAAC,CAAC;IACnD,aAAa,EAAE,oBAAoB,EAAE;IACrC,SAAS,EAAE,gBAAgB,EAAE;IAC7B,QAAQ,EAAE,eAAe,EAAE;CAC5B,CAAC,CAAC;AAEH,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAc;IAC5D,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;KAC5C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;YAAE,SAAS;QAChE,MAAM,QAAQ,GAA4B,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QACvE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,SAAS;QAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACvF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC5D,CAAC;AAYD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,CAAC,GAAG,IAAI,CAAC;QAClB,KAAK,GAAG;YACN,OAAO,CAAC,GAAG,MAAM,CAAC;QACpB,KAAK,GAAG;YACN,OAAO,CAAC,GAAG,SAAS,CAAC;QACvB,KAAK,GAAG;YACN,OAAO,CAAC,GAAG,UAAU,CAAC;QACxB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAe;IAC9D,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CACN,yCAAyC,IAAI,CAAC,KAAK,4CAA4C,CAChG,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;QAC3B,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAkC,CAAC,EAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CACN,4CAA4C,IAAI,CAAC,QAAQ,4CAA4C,CACtG,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,GAAG,OAAO;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAgB,EAChB,IAAY,EACZ,UAAkB,EAClB,IAAe;IAEf,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CACN,oDAAoD,UAAU,sBAAsB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACrH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAC1E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,gCAAgC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAC3E,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CACN,kEAAkE,IAAI,iBAAiB,GAAG,aAAa,IAAI,CAAC,MAAM,iBAAiB,SAAS,CAAC,UAAU,KAAK,CAC7J,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAmB;QAC7B,IAAI;QACJ,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAY,EACZ,UAAkB,EAClB,IAAgB;IAEhB,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CACN,qDAAqD,UAAU,sBAAsB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACtH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CACN,2DAA2D,IAAI,iBAAiB,GAAG,IACjF,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAC3D,IAAI,CACL,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,CACP,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,kEAAkE;AAClE,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAiB;IACpE,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC"}