pi-daddy 0.27.4 → 0.32.0

package/dist/approval-prompt.d.ts

@@ -1,119 +0,0 @@
-/**
- * The approval dialog — the only place a human enters the capability-governance path.
- *
- * Kept out of `extensions/grants.ts` deliberately: that file is wiring only, and this holds decisions
- * (what to offer, what a dismissal means, what happens with nobody watching) that must be testable
- * without pi. `ApprovalUI` is the minimal slice of pi's `ExtensionUIContext` needed here, so a test can
- * supply a plain object.
- *
- * Everything here denies on uncertainty. pi already agrees: in non-interactive modes it installs a
- * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
- */
-import { type ApprovalPath, type ApprovalScope } from "./approval.ts";
-import type { Capability } from "./resolve.ts";
-/** The slice of pi's `ExtensionUIContext` this module needs. */
-export interface ApprovalUI {
-    select(title: string, options: string[], opts?: {
-        timeout?: number;
-        signal?: AbortSignal;
-    }): Promise<string | undefined>;
-    notify(message: string, type?: "info" | "warning" | "error"): void;
-}
-export declare const DENY_LABEL = "Deny";
-export declare const SCOPE_LABELS: Record<ApprovalScope, string>;
-export interface PromptRequest {
-    capability: Capability;
-    /** Agent type name, or `DELEGATE_SUBJECT` on the delegate path. */
-    subject: string;
-    path: ApprovalPath;
-    /** Shown to the human for context. Never itself part of a key. */
-    task?: string;
-    /** Trusted exact-scope identity; bound requests single-flight only with an identical binding. */
-    bindingKey?: string;
-    signal?: AbortSignal;
-}
-/**
- * Which of the five outcomes a request produced.
- *
- * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
- * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
- * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
- * no; the other three are absence-of-signal, not a signal.
- */
-export declare const PROMPT_OUTCOME_KINDS: readonly ["granted", "declined", "dismissed", "no-ui", "error"];
-export type PromptOutcomeKind = typeof PROMPT_OUTCOME_KINDS[number];
-export interface PromptOutcome {
-    /** The scope the human chose, or null for any form of no. */
-    scope: ApprovalScope | null;
-    /** Which of the five outcomes this was. Set on every return path. */
-    kind: PromptOutcomeKind;
-    /** Why, when the answer was no. */
-    reason?: string;
-    /**
-     * True when this caller RODE another caller's answer rather than being asked (R-66).
-     *
-     * The single-flight queue shares any non-`once` outcome, which is right — a human approving
-     * `tool:bash` *for this session* authorised the capability, not one child. What is not right is
-     * recording the riders as though each had faced a dialog: the ledger's whole job is answering "did a
-     * human authorise this?", and a fan-out of eight wrote eight lines claiming a prompt where there was
-     * one. The rider's honest source is `session`, and this flag is how the caller can tell.
-     */
-    joined?: boolean;
-}
-export interface ApprovalGateOptions {
-    ui: ApprovalUI;
-    /** pi's `ctx.hasUI` — false in print/json mode, and therefore in every governed child. */
-    hasUI: boolean;
-    /** pi's `ctx.mode`, quoted back in the refusal so an operator can see why. */
-    mode: string;
-    timeoutMs?: number;
-}
-export interface ApprovalGate {
-    request(request: PromptRequest): Promise<PromptOutcome>;
-}
-/**
- * Read `PI_GRANTS_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
- *
- * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
- * interpretation of a value we do not understand.
- */
-export declare function timeoutMsFromEnv(raw: string | undefined): number | undefined;
-/**
- * The single-flight queue: one dialog per approval key at a time.
- *
- * `delegate` sets no `executionMode`, so an orchestrator can fan out several children at once and two can
- * hit the same gate simultaneously — otherwise two stacked dialogs asking the identical question.
- *
- * **R-29 — the key does two jobs, and only one of them may be shared.** `approvalKey` is
- * `capability@subject`, and on the delegate path the subject is the constant `DELEGATE_SUBJECT`, which is
- * deliberate: the only things naming a delegated child are the task and the tool list, both model-chosen,
- * and a key the model controls is not a key (`approval.ts:24-32`). That reasoning governs *approval
- * identity* — what a human said yes to, and what may be persisted — and it is right.
- *
- * It does **not** govern de-duplication. Sharing one dialog's outcome is correct for `session` and
- * `always`, which are genuinely answers about the session or the project, and for a decline or an error,
- * which answer everyone. It is **wrong for `once`**, which means *this spawn*. Measured before the fix:
- * four concurrent delegations gating `tool:bash`, one dialog, one click of *Allow once* → four `granted`
- * outcomes, with the human having seen only the first caller's task. That is a confused deputy, and it
- * falsified ADR-0014's decided property that "`once` stops at the boundary".
- */
-export type InFlightApprovals = Map<string, Promise<PromptOutcome>>;
-/**
- * Build gates that SHARE one single-flight queue.
- *
- * This exists because of how the wiring actually calls in. The gate's options depend on the per-call
- * `ExtensionContext` (`ui`, `hasUI`, `mode`), so the extension necessarily builds a gate per invocation —
- * and a gate that owns its queue privately therefore de-duplicates nothing across invocations, which is
- * exactly the case §6.1 exists for (two concurrent `delegate` calls are two separate invocations).
- *
- * The provider separates the two lifetimes: options stay per-call and fresh, the queue is created once and
- * lives as long as the provider. Preferred over a module-level map because that would be shared by every
- * gate in the process — including across tests — for no benefit.
- */
-export declare function createApprovalGateProvider(): (options: ApprovalGateOptions) => ApprovalGate;
-/**
- * @param inFlight optional shared single-flight queue — see `createApprovalGateProvider`. Defaults to one
- * private to this gate, which only de-duplicates requests made through this same gate object.
- */
-export declare function createApprovalGate(options: ApprovalGateOptions, inFlight?: InFlightApprovals): ApprovalGate;
-//# sourceMappingURL=approval-prompt.d.ts.map

package/dist/approval-prompt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-prompt.d.ts","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAChD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAItD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iEAAkE,CAAC;AACpG,MAAM,MAAM,iBAAiB,GAAG,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,iBAAiB,CAAC;IACxB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,UAAU,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5E;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,IAAI,CAAC,OAAO,EAAE,mBAAmB,KAAK,YAAY,CAG3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,iBAA6B,GACtC,YAAY,CAwEd"}

package/dist/approval-prompt.js

@@ -1,133 +0,0 @@
-/**
- * The approval dialog — the only place a human enters the capability-governance path.
- *
- * Kept out of `extensions/grants.ts` deliberately: that file is wiring only, and this holds decisions
- * (what to offer, what a dismissal means, what happens with nobody watching) that must be testable
- * without pi. `ApprovalUI` is the minimal slice of pi's `ExtensionUIContext` needed here, so a test can
- * supply a plain object.
- *
- * Everything here denies on uncertainty. pi already agrees: in non-interactive modes it installs a
- * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
- */
-import { approvalKey, offeredScopes } from "./approval.js";
-export const DENY_LABEL = "Deny";
-export const SCOPE_LABELS = {
-    once: "Allow once",
-    session: "Allow for this session",
-    always: "Always allow in this project (30 days)",
-};
-/**
- * Which of the five outcomes a request produced.
- *
- * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
- * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
- * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
- * no; the other three are absence-of-signal, not a signal.
- */
-export const PROMPT_OUTCOME_KINDS = ["granted", "declined", "dismissed", "no-ui", "error"];
-const DEFAULT_TIMEOUT_MS = 120_000;
-/**
- * Read `PI_GRANTS_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
- *
- * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
- * interpretation of a value we do not understand.
- */
-export function timeoutMsFromEnv(raw) {
-    if (raw === undefined)
-        return DEFAULT_TIMEOUT_MS;
-    const seconds = Number.parseInt(raw, 10);
-    if (!Number.isFinite(seconds) || seconds <= 0)
-        return undefined;
-    return seconds * 1000;
-}
-function labelToScope(label, scopes) {
-    return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
-}
-/**
- * Build gates that SHARE one single-flight queue.
- *
- * This exists because of how the wiring actually calls in. The gate's options depend on the per-call
- * `ExtensionContext` (`ui`, `hasUI`, `mode`), so the extension necessarily builds a gate per invocation —
- * and a gate that owns its queue privately therefore de-duplicates nothing across invocations, which is
- * exactly the case §6.1 exists for (two concurrent `delegate` calls are two separate invocations).
- *
- * The provider separates the two lifetimes: options stay per-call and fresh, the queue is created once and
- * lives as long as the provider. Preferred over a module-level map because that would be shared by every
- * gate in the process — including across tests — for no benefit.
- */
-export function createApprovalGateProvider() {
-    const inFlight = new Map();
-    return (options) => createApprovalGate(options, inFlight);
-}
-/**
- * @param inFlight optional shared single-flight queue — see `createApprovalGateProvider`. Defaults to one
- * private to this gate, which only de-duplicates requests made through this same gate object.
- */
-export function createApprovalGate(options, inFlight = new Map()) {
-    const ask = async (request) => {
-        const scopes = offeredScopes(request.path);
-        const title = `grants: approve ${request.capability} for ${request.subject}?` +
-            (request.task ? `\n  task: ${request.task}` : "");
-        let chosen;
-        try {
-            chosen = await options.ui.select(title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])], {
-                timeout: options.timeoutMs,
-                signal: request.signal,
-            });
-        }
-        catch (error) {
-            // A governance layer that errors must deny, not permit. This is a dialog malfunction, not a
-            // person's answer — `kind: "error"` keeps it out of "declined".
-            return { scope: null, kind: "error", reason: `approval dialog failed, denying (${String(error)})` };
-        }
-        // undefined covers dismissal, timeout, and abort. All are a no, but none is a person saying no.
-        if (chosen === undefined) {
-            return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was dismissed` };
-        }
-        if (chosen === DENY_LABEL) {
-            return { scope: null, kind: "declined", reason: `${request.capability} was denied by a human` };
-        }
-        const scope = labelToScope(chosen, scopes);
-        return scope === null
-            ? { scope: null, kind: "error", reason: `unrecognised approval choice ${JSON.stringify(chosen)}, denying` }
-            : { scope, kind: "granted" };
-    };
-    return {
-        async request(request) {
-            if (!options.hasUI) {
-                // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
-                // rather than being folded into "declined" (see PromptOutcomeKind).
-                return {
-                    scope: null,
-                    kind: "no-ui",
-                    reason: `${request.capability} requires approval and this session has no interactive user ` +
-                        `(mode: ${options.mode}). Pre-approve it in an interactive session, or drop it from the request.`,
-                };
-            }
-            const key = `${approvalKey(request.capability, request.subject)}${request.bindingKey ? `#${request.bindingKey}` : ""}`;
-            // R-29. Join an in-flight dialog, but only *keep* its answer if that answer was about more than one
-            // spawn. A `once` belongs to whichever caller the human was actually looking at — the title shows
-            // that caller's task — so anyone else who joined must ask their own question rather than ride a yes
-            // given for somebody else's work. The loop (rather than a single retry) covers the case where a
-            // fellow waiter started its own dialog first: we join that one instead of opening a third.
-            for (;;) {
-                const existing = inFlight.get(key);
-                if (!existing)
-                    break;
-                const outcome = await existing;
-                // **`joined` marks the rider, and the ledger depends on it (R-66).** Sharing a non-`once` outcome
-                // is correct — the human authorised the capability for the session, not for one child — but the
-                // caller then stamped `approvalSource: "prompt"` on every one of them, so a fan-out of eight wrote
-                // eight lines each asserting a human was prompted when exactly one was. That is R-46's defect at
-                // the concurrency level, and `ledger.ts` calls over-claiming in this direction "the worst available
-                // failure". Confirmed by execution: one dialog, eight `granted/session` outcomes.
-                if (outcome.scope !== "once")
-                    return { ...outcome, joined: true };
-            }
-            const pending = ask(request).finally(() => inFlight.delete(key));
-            inFlight.set(key, pending);
-            return pending;
-        },
-    };
-}
-//# sourceMappingURL=approval-prompt.js.map

package/dist/approval-prompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-prompt.js","sourceRoot":"","sources":["../src/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAyC,MAAM,eAAe,CAAC;AAalG,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,wBAAwB;IACjC,MAAM,EAAE,wCAAwC;CACjD,CAAC;AAcF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAmCpG,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,OAAO,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAuB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAuBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,QAAQ,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,WAA8B,IAAI,GAAG,EAAE;IAEvC,MAAM,GAAG,GAAG,KAAK,EAAE,OAAsB,EAA0B,EAAE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,GACT,mBAAmB,OAAO,CAAC,UAAU,QAAQ,OAAO,CAAC,OAAO,GAAG;YAC/D,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEpD,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3F,OAAO,EAAE,OAAO,CAAC,SAAS;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4FAA4F;YAC5F,gEAAgE;YAChE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtG,CAAC;QAED,gGAAgG;QAChG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,OAAO,CAAC,UAAU,gBAAgB,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,wBAAwB,EAAE,CAAC;QAClG,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3G,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,gGAAgG;gBAChG,oEAAoE;gBACpE,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,OAAO;oBACb,MAAM,EACJ,GAAG,OAAO,CAAC,UAAU,8DAA8D;wBACnF,UAAU,OAAO,CAAC,IAAI,2EAA2E;iBACpG,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAEvH,oGAAoG;YACpG,kGAAkG;YAClG,oGAAoG;YACpG,gGAAgG;YAChG,2FAA2F;YAC3F,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,MAAM;gBACrB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;gBAC/B,kGAAkG;gBAClG,gGAAgG;gBAChG,mGAAmG;gBACnG,iGAAiG;gBACjG,oGAAoG;gBACpG,kFAAkF;gBAClF,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;oBAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/approval-store.d.ts

@@ -1,149 +0,0 @@
-/**
- * Persistence for `always`-scoped approvals — the package's only mutable state outside the ledger.
- *
- * DESIGN NOTE, because it is easy to get backwards: this file is a CONVENIENCE CACHE, not a security
- * control. The security decision was already made by a human at the moment of approval. So a failure here
- * must never fail the work — an unwritable file downgrades the approval to session scope (see the boolean
- * return of `saveApproval`), and an unreadable one simply grants nothing.
- *
- * Read on demand, never cached at session start, so **a revoke takes effect at the next gate check** —
- * including a revoke performed from another session while this one is running.
- *
- * That sentence used to read *"takes effect immediately"* and claimed two different things, one of which was
- * false and one of which is impossible:
- *
- *  - **False, and fixed (R-49).** Every write is load → modify → write and it was unlocked, so a save could
- *    restore an entry another session had just revoked. Writes now hold the same file lock the ledger uses
- *    (`src/file-lock.ts`, `underLock` below).
- *  - **Impossible, and stated rather than fixed.** A spawn whose gate check has already passed is not
- *    retracted by a revoke arriving microseconds later. No lock closes that: the read has to finish before
- *    the spawn starts, so there is always an instant where the decision is made and the process is not yet
- *    running. Inherent to revoking anything, not a gap in this one.
- *
- * Reads deliberately take no lock. A read that loses a race sees the previous state, which is exactly what
- * "at the next gate check" already means.
- *
- * **One file per project** (ADR-0020), and **no model-authored text, ever** (ADR-0021) — see `approvalsPath`
- * and `sanitise` for why each of those is a decision rather than a detail.
- *
- * Pruning is deliberately lazy: `loadApprovals` never writes, so a read is a read. Invalid entries are
- * dropped from the file on the next `saveApproval` or `revokeApproval`.
- */
-import { type ApprovalEntry, type EntryVerdict, type SubjectSnapshot } from "./approval.ts";
-export interface DroppedApproval {
-    key: string;
-    entry: ApprovalEntry;
-    verdict: EntryVerdict;
-}
-/**
- * Look up a subject's current ceiling AND body digest; null when the subject no longer exists.
- *
- * One snapshot rather than two callbacks (ADR-0019) — see `SubjectSnapshot`. Was `CeilingLookup`, which
- * could only ever answer half the question `entryVerdict` needs to ask.
- */
-export type SubjectLookup = (subject: string) => SubjectSnapshot | null;
-/**
- * Where persisted approvals live — **outside the governed workspace** (ADR-0014).
- *
- * It used to be `<cwd>/.pi/grants-approvals.json`, which was self-defeating in this package's own
- * recommended configuration: `PI_GRANTS_GATED=tool:write` means *"may use write, may not pass it down
- * without a human"*, and **a session that may use `write` can write the approvals file**. A reviewer
- * demonstrated it end to end, including authoring a matching agent-type file so `grantAtApproval`
- * compared equal — no dialog, and a ledger line reading `approvalSource: "persisted"`, indistinguishable
- * from a real human approval.
- *
- * A narrowed child does not hold write access to the user's home directory, so it cannot forge an entry
- * here. Each entry still carries its own `cwd` and `entryVerdict` still checks it — that check exists for
- * R-27 and refuses an entry copied between checkouts or machines, which per-project files do not make
- * redundant.
- *
- * **This does not defend against a child holding `bash`** — see ADR-0012, which accepts that such a
- * child can escape governance entirely. The point of this change is to close the *self-defeating* case,
- * not to claim a boundary the package does not have.
- *
- * **ONE FILE PER PROJECT since 0.11.0 (ADR-0020).** It was one shared document keyed only by
- * `capability@subject`, which produced four defects in eight lines — approving in one checkout deleted
- * another's entries (R-41), `revoke --all` cleared every project (R-43), two concurrent writes lost both
- * (R-42), and an unlocked read-modify-write could resurrect a revoked entry (R-49, fixed in 0.13.0). The
- * unfixable one was the keyspace: two checkouts holding definitions of the same name — `review`, `deploy`,
- * i.e. what happens the moment an operator reuses their own conventions — could not both hold an approval,
- * so they took turns indefinitely. Per-project files make the collision **inexpressible** rather than
- * handled, and `revoke --all` cannot name another project's file.
- *
- * The `cwd` is hashed as well as named: the basename keeps the file legible to a human reading the
- * directory, and the hash is what makes it unambiguous, since two checkouts can share a basename.
- *
- * **It took a `cwd` parameter and ignored it until 0.10.2**, which was not a harmless vestige: the unit
- * suite passed a `mkdtemp` directory to it, reasonably believed the result was hermetic, and spent every
- * `npm test` rewriting and clearing the developer's real store in `$HOME` (R-40). That was invisible while
- * the store was unwritable and became destructive the day ADR-0019 made it reachable. The parameter is now
- * real and required, which is the opposite failure mode: forgetting it is a type error.
- */
-export declare function approvalsPath(cwd: string): string;
-/**
- * The shared single-file store, so it can be REPORTED rather than read (ADR-0020).
- *
- * Deliberately not migrated. Splitting it by each entry's own `cwd` would be mechanical and lossless — the
- * trust root is unchanged, unlike ADR-0014's move out of the workspace — but it is code that runs once, is
- * exercised on exactly one input per machine, and lives in the layer with nine recorded defects. Re-approving
- * costs a click; a migration bug costs a silently wrong approval.
- */
-export declare function sharedApprovalsPath(): string;
-/**
- * The old in-workspace location, so it can be REPORTED rather than read.
- *
- * Deliberately not migrated. Importing a legacy file would import exactly the entries whose
- * trustworthiness this change exists to remove — a forged approval would survive the fix that was
- * supposed to stop it. The extension names the file and ignores it; re-approving is a few keystrokes and
- * the only honest path.
- */
-export declare function legacyApprovalsPath(cwd: string): string;
-export interface LoadApprovalsInput {
-    cwd: string;
-    now: Date;
-    snapshotOf: SubjectLookup;
-}
-/** Load the approvals valid HERE and NOW, plus the ones that were dropped and why. */
-export declare function loadApprovals(input: LoadApprovalsInput): Promise<{
-    valid: Map<string, ApprovalEntry>;
-    dropped: DroppedApproval[];
-}>;
-/**
- * Persist one approval, pruning anything THIS session can see has become invalid.
- *
- * Returns false when the write failed. The caller must then downgrade to session scope and warn — NOT
- * refuse the delegation. The human already said yes; refusing work because a cache could not be written
- * would be failing closed on the wrong thing.
- */
-export declare function saveApproval(cwd: string, key: string, entry: ApprovalEntry, snapshotOf: SubjectLookup, now: Date): Promise<boolean>;
-/**
- * Remove one approval, pruning any entries that have since become invalid.
- *
- * Like `saveApproval`, this filters invalid entries so a revoke takes the opportunity to clean up stale
- * ones — the lazy-pruning policy applies to both write paths.
- *
- * **Three outcomes, not two (R-49).** It returned a boolean, and the caller printed
- * *"no persisted approval named X"* for false — which was a **false statement** whenever the cause was a
- * failed write. An operator told there is nothing to revoke, while the approval they are revoking survives,
- * has been told the opposite of the truth about a security control. `"absent"` and `"failed"` are different
- * facts and now say so.
- */
-/**
- * **Four, and the fourth is the first fix's own smaller copy of R-61.** `failed` asserts the approval is
- * still in effect, which is verified: we found the entry and could not remove it. A **lock timeout happens
- * before the load**, so nothing was ever looked at — reporting `failed` there asserted a fact about an entry
- * that may not exist, which is R-61's shape at lower severity. It errs alarming rather than reassuring, so
- * it is the safe direction to be wrong in; that is a reason to rank it low, not a reason to keep it.
- */
-export type RevokeOutcome = "revoked" | "absent" | "failed" | "busy";
-export declare function revokeApproval(cwd: string, key: string, snapshotOf: SubjectLookup, now: Date): Promise<RevokeOutcome>;
-/**
- * Clear every approval **for this directory**. Returns false if the write failed.
- *
- * Scoped rather than global, and the old behaviour was the surprising one: `/grants revoke --all` wrote an
- * empty file, so revoking in one project silently revoked every other project's approvals too. An operator
- * running it in one checkout is answering for that checkout — there is no interface for "and everywhere
- * else", and it should not be the default reading of a command that names neither.
- */
-export declare function revokeAll(cwd: string): Promise<boolean>;
-//# sourceMappingURL=approval-store.d.ts.map

package/dist/approval-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAQ1G,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,eAAe,GAAG,IAAI,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASjD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAqED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,IAAI,CAAC;IACV,UAAU,EAAE,aAAa,CAAC;CAC3B;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAwB5E;AA4CD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;;;;;;;GAWG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErE,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7D"}