verbolab 0.1.0-alpha.1

package/dist/src/approval/approval-server.js

@@ -0,0 +1,90 @@
+import http from 'http';
+// ---- Factory ----
+export async function createApprovalServer(options) {
+    let yoloMode = false;
+    const pollInterval = options.pollIntervalMs ?? 500;
+    const timeout = options.timeoutMs ?? 300000;
+    // Helper: build Claude Code PreToolUse hook response
+    function hookResponse(decision, reason) {
+        return {
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: decision,
+                permissionDecisionReason: reason,
+            },
+        };
+    }
+    const server = http.createServer(async (req, res) => {
+        if (req.method === 'POST' && req.url === '/hooks') {
+            // Read body
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const body = JSON.parse(Buffer.concat(chunks).toString());
+            // YOLO mode: auto-approve everything
+            if (yoloMode) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(hookResponse('allow', 'YOLO mode')));
+                return;
+            }
+            // If sessions store is available, only gate Verbo-managed agents.
+            // Unknown agents (e.g. user's own Claude Code) get auto-approved
+            // so we don't block them with phantom approval requests.
+            if (options.sessions) {
+                const sessionId = body.session_id;
+                const isVerboAgent = sessionId && options.sessions.get(sessionId) !== null;
+                if (!isVerboAgent) {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(hookResponse('allow', 'Not a Verbo-managed agent')));
+                    return;
+                }
+            }
+            // Create approval request from Claude Code hook payload
+            const approval = options.approvals.create({
+                agentName: body.agent_type || body.agent_id || body.session_id || 'unknown',
+                agentSessionId: body.session_id || undefined,
+                toolName: body.tool_name || 'unknown',
+                toolInput: body.tool_input || {},
+            });
+            // Terminal bell: human action requested
+            process.stderr.write('\x07');
+            // Poll until resolved or timeout
+            const startTime = Date.now();
+            while (Date.now() - startTime < timeout) {
+                // Re-check YOLO in case it was toggled after this request arrived
+                if (yoloMode) {
+                    options.approvals.approve(approval.id);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(hookResponse('allow', 'YOLO mode')));
+                    return;
+                }
+                const current = options.approvals.get(approval.id);
+                if (current && current.status !== 'pending') {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(hookResponse(current.status === 'approved' ? 'allow' : 'deny', current.status === 'approved' ? 'Approved in Verbo' : 'Denied in Verbo')));
+                    return;
+                }
+                await new Promise(resolve => setTimeout(resolve, pollInterval));
+            }
+            // Timeout: deny by default
+            options.approvals.deny(approval.id);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(hookResponse('deny', 'Approval timed out')));
+        }
+        else {
+            // Health check or unknown route
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ status: 'ok', yoloMode }));
+        }
+    });
+    // Start server
+    await new Promise(resolve => server.listen(options.port, '127.0.0.1', resolve));
+    const address = server.address();
+    return {
+        port: () => address.port,
+        isYoloMode: () => yoloMode,
+        setYoloMode: (enabled) => { yoloMode = enabled; },
+        stop: () => new Promise(resolve => server.close(() => resolve())),
+    };
+}
+//# sourceMappingURL=approval-server.js.map

package/dist/src/approval/approval-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-server.js","sourceRoot":"","sources":["../../../src/approval/approval-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAqBxB,oBAAoB;AAEpB,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA8B;IACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE5C,qDAAqD;IACrD,SAAS,YAAY,CAAC,QAA0B,EAAE,MAAc;QAC9D,OAAO;YACL,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,QAAQ;gBAC5B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,YAAY;YACZ,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE1D,qCAAqC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,kEAAkE;YAClE,iEAAiE;YACjE,yDAAyD;YACzD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;gBAClC,MAAM,YAAY,GAAG,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;gBAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC;oBAC5E,OAAO;gBACT,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS;gBAC3E,cAAc,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;gBAC5C,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;gBACrC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;aACjC,CAAC,CAAC;YAEH,wCAAwC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE7B,iCAAiC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;gBACxC,kEAAkE;gBAClE,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;oBAC5D,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CACjC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAChD,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,CACxE,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,2BAA2B;YAC3B,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC;IAErD,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI;QACxB,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ;QAC1B,WAAW,EAAE,CAAC,OAAgB,EAAE,EAAE,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/src/approval/approval-store.d.ts

@@ -0,0 +1,29 @@
+import type { VerboDatabase } from '../db/database.js';
+export interface ApprovalRequest {
+    id: string;
+    agentSessionId: string | null;
+    agentName: string;
+    toolName: string;
+    toolInput: Record<string, unknown>;
+    status: 'pending' | 'approved' | 'denied';
+    createdAt: string;
+    resolvedAt: string | null;
+}
+export interface CreateApprovalInput {
+    agentSessionId?: string;
+    agentName: string;
+    toolName: string;
+    toolInput: Record<string, unknown>;
+}
+export interface ApprovalStore {
+    create(input: CreateApprovalInput): ApprovalRequest;
+    get(id: string): ApprovalRequest | null;
+    approve(id: string): ApprovalRequest;
+    deny(id: string): ApprovalRequest;
+    listPending(): ApprovalRequest[];
+    listResolved(limit?: number): ApprovalRequest[];
+    deleteBySession(agentSessionId: string): void;
+    cleanup(): void;
+}
+export declare function createApprovalStore(db: VerboDatabase): ApprovalStore;
+//# sourceMappingURL=approval-store.d.ts.map

package/dist/src/approval/approval-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../../../src/approval/approval-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,CAAC;IACpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAAC;IACrC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAAC;IAClC,WAAW,IAAI,eAAe,EAAE,CAAC;IACjC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CAAC;IAChD,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,OAAO,IAAI,IAAI,CAAC;CACjB;AAgCD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,aAAa,GAAG,aAAa,CAsGpE"}

package/dist/src/approval/approval-store.js

@@ -0,0 +1,94 @@
+import { ulid } from 'ulid';
+// ---- Helper: row -> ApprovalRequest ----
+function rowToApproval(row) {
+    return {
+        id: row.id,
+        agentSessionId: row.agent_session_id,
+        agentName: row.agent_name,
+        toolName: row.tool_name,
+        toolInput: JSON.parse(row.tool_input ?? '{}'),
+        status: row.status,
+        createdAt: row.created_at,
+        resolvedAt: row.resolved_at,
+    };
+}
+// ---- Factory ----
+export function createApprovalStore(db) {
+    const raw = db.raw();
+    const stmtInsert = raw.prepare(`
+    INSERT INTO approval_requests (
+      id, agent_session_id, agent_name, tool_name, tool_input,
+      status, created_at, resolved_at
+    ) VALUES (
+      @id, @agent_session_id, @agent_name, @tool_name, @tool_input,
+      @status, @created_at, @resolved_at
+    )
+  `);
+    const stmtGetById = raw.prepare('SELECT * FROM approval_requests WHERE id = ?');
+    const stmtListPending = raw.prepare("SELECT * FROM approval_requests WHERE status = 'pending' ORDER BY created_at ASC");
+    const stmtResolve = raw.prepare(`
+    UPDATE approval_requests
+    SET status = @status, resolved_at = @resolved_at
+    WHERE id = @id
+  `);
+    const stmtCleanup = raw.prepare("DELETE FROM approval_requests WHERE status != 'pending'");
+    const stmtListResolved = raw.prepare("SELECT * FROM approval_requests WHERE status IN ('approved', 'denied') ORDER BY resolved_at DESC LIMIT ?");
+    const stmtDeleteBySession = raw.prepare("DELETE FROM approval_requests WHERE agent_session_id = ? AND status = 'pending'");
+    function create(input) {
+        const now = new Date().toISOString();
+        const id = ulid();
+        const row = {
+            id,
+            agent_session_id: input.agentSessionId ?? null,
+            agent_name: input.agentName,
+            tool_name: input.toolName,
+            tool_input: JSON.stringify(input.toolInput),
+            status: 'pending',
+            created_at: now,
+            resolved_at: null,
+        };
+        stmtInsert.run(row);
+        return get(id);
+    }
+    function get(id) {
+        const row = stmtGetById.get(id);
+        if (!row)
+            return null;
+        return rowToApproval(row);
+    }
+    function approve(id) {
+        const now = new Date().toISOString();
+        stmtResolve.run({ id, status: 'approved', resolved_at: now });
+        return get(id);
+    }
+    function deny(id) {
+        const now = new Date().toISOString();
+        stmtResolve.run({ id, status: 'denied', resolved_at: now });
+        return get(id);
+    }
+    function listPending() {
+        const rows = stmtListPending.all();
+        return rows.map(rowToApproval);
+    }
+    function listResolved(limit = 50) {
+        const rows = stmtListResolved.all(limit);
+        return rows.map(rowToApproval);
+    }
+    function deleteBySession(agentSessionId) {
+        stmtDeleteBySession.run(agentSessionId);
+    }
+    function cleanup() {
+        stmtCleanup.run();
+    }
+    return {
+        create,
+        get,
+        approve,
+        deny,
+        listPending,
+        listResolved,
+        deleteBySession,
+        cleanup,
+    };
+}
+//# sourceMappingURL=approval-store.js.map

package/dist/src/approval/approval-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../../../src/approval/approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA+C5B,2CAA2C;AAE3C,SAAS,aAAa,CAAC,GAAuB;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,cAAc,EAAE,GAAG,CAAC,gBAAgB;QACpC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,MAAmC;QAC/C,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC;AACJ,CAAC;AAED,oBAAoB;AAEpB,MAAM,UAAU,mBAAmB,CAAC,EAAiB;IACnD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IAErB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC;;;;;;;;GAQ9B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CACjC,kFAAkF,CACnF,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;;;;GAI/B,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAC7B,yDAAyD,CAC1D,CAAC;IAEF,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAClC,0GAA0G,CAC3G,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CACrC,iFAAiF,CAClF,CAAC;IAEF,SAAS,MAAM,CAAC,KAA0B;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG;YACV,EAAE;YACF,gBAAgB,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC9C,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,IAAI;SAClB,CAAC;QAEF,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,EAAE,CAAE,CAAC;IAClB,CAAC;IAED,SAAS,GAAG,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAmC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,OAAO,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,OAAO,GAAG,CAAC,EAAE,CAAE,CAAC;IAClB,CAAC;IAED,SAAS,IAAI,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,EAAE,CAAE,CAAC;IAClB,CAAC;IAED,SAAS,WAAW;QAClB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAA0B,CAAC;QAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,YAAY,CAAC,KAAK,GAAG,EAAE;QAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAyB,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,eAAe,CAAC,cAAsB;QAC7C,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,OAAO;QACd,WAAW,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM;QACN,GAAG;QACH,OAAO;QACP,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,eAAe;QACf,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/src/auth/auth-store.d.ts

@@ -0,0 +1,18 @@
+export interface AuthLimits {
+    maxAgents: number;
+    maxTasks: number;
+    maxProjects: number;
+}
+export interface AuthSession {
+    token: string;
+    userId: string;
+    email: string;
+    plan: 'free' | 'pro';
+    limits: AuthLimits;
+    cachedAt: string;
+}
+export declare function readSession(): AuthSession | null;
+export declare function writeSession(session: AuthSession): void;
+export declare function clearSession(): void;
+export declare function isSessionFresh(session: AuthSession): boolean;
+//# sourceMappingURL=auth-store.d.ts.map

package/dist/src/auth/auth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../../src/auth/auth-store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,wBAAgB,WAAW,IAAI,WAAW,GAAG,IAAI,CAQhD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,wBAAgB,YAAY,IAAI,IAAI,CAGnC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAE5D"}

package/dist/src/auth/auth-store.js

@@ -0,0 +1,34 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+function authFilePath() {
+    return path.join(os.homedir(), '.verbo', 'auth.json');
+}
+export function readSession() {
+    const file = authFilePath();
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSession(session) {
+    const file = authFilePath();
+    const dir = path.dirname(file);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(session, null, 2), 'utf-8');
+}
+export function clearSession() {
+    const file = authFilePath();
+    if (fs.existsSync(file))
+        fs.unlinkSync(file);
+}
+export function isSessionFresh(session) {
+    return Date.now() - new Date(session.cachedAt).getTime() < CACHE_TTL_MS;
+}
+//# sourceMappingURL=auth-store.js.map

package/dist/src/auth/auth-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../../src/auth/auth-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAiBxB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAgB,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC;AAC1E,CAAC"}

package/dist/src/auth/device-code-client.d.ts

@@ -0,0 +1,32 @@
+import type { AuthSession } from './auth-store.js';
+export declare const AUTH_API_URL: string;
+export interface JwtPayload {
+    sub: string;
+    email: string;
+    [key: string]: unknown;
+}
+/**
+ * Decode the payload segment of a JWT without verifying the signature.
+ * Verification is the server's responsibility — the client only needs the claims.
+ */
+export declare function decodeJwtPayload(token: string): JwtPayload;
+export interface CompletedPollResult {
+    status: 'completed';
+    token: string;
+    userId: string;
+    email: string;
+    plan: 'free' | 'pro';
+    limits: {
+        max_agents: number;
+        max_tasks: number;
+        max_projects: number;
+    };
+}
+export interface PendingPollResult {
+    status: 'pending' | 'expired';
+}
+export type PollResult = PendingPollResult | CompletedPollResult;
+export declare function requestDeviceCode(): Promise<string>;
+export declare function pollDeviceCode(code: string): Promise<PollResult>;
+export declare function toAuthSession(result: CompletedPollResult): Omit<AuthSession, 'cachedAt'>;
+//# sourceMappingURL=device-code-client.d.ts.map

package/dist/src/auth/device-code-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-client.d.ts","sourceRoot":"","sources":["../../../src/auth/device-code-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,eAAO,MAAM,YAAY,QACsC,CAAC;AAMhE,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAK1D;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEjE,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAKzD;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAItE;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,mBAAmB,GAC1B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAa/B"}

package/dist/src/auth/device-code-client.js

@@ -0,0 +1,41 @@
+import { Buffer } from 'node:buffer';
+export const AUTH_API_URL = process.env.VERBO_AUTH_URL ?? 'https://orchestra.verbolab.co';
+/**
+ * Decode the payload segment of a JWT without verifying the signature.
+ * Verification is the server's responsibility — the client only needs the claims.
+ */
+export function decodeJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new Error('Invalid JWT: expected 3 segments');
+    const json = Buffer.from(parts[1], 'base64url').toString('utf-8');
+    return JSON.parse(json);
+}
+export async function requestDeviceCode() {
+    const res = await fetch(`${AUTH_API_URL}/api/device-code`, { method: 'POST' });
+    if (!res.ok)
+        throw new Error(`Failed to request device code: ${res.status}`);
+    const { code } = (await res.json());
+    return code;
+}
+export async function pollDeviceCode(code) {
+    const res = await fetch(`${AUTH_API_URL}/api/device-code?code=${code}`);
+    if (!res.ok)
+        throw new Error(`Poll failed: ${res.status}`);
+    return (await res.json());
+}
+export function toAuthSession(result) {
+    const jwt = decodeJwtPayload(result.token);
+    return {
+        token: result.token,
+        userId: jwt.sub,
+        email: jwt.email,
+        plan: result.plan,
+        limits: {
+            maxAgents: result.limits.max_agents,
+            maxTasks: result.limits.max_tasks,
+            maxProjects: result.limits.max_projects,
+        },
+    };
+}
+//# sourceMappingURL=device-code-client.js.map

package/dist/src/auth/device-code-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-client.js","sourceRoot":"","sources":["../../../src/auth/device-code-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,CAAC,MAAM,YAAY,GACvB,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,+BAA+B,CAAC;AAYhE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;AACxC,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAA2B;IAE3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,GAAG,CAAC,GAAG;QACf,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE;YACN,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;YACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;YACjC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;SACxC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/auth/plan-enforcer.d.ts

@@ -0,0 +1,8 @@
+import type { AuthLimits } from './auth-store.js';
+export type { AuthLimits };
+export type LimitKey = 'maxAgents' | 'maxTasks' | 'maxProjects';
+export declare function checkLimit(key: LimitKey, currentCount: number, limits: AuthLimits): {
+    allowed: boolean;
+    message?: string;
+};
+//# sourceMappingURL=plan-enforcer.d.ts.map

package/dist/src/auth/plan-enforcer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-enforcer.d.ts","sourceRoot":"","sources":["../../../src/auth/plan-enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAWhE,wBAAgB,UAAU,CACxB,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAKxC"}

package/dist/src/auth/plan-enforcer.js

@@ -0,0 +1,14 @@
+const MESSAGES = {
+    maxAgents: (n) => `Free plan allows ${n} agents. Upgrade at verbolab.co/upgrade`,
+    maxTasks: (n) => `Free plan allows ${n} tasks. Upgrade at verbolab.co/upgrade`,
+    maxProjects: (n) => `Free plan allows ${n} projects. Upgrade at verbolab.co/upgrade`,
+};
+export function checkLimit(key, currentCount, limits) {
+    const limit = limits[key];
+    if (limit === -1)
+        return { allowed: true };
+    if (currentCount < limit)
+        return { allowed: true };
+    return { allowed: false, message: MESSAGES[key](limit) };
+}
+//# sourceMappingURL=plan-enforcer.js.map

package/dist/src/auth/plan-enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-enforcer.js","sourceRoot":"","sources":["../../../src/auth/plan-enforcer.ts"],"names":[],"mappings":"AAKA,MAAM,QAAQ,GAA4C;IACxD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,oBAAoB,CAAC,yCAAyC;IAChE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,oBAAoB,CAAC,wCAAwC;IAC/D,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAAC,2CAA2C;CACnE,CAAC;AAEF,MAAM,UAAU,UAAU,CACxB,GAAa,EACb,YAAoB,EACpB,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,YAAY,GAAG,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/src/commands/audit.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import type { AuditLogStore } from '../core/audit-log-store.js';
+export interface AuditCommandDeps {
+    auditLog: AuditLogStore;
+}
+export declare function registerAuditCommand(program: Command, getDeps: () => AuditCommandDeps): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/src/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAgC,MAAM,4BAA4B,CAAC;AAI9F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,CAAC;CACzB;AAID,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,GAAG,IAAI,CA6F5F"}

package/dist/src/commands/audit.js

@@ -0,0 +1,92 @@
+// ---- CLI command registration ----
+export function registerAuditCommand(program, getDeps) {
+    const audit = program
+        .command('audit')
+        .description('View and export the audit log');
+    // ---- verbo audit list ----
+    audit
+        .command('list')
+        .description('List audit log entries with optional filters')
+        .option('-e, --event-type <type>', 'Filter by event type (e.g. task.created)')
+        .option('-h, --human-id <id>', 'Filter by human ID')
+        .option('-t, --task-id <id>', 'Filter by task ID')
+        .option('-s, --since <timestamp>', 'Show entries since timestamp (ISO or YYYY-MM-DD)')
+        .option('-u, --until <timestamp>', 'Show entries until timestamp (ISO or YYYY-MM-DD)')
+        .option('-n, --limit <count>', 'Maximum number of entries to show', '50')
+        .action((opts) => {
+        const { auditLog } = getDeps();
+        const limit = parseInt(opts.limit, 10) || 50;
+        const filter = {};
+        if (opts.eventType)
+            filter.eventType = opts.eventType;
+        if (opts.humanId)
+            filter.humanId = opts.humanId;
+        if (opts.taskId)
+            filter.taskId = opts.taskId;
+        if (opts.since)
+            filter.since = normalizeTimestamp(opts.since);
+        if (opts.until)
+            filter.until = normalizeTimestamp(opts.until);
+        const entries = auditLog.query(filter);
+        if (entries.length === 0) {
+            console.log('No audit entries found.');
+            return;
+        }
+        const limited = entries.slice(0, limit);
+        console.log(`Audit log (${limited.length}${entries.length > limit ? ` of ${entries.length}` : ''} entries):\n`);
+        for (const entry of limited) {
+            const ts = entry.timestamp.slice(0, 19).replace('T', ' ');
+            const actor = entry.humanId ?? entry.agentSessionId ?? '-';
+            const detailStr = Object.keys(entry.details).length > 0
+                ? `  ${JSON.stringify(entry.details)}`
+                : '';
+            console.log(`  ${ts}  ${padRight(entry.eventType, 24)}  ${padRight(actor, 16)}${detailStr}`);
+        }
+        if (entries.length > limit) {
+            console.log(`\n  … ${entries.length - limit} more entries (use --limit to show more)`);
+        }
+    });
+    // ---- verbo audit export ----
+    audit
+        .command('export')
+        .description('Export audit log entries as JSON or CSV')
+        .option('-e, --event-type <type>', 'Filter by event type')
+        .option('-h, --human-id <id>', 'Filter by human ID')
+        .option('-t, --task-id <id>', 'Filter by task ID')
+        .option('-s, --since <timestamp>', 'Show entries since timestamp (ISO or YYYY-MM-DD)')
+        .option('-u, --until <timestamp>', 'Show entries until timestamp (ISO or YYYY-MM-DD)')
+        .option('-f, --format <format>', 'Export format: json or csv', 'json')
+        .action((opts) => {
+        const { auditLog } = getDeps();
+        const format = opts.format.toLowerCase();
+        if (format !== 'json' && format !== 'csv') {
+            console.error(`Invalid format: ${opts.format}. Must be "json" or "csv".`);
+            process.exit(1);
+        }
+        const filter = {};
+        if (opts.eventType)
+            filter.eventType = opts.eventType;
+        if (opts.humanId)
+            filter.humanId = opts.humanId;
+        if (opts.taskId)
+            filter.taskId = opts.taskId;
+        if (opts.since)
+            filter.since = normalizeTimestamp(opts.since);
+        if (opts.until)
+            filter.until = normalizeTimestamp(opts.until);
+        const output = auditLog.export(filter, format);
+        console.log(output);
+    });
+}
+// ---- Helpers ----
+function normalizeTimestamp(input) {
+    // If it looks like a date-only string (YYYY-MM-DD), append midnight UTC
+    if (/^\d{4}-\d{2}-\d{2}$/.test(input)) {
+        return `${input}T00:00:00.000Z`;
+    }
+    return input;
+}
+function padRight(str, len) {
+    return str.length >= len ? str : str + ' '.repeat(len - str.length);
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/commands/audit.ts"],"names":[],"mappings":"AASA,qCAAqC;AAErC,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAA+B;IACpF,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,6BAA6B;IAC7B,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,yBAAyB,EAAE,0CAA0C,CAAC;SAC7E,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SACnD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,yBAAyB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,yBAAyB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,qBAAqB,EAAE,mCAAmC,EAAE,IAAI,CAAC;SACxE,MAAM,CAAC,CAAC,IAOR,EAAE,EAAE;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAE7C,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACtD,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAExC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAChH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBACrD,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,MAAM,GAAG,KAAK,0CAA0C,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,+BAA+B;IAC/B,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;SACzD,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SACnD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,yBAAyB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,yBAAyB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,CAAC;SACrE,MAAM,CAAC,CAAC,IAOR,EAAE,EAAE;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAkB,CAAC;QACzD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACtD,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,oBAAoB;AAEpB,SAAS,kBAAkB,CAAC,KAAa;IACvC,wEAAwE;IACxE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,gBAAgB,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC"}

package/dist/src/commands/team.d.ts

@@ -0,0 +1,48 @@
+import { Command } from 'commander';
+import type { RbacStore, Role } from '../core/rbac.js';
+import type { AuditLogStore } from '../core/audit-log-store.js';
+import type Database from 'better-sqlite3';
+export interface TeamMemberRow {
+    human_id: string;
+    role: Role;
+    created_at: string;
+    updated_at: string;
+}
+export interface RoleChangeRow {
+    id: string;
+    target_human_id: string;
+    changed_by: string;
+    old_role: string | null;
+    new_role: string;
+    reason: string | null;
+    created_at: string;
+}
+export interface TeamEntry {
+    humanId: string;
+    role: Role;
+}
+/**
+ * Parse a `## Team` section from VERBO.md content.
+ *
+ * Expected format:
+ * ```
+ * ## Team
+ * alice: owner
+ * bob: lead
+ * carol: developer
+ * dave: viewer
+ * ```
+ */
+export declare function parseTeamSection(verboMdContent: string): TeamEntry[];
+/**
+ * Seed team_members from the `## Team` section of VERBO.md.
+ * Only inserts members that don't already exist — never overwrites.
+ */
+export declare function bootstrapTeamFromVerboMd(db: Database.Database, verboMdContent: string): number;
+export interface TeamCommandDeps {
+    db: Database.Database;
+    rbacStore: RbacStore;
+    auditLog?: AuditLogStore;
+}
+export declare function registerTeamCommand(program: Command, getDeps: () => TeamCommandDeps): void;
+//# sourceMappingURL=team.d.ts.map

package/dist/src/commands/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../../src/commands/team.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;CACZ;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,EAAE,CAyBpE;AAID;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,cAAc,EAAE,MAAM,GACrB,MAAM,CA8BR;AAID,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,GAAG,IAAI,CA2H1F"}