pi-codex-auto-review 0.1.3 → 0.2.0

package/dist/approval-settings.js

@@ -1,8 +1,8 @@
-import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
-import { canonicalJson, GuardError } from './contracts.js';
-import { validateSettings } from './policy/index.js';
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { canonicalJson, GuardError } from "./contracts.js";
+import { validateSettings } from "./policy/index.js";
 export class ApprovalSettingsStore {
     path;
     defaults;
@@ -14,14 +14,18 @@ export class ApprovalSettingsStore {
     }
     async load() {
         try {
-            const stored = JSON.parse(await readFile(this.path, 'utf8'));
+            const stored = JSON.parse(await readFile(this.path, "utf8"));
             validateSettings(stored);
-            return validateSettings({ ...this.defaults, ...stored });
+            return validateSettings({
+                ...this.defaults,
+                ...stored,
+            });
         }
         catch (error) {
-            if (!this.isRequired && error.code === 'ENOENT')
+            if (!this.isRequired &&
+                error.code === "ENOENT")
                 return validateSettings(this.defaults);
-            throw new GuardError('INVALID_SETTINGS', 'Approval settings could not be loaded', { cause: error });
+            throw new GuardError("INVALID_SETTINGS", "Approval settings could not be loaded", { cause: error });
         }
     }
     async save(settings) {
@@ -29,7 +33,10 @@ export class ApprovalSettingsStore {
         await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
         const temporary = `${this.path}.${randomUUID()}.tmp`;
         try {
-            await writeFile(temporary, canonicalJson(settings) + '\n', { flag: 'wx', mode: 0o600 });
+            await writeFile(temporary, `${canonicalJson(settings)}\n`, {
+                flag: "wx",
+                mode: 0o600,
+            });
             await rename(temporary, this.path);
         }
         finally {

package/dist/approval-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-settings.js","sourceRoot":"","sources":["../src/approval-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAsB,MAAM,mBAAmB,CAAC;AAEzE,MAAM,OAAO,qBAAqB;IACX;IAA+B;IAAwD;IAA5G,YAAqB,IAAY,EAAmB,WAAmC,EAAE,EAAmB,aAAa,KAAK;QAAzG,SAAI,GAAJ,IAAI,CAAQ;QAAmB,aAAQ,GAAR,QAAQ,CAA6B;QAAmB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAClI,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,CAAC;YACrE,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,gBAAgB,CAAC,EAAC,GAAG,IAAI,CAAC,QAAQ,EAAC,GAAG,MAAgC,EAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,UAAU,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnH,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAC,uCAAuC,EAAC,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAuB;QAChC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,EAAC,aAAa,CAAC,QAAQ,CAAC,GAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,CAAC,SAAS,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,SAAS,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;QAAC,CAAC;IACjD,CAAC;CACF"}
+{"version":3,"file":"approval-settings.js","sourceRoot":"","sources":["../src/approval-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAsB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,OAAO,qBAAqB;IAEjB;IACQ;IACA;IAHrB,YACa,IAAY,EACJ,WAAmC,EAAE,EACrC,aAAa,KAAK;QAF1B,SAAI,GAAJ,IAAI,CAAQ;QACJ,aAAQ,GAAR,QAAQ,CAA6B;QACrC,eAAU,GAAV,UAAU,CAAQ;IACpC,CAAC;IACJ,KAAK,CAAC,IAAI;QACN,IAAI,CAAC;YACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAC9B,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CACpC,CAAC;YACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,gBAAgB,CAAC;gBACpB,GAAG,IAAI,CAAC,QAAQ;gBAChB,GAAI,MAAiC;aACxC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IACI,CAAC,IAAI,CAAC,UAAU;gBACf,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAElD,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,IAAI,UAAU,CAChB,kBAAkB,EAClB,uCAAuC,EACvC,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAuB;QAC9B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACvD,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;aACd,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;CACJ"}

package/dist/approvals.d.ts

@@ -1,10 +1,10 @@
-import { type Grant, type GuardAction, type PermissionDelta, type PolicyDecision, type ApprovalPolicy, type ReviewContext, type ReviewResult, type ExecutionAuthority } from './contracts.js';
-import { type Clock } from './signals.js';
-import { type ReviewProvider } from './reviewer.js';
-import { AuditLog } from './audit.js';
-import type { GuardSettings } from './policy/index.js';
-import { ReviewLifecycle } from './review/lifecycle.js';
-export type ApprovalChoice = 'deny' | 'once' | 'session' | 'persistent';
+import type { AuditLog } from "./audit.js";
+import { type ApprovalPolicy, type ExecutionAuthority, type Grant, type GuardAction, type PermissionDelta, type PolicyDecision, type ReviewContext, type ReviewResult } from "./contracts.js";
+import type { GuardSettings } from "./policy/index.js";
+import { ReviewLifecycle } from "./review/lifecycle.js";
+import { type ReviewExecutionContext, type ReviewProvider } from "./reviewer.js";
+import { type Clock } from "./signals.js";
+export type ApprovalChoice = "deny" | "once" | "session" | "persistent";
 export interface ApprovalUI {
     select(action: GuardAction, delta: PermissionDelta, options: {
         signal: AbortSignal;
@@ -38,7 +38,7 @@ export declare class ApprovalManager {
         persistence?: GrantPersistence;
         clock?: Clock;
         approvalPolicy?: ApprovalPolicy;
-        approvalsReviewer?: 'auto_review' | 'user';
+        approvalsReviewer?: "auto_review" | "user";
     };
     readonly lifecycle: ReviewLifecycle;
     private grants;
@@ -52,7 +52,7 @@ export declare class ApprovalManager {
         persistence?: GrantPersistence;
         clock?: Clock;
         approvalPolicy?: ApprovalPolicy;
-        approvalsReviewer?: 'auto_review' | 'user';
+        approvalsReviewer?: "auto_review" | "user";
     });
     initialize(): Promise<void>;
     reset(sessionId?: string): void;
@@ -64,6 +64,7 @@ export declare class ApprovalManager {
         signal?: AbortSignal;
         reviewContext?: ReviewContext;
         settings?: GuardSettings;
+        executionContext?: ReviewExecutionContext;
         onReviewStart?: () => void;
         onReviewResult?: (result?: ReviewResult) => void;
         onInterrupt?: () => void;

package/dist/approvals.js

@@ -1,11 +1,10 @@
-import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, writeFile, rm } from 'node:fs/promises';
-import { dirname } from 'node:path';
-import { canonicalJson, immutable, ruleDigest, approvalEligible, GuardError, EMPTY_DELTA } from './contracts.js';
-import { deadlineSignal, withSignal } from './signals.js';
-import { reviewAction } from './reviewer.js';
-import { ReviewLifecycle } from './review/lifecycle.js';
-import { digest } from './contracts.js';
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { approvalEligible, canonicalJson, digest, EMPTY_DELTA, GuardError, immutable, ruleDigest, } from "./contracts.js";
+import { ReviewLifecycle } from "./review/lifecycle.js";
+import { reviewAction, } from "./reviewer.js";
+import { deadlineSignal, withSignal } from "./signals.js";
 export class FileGrantPersistence {
     path;
     constructor(path) {
@@ -13,22 +12,32 @@ export class FileGrantPersistence {
     }
     async load() {
         try {
-            const data = JSON.parse(await readFile(this.path, 'utf8'));
-            if (!Array.isArray(data) || data.some(value => !value || value.scope !== 'persistent' || typeof value.ruleDigest !== 'string' || typeof value.policyRevision !== 'string' || typeof value.permissionDigest !== 'string' || !value.delta || !['readPaths', 'writePaths', 'domains'].every(key => Array.isArray(value.delta[key]) && value.delta[key].every((x) => typeof x === 'string'))))
-                throw new Error('Invalid persistent rules');
+            const data = JSON.parse(await readFile(this.path, "utf8"));
+            if (!Array.isArray(data) ||
+                data.some((value) => value?.scope !== "persistent" ||
+                    typeof value.ruleDigest !== "string" ||
+                    typeof value.policyRevision !== "string" ||
+                    typeof value.permissionDigest !== "string" ||
+                    !value.delta ||
+                    !["readPaths", "writePaths", "domains"].every((key) => Array.isArray(value.delta[key]) &&
+                        value.delta[key].every((x) => typeof x === "string"))))
+                throw new Error("Invalid persistent rules");
             return immutable(data);
         }
         catch (error) {
-            if (error.code === 'ENOENT')
+            if (error.code === "ENOENT")
                 return [];
-            throw new GuardError('INVALID_GRANTS', 'Persistent rules could not be loaded', { cause: error });
+            throw new GuardError("INVALID_GRANTS", "Persistent rules could not be loaded", { cause: error });
         }
     }
     async save(grants) {
         await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
         const temp = `${this.path}.${randomUUID()}.tmp`;
         try {
-            await writeFile(temp, canonicalJson(grants) + '\n', { mode: 0o600, flag: 'wx' });
+            await writeFile(temp, `${canonicalJson(grants)}\n`, {
+                mode: 0o600,
+                flag: "wx",
+            });
             await rename(temp, this.path);
         }
         finally {
@@ -46,114 +55,223 @@ export class ApprovalManager {
     constructor(options) {
         this.options = options;
     }
-    async initialize() { this.grants = await this.options.persistence?.load() ?? []; }
+    async initialize() {
+        this.grants = (await this.options.persistence?.load()) ?? [];
+    }
     reset(sessionId) {
-        this.epoch.abort(new GuardError('SESSION_CHANGED', 'Session changed'));
+        this.epoch.abort(new GuardError("SESSION_CHANGED", "Session changed"));
         this.epoch = new AbortController();
         this.sessionId = sessionId;
-        this.grants = this.grants.filter(grant => grant.scope === 'persistent');
+        this.grants = this.grants.filter((grant) => grant.scope === "persistent");
         this.lifecycle.reset();
     }
-    invalidate() { this.reset(this.sessionId); this.grants = []; }
+    invalidate() {
+        this.reset(this.sessionId);
+        this.grants = [];
+    }
     async admit(action, policy, context) {
         this.sessionId ??= action.sessionId;
-        const signal = AbortSignal.any([this.epoch.signal, ...(action.source === 'user-bash' ? [] : [this.lifecycle.signal]), ...(context.signal ? [context.signal] : [])]);
-        const deny = (reason) => ({ isAllowed: false, delta: EMPTY_DELTA, reason });
+        const signal = AbortSignal.any([
+            this.epoch.signal,
+            ...(action.source === "user-bash" ? [] : [this.lifecycle.signal]),
+            ...(context.signal ? [context.signal] : []),
+        ]);
+        const deny = (reason) => ({
+            isAllowed: false,
+            delta: EMPTY_DELTA,
+            reason,
+        });
         if (signal.aborted || action.sessionId !== this.sessionId)
-            return deny('Cancelled or stale session');
-        if (policy.actionDigest !== action.digest || policy.kind === 'deny' || policy.isHardDeny) {
-            await this.options.audit.record(action, 'policy', 'deny');
+            return deny("Cancelled or stale session");
+        if (policy.actionDigest !== action.digest ||
+            policy.kind === "deny" ||
+            policy.isHardDeny) {
+            await this.options.audit.record(action, "policy", "deny");
             return deny(policy.reason);
         }
         if (policy.authority && policy.authority.actionDigest !== action.digest)
-            return deny('Authority belongs to another action');
-        if (policy.kind === 'allow') {
-            await this.options.audit.record(action, 'policy', 'allow');
-            return { isAllowed: true, delta: policy.delta, authority: policy.authority, reason: policy.reason };
+            return deny("Authority belongs to another action");
+        if (policy.kind === "allow") {
+            await this.options.audit.record(action, "policy", "allow");
+            return {
+                isAllowed: true,
+                delta: policy.delta,
+                authority: policy.authority,
+                reason: policy.reason,
+            };
         }
-        if (!approvalEligible(this.options.approvalPolicy ?? 'on-request', policy.approvalCategory ?? 'sandbox'))
-            return deny('Approval policy disables this request category');
-        const obsolete = this.grants.filter(grant => grant.permissionDigest !== action.permissionDigest || grant.policyRevision !== action.policyRevision);
+        if (!approvalEligible(this.options.approvalPolicy ?? "on-request", policy.approvalCategory ?? "sandbox"))
+            return deny("Approval policy disables this request category");
+        const obsolete = this.grants.filter((grant) => grant.permissionDigest !== action.permissionDigest ||
+            grant.policyRevision !== action.policyRevision);
         if (obsolete.length) {
-            this.grants = this.grants.filter(grant => !obsolete.includes(grant));
-            await this.options.audit.record(action, 'grant', 'invalidated-policy-or-profile');
+            this.grants = this.grants.filter((grant) => !obsolete.includes(grant));
+            await this.options.audit.record(action, "grant", "invalidated-policy-or-profile");
         }
-        const contextId = context.reviewContext?.contextId ?? 'legacy';
+        const contextId = context.reviewContext?.contextId ?? "legacy";
         const retry = this.lifecycle.consumeRetry(action, contextId);
         let reviewContext = context.reviewContext;
         if (retry && reviewContext) {
-            const fields = { ...reviewContext, items: [...reviewContext.items, { id: retry.id, source: 'user-confirmation', trust: 'authorization', content: { type: 'exact-action-retry-approval', actionIdentity: retry.actionIdentity, denialId: retry.denialId, scope: 'one retry; fresh policy review required' } }] };
+            const { digest: previousDigest, ...previous } = reviewContext;
+            const fields = {
+                ...previous,
+                items: [
+                    ...reviewContext.items,
+                    {
+                        id: retry.id,
+                        source: "user-confirmation",
+                        trust: "authorization",
+                        content: {
+                            type: "exact-action-retry-approval",
+                            actionIdentity: retry.actionIdentity,
+                            denialId: retry.denialId,
+                            scope: "one retry; fresh policy review required",
+                        },
+                    },
+                ],
+            };
             reviewContext = immutable({ ...fields, digest: digest(fields) });
-            await this.options.audit.record(action, 'retry', 'consumed');
+            await this.options.audit.record(action, "retry", "consumed");
         }
-        const cached = retry || policy.requiresFreshReview || policy.requiresUserInput || policy.authority?.kind === 'reviewed-command' ? undefined : this.grants.find(grant => grant.ruleDigest === ruleDigest(action) && grant.permissionDigest === action.permissionDigest && grant.policyRevision === action.policyRevision && (grant.scope === 'persistent' || grant.sessionId === action.sessionId));
+        const cached = retry ||
+            policy.requiresFreshReview ||
+            policy.requiresUserInput ||
+            policy.authority?.kind === "reviewed-command"
+            ? undefined
+            : this.grants.find((grant) => grant.ruleDigest === ruleDigest(action) &&
+                grant.permissionDigest === action.permissionDigest &&
+                grant.policyRevision === action.policyRevision &&
+                (grant.scope === "persistent" ||
+                    grant.sessionId === action.sessionId));
         if (cached) {
             this.lifecycle.record(action, contextId);
-            await this.options.audit.record(action, 'grant', cached.scope);
-            return { isAllowed: true, delta: cached.delta, grant: cached, reason: 'Bound rule authorized the action' };
+            await this.options.audit.record(action, "grant", cached.scope);
+            return {
+                isAllowed: true,
+                delta: cached.delta,
+                grant: cached,
+                reason: "Bound rule authorized the action",
+            };
         }
         context.onReviewStart?.();
-        const review = this.options.approvalsReviewer === 'user' || policy.requiresUserInput ? { decision: 'ask', reason: 'User review requested', result: undefined } : await reviewAction({ action, policyDecision: policy, provider: context.provider, trustedAuthorization: context.trustedAuthorization, hasUI: Boolean(context.ui), signal, timeoutMs: this.options.reviewTimeoutMs, clock: this.options.clock, context: reviewContext, settings: context.settings });
+        const review = this.options.approvalsReviewer === "user" ||
+            policy.requiresUserInput
+            ? {
+                decision: "ask",
+                reason: "User review requested",
+                result: undefined,
+            }
+            : await reviewAction({
+                action,
+                policyDecision: policy,
+                provider: context.provider,
+                trustedAuthorization: context.trustedAuthorization,
+                hasUI: Boolean(context.ui),
+                signal,
+                timeoutMs: this.options.reviewTimeoutMs,
+                clock: this.options.clock,
+                context: reviewContext,
+                settings: context.settings,
+                executionContext: context.executionContext,
+            });
         context.onReviewResult?.(review.result);
         if (signal.aborted)
-            return { ...deny('Call cancelled'), review: review.result };
+            return { ...deny("Call cancelled"), review: review.result };
         const recorded = this.lifecycle.record(action, contextId, review.result);
         if (recorded.shouldInterrupt)
             context.onInterrupt?.();
         if (review.result)
             await this.options.audit.recordReview(action, review.result);
-        if (review.decision === 'deny')
-            return { ...deny(review.reason), review: review.result, denialId: recorded.denialId };
-        if (review.decision === 'allow') {
+        if (review.decision === "deny")
+            return {
+                ...deny(review.reason),
+                review: review.result,
+                denialId: recorded.denialId,
+            };
+        if (review.decision === "allow") {
             if (signal.aborted)
-                return deny('Turn interrupted before approval could execute');
-            if (review.result && (review.result.status !== 'approved' || review.result.actionDigest !== action.digest || reviewContext && review.result.contextDigest !== reviewContext.digest))
-                return deny('Review result does not match the bound action and context');
-            if (!review.result && policy.authority?.kind === 'reviewed-command')
-                return deny('Full command approval requires a structured assessment');
-            await this.options.audit.record(action, 'review', 'approved');
-            return { isAllowed: true, delta: policy.delta, authority: policy.authority ?? { kind: 'scoped-permissions', actionDigest: action.digest }, reason: review.reason, review: review.result };
+                return deny("Turn interrupted before approval could execute");
+            if (review.result &&
+                (review.result.status !== "approved" ||
+                    review.result.actionDigest !== action.digest ||
+                    (reviewContext &&
+                        review.result.contextDigest !== reviewContext.digest)))
+                return deny("Review result does not match the bound action and context");
+            if (!review.result && policy.authority?.kind === "reviewed-command")
+                return deny("Full command approval requires a structured assessment");
+            await this.options.audit.record(action, "review", "approved");
+            return {
+                isAllowed: true,
+                delta: policy.delta,
+                authority: policy.authority ?? {
+                    kind: "scoped-permissions",
+                    actionDigest: action.digest,
+                },
+                reason: review.reason,
+                review: review.result,
+            };
         }
         if (!context.ui)
-            return deny('Approval UI unavailable');
+            return deny("Approval UI unavailable");
         const ui = context.ui;
         // Queue all dialogs, including compensated persistence, until this decision settles.
         const pending = this.tail.then(async () => {
             if (signal.aborted)
-                return deny('Queued approval cancelled');
+                return deny("Queued approval cancelled");
             const deadline = deadlineSignal(signal, this.options.approvalTimeoutMs, this.options.clock);
             try {
-                const choice = await withSignal(ui.select(action, policy.delta, { signal: deadline.signal, timeoutMs: this.options.approvalTimeoutMs }), deadline.signal);
+                const choice = await withSignal(ui.select(action, policy.delta, {
+                    signal: deadline.signal,
+                    timeoutMs: this.options.approvalTimeoutMs,
+                }), deadline.signal);
                 deadline.signal.throwIfAborted();
-                if (!choice || choice === 'deny')
-                    return deny('User denied the action');
-                if (!['once', 'session', 'persistent'].includes(choice))
-                    return deny('Invalid approval scope');
-                if (choice === 'persistent' && !this.options.persistence)
-                    return deny('Persistent rules are unavailable');
-                if (policy.authority?.kind === 'reviewed-command' && choice !== 'once')
-                    return deny('Full command authority can only be approved for one invocation');
-                if ((policy.requiresFreshReview || policy.requiresUserInput) && choice !== 'once')
-                    return deny('This request requires a fresh one-use approval');
-                const grant = immutable({ id: randomUUID(), scope: choice, actionDigest: action.digest, ruleDigest: ruleDigest(action), sessionId: action.sessionId, policyRevision: action.policyRevision, permissionDigest: action.permissionDigest, delta: policy.delta });
-                if (choice === 'persistent') {
-                    const prior = this.grants.filter(item => item.scope === 'persistent');
-                    await this.options.persistence.save([...prior, grant]);
+                if (!choice || choice === "deny")
+                    return deny("User denied the action");
+                if (!["once", "session", "persistent"].includes(choice))
+                    return deny("Invalid approval scope");
+                const persistence = this.options.persistence;
+                if (choice === "persistent" && !persistence)
+                    return deny("Persistent rules are unavailable");
+                if (policy.authority?.kind === "reviewed-command" &&
+                    choice !== "once")
+                    return deny("Full command authority can only be approved for one invocation");
+                if ((policy.requiresFreshReview || policy.requiresUserInput) &&
+                    choice !== "once")
+                    return deny("This request requires a fresh one-use approval");
+                const grant = immutable({
+                    id: randomUUID(),
+                    scope: choice,
+                    actionDigest: action.digest,
+                    ruleDigest: ruleDigest(action),
+                    sessionId: action.sessionId,
+                    policyRevision: action.policyRevision,
+                    permissionDigest: action.permissionDigest,
+                    delta: policy.delta,
+                });
+                if (choice === "persistent" && persistence) {
+                    const prior = this.grants.filter((item) => item.scope === "persistent");
+                    await persistence.save([...prior, grant]);
                     if (deadline.signal.aborted) {
-                        await this.options.persistence.save(prior);
-                        return deny('Persistent approval cancelled and reverted');
+                        await persistence.save(prior);
+                        return deny("Persistent approval cancelled and reverted");
                     }
                 }
                 deadline.signal.throwIfAborted();
-                if (choice !== 'once')
+                if (choice !== "once")
                     this.grants.push(grant);
-                await this.options.audit.record(action, 'approval', choice);
+                await this.options.audit.record(action, "approval", choice);
                 // Once-grants are consumed at logical admission; helpers share this returned immutable profile.
-                return { isAllowed: true, delta: grant.delta, grant, authority: policy.authority, reason: 'User authorized the bound action' };
+                return {
+                    isAllowed: true,
+                    delta: grant.delta,
+                    grant,
+                    authority: policy.authority,
+                    reason: "User authorized the bound action",
+                };
             }
             catch {
-                await this.options.audit.record(action, 'approval', 'cancelled-or-failed');
-                return deny('Approval cancelled or failed');
+                await this.options.audit.record(action, "approval", "cancelled-or-failed");
+                return deny("Approval cancelled or failed");
             }
             finally {
                 deadline.dispose();
@@ -162,6 +280,9 @@ export class ApprovalManager {
         this.tail = pending.then(() => { }, () => { });
         return pending;
     }
-    async settle() { await this.tail; await this.options.audit.flush(); }
+    async settle() {
+        await this.tail;
+        await this.options.audit.flush();
+    }
 }
 //# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAgK,MAAM,gBAAgB,CAAC;AAC/Q,OAAO,EAAE,cAAc,EAAE,UAAU,EAAc,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAGlE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAKxC,MAAM,OAAO,oBAAoB;IACV;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IACrC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChb,OAAO,SAAS,CAAC,IAAe,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;IAC1L,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;gBAChH,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAML;IALZ,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,GAAY,EAAE,CAAC;IACrB,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9B,SAAS,CAAU;IAC3B,YAAqB,OAA4M;QAA5M,YAAO,GAAP,OAAO,CAAqM;IAAG,CAAC;IACrO,KAAK,CAAC,UAAU,KAAoB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjG,KAAK,CAAC,SAAkB;QACtB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,UAAU,KAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,CAAC,KAAK,CAAC,MAAmB,EAAE,MAAsB,EAAE,OAA2Q;QAClU,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpK,MAAM,IAAI,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACpL,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC5H,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QACjM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACxK,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC;QACnJ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC;QAAC,CAAC;QACjL,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,QAAQ,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1C,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,EAAC,GAAG,aAAa,EAAE,KAAK,EAAC,CAAC,GAAG,aAAa,CAAC,KAAK,EAAC,EAAC,EAAE,EAAC,KAAK,CAAC,EAAE,EAAC,MAAM,EAAC,mBAA4B,EAAC,KAAK,EAAC,eAAwB,EAAC,OAAO,EAAC,EAAC,IAAI,EAAC,6BAA6B,EAAC,cAAc,EAAC,KAAK,CAAC,cAAc,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,EAAC,yCAAyC,EAAC,EAAC,CAAC,EAAC,CAAC;YAC5S,aAAa,GAAG,SAAS,CAAC,EAAC,GAAG,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACnY,IAAI,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAC,SAAS,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAAC,CAAC;QACpO,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpc,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,eAAe;YAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,EAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAC,CAAC;QACpH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClF,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9P,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB;gBAAE,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAC3I,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAC,IAAI,EAAC,oBAAoB,EAAC,YAAY,EAAC,MAAM,CAAC,MAAM,EAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACvL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,qFAAqF;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAwB,EAAE;YAC5D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC1J,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBACxE,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAC/F,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAC1G,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,gEAAgE,CAAC,CAAC;gBACtJ,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;gBACjJ,MAAM,KAAK,GAAU,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACrQ,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;oBACtE,MAAM,IAAI,CAAC,OAAO,CAAC,WAAY,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBACxD,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAAC,OAAO,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBAAC,CAAC;gBAC1I,CAAC;gBACD,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC5D,gGAAgG;gBAChG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACjI,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;oBAC5H,CAAC;gBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,MAAM,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACrF"}
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEH,gBAAgB,EAChB,aAAa,EACb,MAAM,EACN,WAAW,EAIX,UAAU,EACV,SAAS,EAKT,UAAU,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAGH,YAAY,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAc,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AActE,MAAM,OAAO,oBAAoB;IACR;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IACrC,KAAK,CAAC,IAAI;QACN,IAAI,CAAC;YACD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACpE,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,CAAC,IAAI,CACL,CAAC,KAAK,EAAE,EAAE,CACN,KAAK,EAAE,KAAK,KAAK,YAAY;oBAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;oBACpC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;oBACxC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;oBAC1C,CAAC,KAAK,CAAC,KAAK;oBACZ,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,CACzC,CAAC,GAAG,EAAE,EAAE,CACJ,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAC/B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAClB,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CACxC,CACR,CACR;gBAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChD,OAAO,SAAS,CAAC,IAAe,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,MAAM,IAAI,UAAU,CAChB,gBAAgB,EAChB,sCAAsC,EACtC,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAwB;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE;gBAChD,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,IAAI;aACb,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACP,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;CACJ;AAUD,MAAM,OAAO,eAAe;IAOX;IANJ,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,GAAY,EAAE,CAAC;IACrB,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3C,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9B,SAAS,CAAU;IAC3B,YACa,OAQR;QARQ,YAAO,GAAP,OAAO,CAQf;IACF,CAAC;IACJ,KAAK,CAAC,UAAU;QACZ,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,SAAkB;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,CAC1C,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,UAAU;QACN,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,KAAK,CACP,MAAmB,EACnB,MAAsB,EACtB,OAWC;QAED,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,MAAM;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC;YACzC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,WAAW;YAClB,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACrD,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC9C,IACI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;YACrC,MAAM,CAAC,IAAI,KAAK,MAAM;YACtB,MAAM,CAAC,UAAU,EACnB,CAAC;YACC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;YACnE,OAAO,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;aACxB,CAAC;QACN,CAAC;QACD,IACI,CAAC,gBAAgB,CACb,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,YAAY,EAC3C,MAAM,CAAC,gBAAgB,IAAI,SAAS,CACvC;YAED,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CACN,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;YAClD,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CACrD,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvC,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAC3B,MAAM,EACN,OAAO,EACP,+BAA+B,CAClC,CAAC;QACN,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,IAAI,QAAQ,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1C,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,aAAa,CAAC;YAC9D,MAAM,MAAM,GAAG;gBACX,GAAG,QAAQ;gBACX,KAAK,EAAE;oBACH,GAAG,aAAa,CAAC,KAAK;oBACtB;wBACI,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,MAAM,EAAE,mBAA4B;wBACpC,KAAK,EAAE,eAAwB;wBAC/B,OAAO,EAAE;4BACL,IAAI,EAAE,6BAA6B;4BACnC,cAAc,EAAE,KAAK,CAAC,cAAc;4BACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,KAAK,EAAE,yCAAyC;yBACnD;qBACJ;iBACJ;aACJ,CAAC;YACF,aAAa,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,GACR,KAAK;YACL,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB;YACzC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE,CACN,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,CAAC;gBACvC,KAAK,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;gBAClD,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;gBAC9C,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY;oBACzB,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAChD,CAAC;QACZ,IAAI,MAAM,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,kCAAkC;aAC7C,CAAC;QACN,CAAC;QACD,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GACR,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,MAAM;YACzC,MAAM,CAAC,iBAAiB;YACpB,CAAC,CAAC;gBACI,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,uBAAuB;gBAC/B,MAAM,EAAE,SAAS;aACpB;YACH,CAAC,CAAC,MAAM,YAAY,CAAC;gBACf,MAAM;gBACN,cAAc,EAAE,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC7C,CAAC,CAAC;QACb,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO;YACd,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAClC,MAAM,EACN,SAAS,EACT,MAAM,CAAC,MAAM,CAChB,CAAC;QACF,IAAI,QAAQ,CAAC,eAAe;YAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,MAAM;YACb,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAC1B,OAAO;gBACH,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC9B,CAAC;QACN,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO;gBACd,OAAO,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,IACI,MAAM,CAAC,MAAM;gBACb,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;oBAChC,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM;oBAC5C,CAAC,aAAa;wBACV,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,aAAa,CAAC,MAAM,CAAC,CAAC;gBAE9D,OAAO,IAAI,CACP,2DAA2D,CAC9D,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB;gBAC/D,OAAO,IAAI,CACP,wDAAwD,CAC3D,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,OAAO;gBACH,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;iBAC9B;gBACD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACxB,CAAC;QACN,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,qFAAqF;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAwB,EAAE;YAC1D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,cAAc,CAC3B,MAAM,EACN,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CACrB,CAAC;YACF,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC3B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;oBAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;iBAC5C,CAAC,EACF,QAAQ,CAAC,MAAM,CAClB,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;oBAC5B,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAC1C,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACnD,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC7C,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,WAAW;oBACvC,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACpD,IACI,MAAM,CAAC,SAAS,EAAE,IAAI,KAAK,kBAAkB;oBAC7C,MAAM,KAAK,MAAM;oBAEjB,OAAO,IAAI,CACP,gEAAgE,CACnE,CAAC;gBACN,IACI,CAAC,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,CAAC;oBACxD,MAAM,KAAK,MAAM;oBAEjB,OAAO,IAAI,CACP,gDAAgD,CACnD,CAAC;gBACN,MAAM,KAAK,GAAU,SAAS,CAAC;oBAC3B,EAAE,EAAE,UAAU,EAAE;oBAChB,KAAK,EAAE,MAAM;oBACb,YAAY,EAAE,MAAM,CAAC,MAAM;oBAC3B,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,KAAK,EAAE,MAAM,CAAC,KAAK;iBACtB,CAAC,CAAC;gBACH,IAAI,MAAM,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;oBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC5B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,CACxC,CAAC;oBACF,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBAC1C,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAC1B,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAC9B,OAAO,IAAI,CACP,4CAA4C,CAC/C,CAAC;oBACN,CAAC;gBACL,CAAC;gBACD,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC5D,gGAAgG;gBAChG,OAAO;oBACH,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,kCAAkC;iBAC7C,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAC3B,MAAM,EACN,UAAU,EACV,qBAAqB,CACxB,CAAC;gBACF,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAChD,CAAC;oBAAS,CAAC;gBACP,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CACpB,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACX,CAAC;QACF,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,MAAM;QACR,MAAM,IAAI,CAAC,IAAI,CAAC;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;CACJ"}

package/dist/audit.d.ts

@@ -1,4 +1,4 @@
-import type { GuardAction, ReviewResult, RiskLevel, UserAuthorization, ReviewTerminalState } from './contracts.js';
+import type { GuardAction, ReviewResult, ReviewTerminalState, RiskLevel, UserAuthorization } from "./contracts.js";
 interface ReviewAudit {
     status: ReviewTerminalState;
     riskLevel?: RiskLevel;

package/dist/audit.js

@@ -1,13 +1,14 @@
-import { mkdir, appendFile } from 'node:fs/promises';
-import { dirname } from 'node:path';
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
 export function redact(text, markers = []) {
-    let safe = text.replace(/SYNTHETIC_[A-Z0-9_:-]+/gi, '[REDACTED]')
-        .replace(/\b(Bearer\s+)[^\s"']+/gi, '$1[REDACTED]')
-        .replace(/\b((?:api[_-]?key|token|password|secret)\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;"']+)/gi, '$1[REDACTED]')
-        .replace(/\b(?:sk-[A-Za-z0-9_-]{8,}|AKIA[A-Z0-9]{16})\b/g, '[REDACTED]');
+    let safe = text
+        .replace(/SYNTHETIC_[A-Z0-9_:-]+/gi, "[REDACTED]")
+        .replace(/\b(Bearer\s+)[^\s"']+/gi, "$1[REDACTED]")
+        .replace(/\b((?:api[_-]?key|token|password|secret)\s*[=:]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;"']+)/gi, "$1[REDACTED]")
+        .replace(/\b(?:sk-[A-Za-z0-9_-]{8,}|AKIA[A-Z0-9]{16})\b/g, "[REDACTED]");
     for (const marker of markers)
         if (marker)
-            safe = safe.split(marker).join('[REDACTED]');
+            safe = safe.split(marker).join("[REDACTED]");
     return safe;
 }
 export class AuditLog {
@@ -20,21 +21,44 @@ export class AuditLog {
     }
     records = [];
     async recordReview(action, result) {
-        const review = 'assessment' in result ? { status: result.status, riskLevel: result.assessment.risk_level, userAuthorization: result.assessment.user_authorization, rationale: redact(result.assessment.rationale, this.markers).slice(0, 1000) } : { status: result.status };
-        await this.record(action, 'review', result.status, review);
+        const review = "assessment" in result
+            ? {
+                status: result.status,
+                riskLevel: result.assessment.risk_level,
+                userAuthorization: result.assessment.user_authorization,
+                rationale: redact(result.assessment.rationale, this.markers).slice(0, 1000),
+            }
+            : { status: result.status };
+        await this.record(action, "review", result.status, review);
     }
     async record(action, event, outcome, review) {
         // No arguments, command text, content, provider text or worker output enter the audit schema.
-        const record = { timestamp: new Date().toISOString(), actionDigest: action.digest, toolCallId: action.toolCallId, tool: action.tool, sessionId: action.sessionId, event, outcome, ...(review ? { review } : {}) };
-        const safe = JSON.parse(JSON.stringify(record, (_key, value) => typeof value === 'string' ? redact(value, this.markers) : value));
+        const record = {
+            timestamp: new Date().toISOString(),
+            actionDigest: action.digest,
+            toolCallId: action.toolCallId,
+            tool: action.tool,
+            sessionId: action.sessionId,
+            event,
+            outcome,
+            ...(review ? { review } : {}),
+        };
+        const safe = JSON.parse(JSON.stringify(record, (_key, value) => typeof value === "string" ? redact(value, this.markers) : value));
         this.records.push(safe);
         if (!this.path)
             return;
         const path = this.path;
-        const pending = this.tail.then(async () => { await mkdir(dirname(path), { recursive: true, mode: 0o700 }); await appendFile(path, JSON.stringify(safe) + '\n', { mode: 0o600 }); });
+        const pending = this.tail.then(async () => {
+            await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+            await appendFile(path, `${JSON.stringify(safe)}\n`, {
+                mode: 0o600,
+            });
+        });
         this.tail = pending.catch(() => { });
         await pending;
     }
-    async flush() { await this.tail; }
+    async flush() {
+        await this.tail;
+    }
 }
 //# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,UAA6B,EAAE;IAClE,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,YAAY,CAAC;SAC9D,OAAO,CAAC,yBAAyB,EAAE,cAAc,CAAC;SAClD,OAAO,CAAC,yGAAyG,EAAE,cAAc,CAAC;SAClI,OAAO,CAAC,gDAAgD,EAAE,YAAY,CAAC,CAAC;IAC3E,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,OAAO,QAAQ;IAEE;IAAwB;IADrC,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YAAqB,IAAa,EAAW,UAA6B,EAAE;QAAvD,SAAI,GAAJ,IAAI,CAAS;QAAW,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IACvE,OAAO,GAA6J,EAAE,CAAC;IAChL,KAAK,CAAC,YAAY,CAAC,MAAmB,EAAE,MAAoB;QAC1D,MAAM,MAAM,GAAgB,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,SAAS,EAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAC,iBAAiB,EAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAC,SAAS,EAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,CAAC;QAC5Q,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAoB;QACpF,8FAA8F;QAC9F,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAkB,CAAC;QAC5J,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpL,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;CAClD"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBpC,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,UAA6B,EAAE;IAChE,IAAI,IAAI,GAAG,IAAI;SACV,OAAO,CAAC,0BAA0B,EAAE,YAAY,CAAC;SACjD,OAAO,CAAC,yBAAyB,EAAE,cAAc,CAAC;SAClD,OAAO,CACJ,yGAAyG,EACzG,cAAc,CACjB;SACA,OAAO,CACJ,gDAAgD,EAChD,YAAY,CACf,CAAC;IACN,KAAK,MAAM,MAAM,IAAI,OAAO;QACxB,IAAI,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,MAAM,OAAO,QAAQ;IAGJ;IACA;IAHL,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,YACa,IAAa,EACb,UAA6B,EAAE;QAD/B,SAAI,GAAJ,IAAI,CAAS;QACb,YAAO,GAAP,OAAO,CAAwB;IACzC,CAAC;IACK,OAAO,GASV,EAAE,CAAC;IACT,KAAK,CAAC,YAAY,CACd,MAAmB,EACnB,MAAoB;QAEpB,MAAM,MAAM,GACR,YAAY,IAAI,MAAM;YAClB,CAAC,CAAC;gBACI,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU;gBACvC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB;gBACvD,SAAS,EAAE,MAAM,CACb,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,IAAI,CAAC,OAAO,CACf,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;aACnB;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,CAAC,MAAM,CACR,MAAmB,EACnB,KAAa,EACb,OAAe,EACf,MAAoB;QAEpB,8FAA8F;QAC9F,MAAM,MAAM,GAAG;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK;YACL,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACnB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CAC5C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAClE,CACa,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;gBAChD,IAAI,EAAE,KAAK;aACd,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,OAAO,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,KAAK;QACP,MAAM,IAAI,CAAC,IAAI,CAAC;IACpB,CAAC;CACJ"}