zyrk 0.8.1 → 0.8.2

package/README.md

@@ -131,6 +131,11 @@ zyrk install
 zyrk rebuild --offline             # rebuild the complete approved locked graph
 ```
 
+The review labels every exact source as `PENDING`, `APPROVED`, or `DENIED`,
+shows its lifecycle commands, and names the policy scope that made the decision.
+Review mode never runs package code. A mandatory deny cannot be selected and
+does not prevent a separate permitted source from being approved.
+
 Approvals are local to the exact graph, sources, patch contents, and script
 policy. Interactive selections are written to the checked-in
 `zyrk-workspace.json` file with exact package source identities, so collaborators

package/VERSION

@@ -1 +1 @@
-v0.8.1
+v0.8.2

package/dist/cli/build-approval.d.ts

@@ -0,0 +1,4 @@
+import type { BuildReview } from "../install/private.ts";
+/** Human review text only. It never executes package code or changes policy. */
+export declare function renderBuildReviews(reviews: readonly BuildReview[]): string;
+//# sourceMappingURL=build-approval.d.ts.map

package/dist/cli/build-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-approval.d.ts","sourceRoot":"","sources":["../../src/cli/build-approval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAsBzD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAW1E"}

package/dist/cli/build-approval.js

@@ -0,0 +1,31 @@
+import { redactSecrets } from "../log.js";
+const decisionLabel = {
+    approved: "APPROVED",
+    denied: "DENIED",
+    pending: "PENDING",
+};
+const scopeLabel = {
+    "user-deny": "mandatory user policy",
+    "project-deny": "project deny policy",
+    "project-policy": "project script policy",
+    "workspace-policy": "zyrk-workspace.json",
+    "local-session": "current graph approval",
+    none: "no approval recorded",
+};
+function safe(value) {
+    return redactSecrets(value).replace(/[\x00-\x1f\x7f-\x9f]/g, " ");
+}
+/** Human review text only. It never executes package code or changes policy. */
+export function renderBuildReviews(reviews) {
+    if (!reviews.length)
+        return "No dependency builds require approval.\n";
+    const entries = reviews
+        .map((review) => {
+        const stages = review.stages
+            .map((stage) => `    ${safe(stage.name)}: ${safe(stage.command)}`)
+            .join("\n");
+        return `${decisionLabel[review.decision]} ${safe(review.name)}@${safe(review.version)}\n  source: ${safe(review.sourceId)}\n  policy: ${scopeLabel[review.policyScope]}\n  lifecycle:\n${stages}`;
+    })
+        .join("\n\n");
+    return `Dependency build review (no package code ran)\n\n${entries}\n\nApprovals persist by exact source in zyrk-workspace.json. User and project denies take precedence.\nApproved scripts run with your OS account permissions; approval is not a sandbox.\n`;
+}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAmFzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0BhD;AA0MD,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAuDF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAqiBpE"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAe,SAAS,EAAe,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,CAAC;AACrB,OAAO,EAAoB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAmFzC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0BhD;AA0MD,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AA6EF;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnD,SAAS,CAgDX;AAmBD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACxC,CAAC;AAuDF,gFAAgF;AAChF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA0hBpE"}

package/dist/cli/main.js

@@ -1,5 +1,6 @@
 import { runNextCommand } from "../commands/next.js";
 import { createInstallProgress } from "./progress.js";
+import { renderBuildReviews } from "./build-approval.js";
 import { renderCommandError, renderCommandOutput } from "./terminal.js";
 import { runMaintenanceCommand } from "../commands/maintenance.js";
 import { runDeployCommand } from "../commands/deploy.js";
@@ -220,7 +221,7 @@ Example: zyrk audit --audit-level high`,
 Reconstruct project links from verified sources selected by the existing lockfile.`,
     "approve-builds": `Usage: zyrk approve-builds [package ... | --all]
 
-Review build candidates without running package code. Select exact candidates to persist approval, or use --all to approve every candidate shown.
+Review exact source identities, lifecycle commands, and current policy decisions without running package code. Selected approvals persist to zyrk-workspace.json; user and project denies take precedence. Approved scripts are not sandboxed.
 
 Example: zyrk approve-builds`,
     rebuild: `Usage: zyrk rebuild [--offline]
@@ -426,16 +427,16 @@ function readCliVersion() {
     }
 }
 async function promptForBuildApproval(builds, input, output) {
-    output.write("\nDependency lifecycle scripts need approval. Review these exact package sources:\n");
+    output.write("\nDependency build approval\nScripts run with your OS account permissions; approval is not a sandbox.\nSelected exact-source approvals are saved to zyrk-workspace.json for collaborators.\n\n");
     builds.forEach((build, index) => {
         const stages = build.stages
             .map((stage) => `${stage.name}: ${redactSecrets(stage.command)
             .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
             .slice(0, 180)}`)
             .join("; ");
-        output.write(`  ${index + 1}. ${build.name}@${build.version} (${build.sourceId}) — ${stages}\n`);
+        output.write(`  ${index + 1}. [ ] ${build.name}@${build.version}\n     source: ${build.sourceId}\n     lifecycle: ${stages}\n`);
     });
-    output.write("Enter numbers separated by commas to approve selected sources, `all` to approve all listed sources, or press Enter to skip their scripts and continue unbuilt.\n");
+    output.write("Enter numbers separated by commas to approve selected sources, `all` to approve all listed sources, or press Enter to skip pending scripts and continue intentionally unbuilt.\n");
     const prompt = createInterface({
         input,
         output: output,
@@ -616,6 +617,8 @@ export async function runCli(options) {
             const payload = (command === "audit" ? sanitizeDiagnostic(result) : result);
             if (Array.isArray(payload.builds))
                 payload.builds = sanitizeDiagnostic(payload.builds);
+            if (Array.isArray(payload.buildReviews))
+                payload.buildReviews = sanitizeDiagnostic(payload.buildReviews);
             const exitCode = payload.status === "unavailable" || payload.thresholdExceeded === true
                 ? 1
                 : 0;
@@ -626,15 +629,10 @@ export async function runCli(options) {
                     stderr: "",
                 });
             if (command === "approve-builds") {
-                const builds = (payload.builds ?? []);
+                const reviews = (payload.buildReviews ?? []);
                 return emit({
                     exitCode,
-                    stdout: builds.length
-                        ? builds
-                            .map((b) => `${b.name}@${b.version} ${b.sourceId}\n${b.stages.map((s) => `  ${s.name}: ${redactSecrets(s.command)}`).join("\n")}`)
-                            .join("\n") +
-                            "\nReview runs no package code. Approval trusts these exact candidate sources.\n"
-                        : "No dependency builds require approval.\n",
+                    stdout: renderBuildReviews(reviews),
                     stderr: "",
                 });
             }

package/dist/install/private.d.ts

@@ -12,6 +12,10 @@ export type BuildCandidate = {
         command: string;
     }>;
 };
+export type BuildReview = BuildCandidate & {
+    decision: "approved" | "denied" | "pending";
+    policyScope: "user-deny" | "project-deny" | "project-policy" | "workspace-policy" | "local-session" | "none";
+};
 export declare const WORKSPACE_POLICY_FILE = "zyrk-workspace.json";
 export declare function candidates(nodes: readonly ResolvedOccurrence[], dirs: ReadonlyMap<string, string>): Promise<BuildCandidate[]>;
 export declare function candidateDigest(graph: GraphDoc, builds: readonly BuildCandidate[], policy: unknown, patches: string): string;
@@ -24,13 +28,14 @@ export declare function approveCandidate(options: {
     policy?: unknown;
     portable?: boolean;
 }): Promise<void>;
-export declare function approvedCandidates(options: {
+export declare function reviewBuildCandidates(options: {
     project: string;
     env: NodeJS.ProcessEnv;
     digest: string;
     builds: readonly BuildCandidate[];
     policy: unknown;
-}): Promise<BuildCandidate[]>;
+}): Promise<BuildReview[]>;
+export declare function approvedCandidates(options: Parameters<typeof reviewBuildCandidates>[0]): Promise<BuildCandidate[]>;
 export declare function assertApproved(options: {
     project: string;
     env: NodeJS.ProcessEnv;

package/dist/install/private.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AACF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAe3D,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AA0ED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgC5B;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}
+{"version":3,"file":"private.d.ts","sourceRoot":"","sources":["../../src/install/private.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG;IACzC,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,WAAW,EACP,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,MAAM,CAAC;CACZ,CAAC;AACF,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAe3D,wBAAsB,UAAU,CAC9B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B;AAyBD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,MAAM,GACd,MAAM,CASR;AACD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AA0ED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAoDzB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,cAAc,EAAE,CAAC,CAI3B;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmGzB;AAID,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB"}

package/dist/install/private.js

@@ -88,25 +88,22 @@ export function candidateDigest(graph, builds, policy, patches) {
 }
 export async function approveCandidate(options) {
     const user = await readUserPolicy(options.env ?? process.env);
-    for (const build of options.builds)
-        if (denied(user.scripts, build) || denied(options.policy, build))
-            fail(`Build of ${build.name}@${build.version} is denied by policy.`);
     const selected = new Set(options.selected);
     const all = selected.has("*");
     for (const name of selected)
         if (name !== "*" &&
             !options.builds.some((b) => b.name === name || b.sourceId === name))
             fail("An approval selector does not match a reviewed build candidate.");
+    const selectedBuilds = options.builds.filter((build) => all || selected.has(build.name) || selected.has(build.sourceId));
+    const deniedSelections = selectedBuilds.filter((build) => denied(user.scripts, build) || denied(options.policy, build));
+    for (const build of deniedSelections)
+        fail(`Build of ${build.name}@${build.version} is denied by policy.`);
     await writeFileAtomic(path.join(options.project, ".zyrk-local", "approvals.json"), JSON.stringify({
         schemaVersion: 1,
         candidate: options.digest,
-        sources: options.builds
-            .filter((b) => all || selected.has(b.name) || selected.has(b.sourceId))
-            .map((b) => b.sourceId)
-            .sort(),
+        sources: selectedBuilds.map((build) => build.sourceId).sort(),
     }), { mode: 0o600 });
     if (options.portable) {
-        const selectedBuilds = options.builds.filter((build) => all || selected.has(build.name) || selected.has(build.sourceId));
         await writePortableApprovals(options.project, selectedBuilds);
     }
 }
@@ -164,7 +161,7 @@ async function readUserPolicy(env) {
         fail("Mandatory user build policy is malformed.");
     return user;
 }
-export async function approvedCandidates(options) {
+export async function reviewBuildCandidates(options) {
     if (!options.builds.length)
         return [];
     const user = await readUserPolicy(options.env);
@@ -181,9 +178,11 @@ export async function approvedCandidates(options) {
         local = undefined;
     }
     const portable = await readPortableApprovals(options.project);
-    return options.builds.filter((build) => {
-        if (denied(user.scripts, build) || denied(options.policy, build))
-            return false;
+    return options.builds.map((build) => {
+        if (denied(user.scripts, build))
+            return { ...build, decision: "denied", policyScope: "user-deny" };
+        if (denied(options.policy, build))
+            return { ...build, decision: "denied", policyScope: "project-deny" };
         const manifestAllowed = object(options.policy) &&
             Array.isArray(options.policy.allow) &&
             options.policy.allow.includes(build.sourceId);
@@ -193,9 +192,30 @@ export async function approvedCandidates(options) {
             local.candidate === options.digest &&
             Array.isArray(local.sources) &&
             local.sources.includes(build.sourceId);
-        return manifestAllowed || workspaceAllowed || localAllowed;
+        if (manifestAllowed)
+            return {
+                ...build,
+                decision: "approved",
+                policyScope: "project-policy",
+            };
+        if (workspaceAllowed)
+            return {
+                ...build,
+                decision: "approved",
+                policyScope: "workspace-policy",
+            };
+        if (localAllowed)
+            return {
+                ...build,
+                decision: "approved",
+                policyScope: "local-session",
+            };
+        return { ...build, decision: "pending", policyScope: "none" };
     });
 }
+export async function approvedCandidates(options) {
+    return (await reviewBuildCandidates(options)).filter((review) => review.decision === "approved");
+}
 export async function assertApproved(options) {
     const approved = await approvedCandidates(options);
     if (approved.length !== options.builds.length) {

package/dist/install/run.d.ts

@@ -62,6 +62,7 @@ export type InstallResult = {
     generationId?: string;
     candidateDigest?: string;
     builds?: BuildCandidate[];
+    buildReviews?: import("./private.ts").BuildReview[];
 };
 export declare function installProject(options: InstallOptions): Promise<InstallResult>;
 //# sourceMappingURL=run.d.ts.map

package/dist/install/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,CACrB,MAAM,EAAE,SAAS,cAAc,EAAE,KAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B,CAAC;AAuHF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAq0BxB"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/install/run.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA+B3C,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EACD,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,UAAU,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,CACrB,MAAM,EAAE,SAAS,cAAc,EAAE,KAC9B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EACL,OAAO,GACP,uBAAuB,GACvB,eAAe,GACf,SAAS,GACT,cAAc,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,cAAc,EAAE,WAAW,EAAE,CAAC;CACrD,CAAC;AAuHF,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAo1BxB"}

package/dist/install/run.js

@@ -4,7 +4,7 @@ import { findWorkspaceRoot } from "./workspaces.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { prepareRepair } from "./repair.js";
 import { createFetchOperation } from "../fetch/package.js";
-import { candidates, candidateDigest, approveCandidate, approvedCandidates, materializePrivate, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, reviewBuildCandidates, materializePrivate, buildPrivate, } from "./private.js";
 import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { registerGeneration } from "./metadata.js";
 import { randomId } from "../util/ids.js";
@@ -565,6 +565,13 @@ export async function installProject(options) {
                     policy: scriptPolicy(manifest),
                     portable: true,
                 });
+            const buildReviews = await reviewBuildCandidates({
+                project,
+                env: options.env ?? process.env,
+                digest: reviewedDigest,
+                builds,
+                policy: scriptPolicy(manifest),
+            });
             return {
                 readiness: "build-review",
                 packages: activeNodes.length,
@@ -572,6 +579,7 @@ export async function installProject(options) {
                 warnings,
                 candidateDigest: reviewedDigest,
                 builds,
+                buildReviews,
             };
         }
         let approvedBuilds = [];
@@ -583,11 +591,14 @@ export async function installProject(options) {
                 builds,
                 policy: scriptPolicy(manifest),
             };
-            approvedBuilds = await approvedCandidates(approvalOptions);
+            let reviews = await reviewBuildCandidates(approvalOptions);
+            approvedBuilds = reviews.filter((review) => review.decision === "approved");
             if (approvedBuilds.length < builds.length &&
                 options.requestBuildApproval) {
-                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
-                const selected = await options.requestBuildApproval(pending);
+                const pending = reviews.filter((review) => review.decision === "pending");
+                const selected = pending.length
+                    ? await options.requestBuildApproval(pending)
+                    : [];
                 if (selected.length) {
                     await approveCandidate({
                         project,
@@ -598,7 +609,8 @@ export async function installProject(options) {
                         policy: scriptPolicy(manifest),
                         portable: true,
                     });
-                    approvedBuilds = await approvedCandidates(approvalOptions);
+                    reviews = await reviewBuildCandidates(approvalOptions);
+                    approvedBuilds = reviews.filter((review) => review.decision === "approved");
                 }
             }
         }

package/dist/install/workspace-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqtBxB"}
+{"version":3,"file":"workspace-install.d.ts","sourceRoot":"","sources":["../../src/install/workspace-install.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuH9D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAouBxB"}

package/dist/install/workspace-install.js

@@ -32,7 +32,7 @@ import { loadProjectPatches, applyProjectPatches } from "../commands/patch.js";
 import { prepareRepair } from "./repair.js";
 import { assertSupportedSourcePayload } from "./source-policy.js";
 import { registerGeneration } from "./metadata.js";
-import { candidates, candidateDigest, approveCandidate, approvedCandidates, buildPrivate, } from "./private.js";
+import { candidates, candidateDigest, approveCandidate, reviewBuildCandidates, buildPrivate, } from "./private.js";
 const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const unsupported = (message) => {
     throw new ZyrkError("ZYRK_NOT_IMPLEMENTED", message, {
@@ -446,6 +446,13 @@ export async function installWorkspaceProject(options) {
                     policy,
                     portable: true,
                 });
+            const buildReviews = await reviewBuildCandidates({
+                project: root,
+                env: options.env ?? process.env,
+                digest,
+                builds,
+                policy,
+            });
             return {
                 readiness: "build-review",
                 packages: nodes.length,
@@ -453,6 +460,7 @@ export async function installWorkspaceProject(options) {
                 warnings,
                 candidateDigest: digest,
                 builds,
+                buildReviews,
             };
         }
         let approvedBuilds = [];
@@ -464,11 +472,14 @@ export async function installWorkspaceProject(options) {
                 builds,
                 policy,
             };
-            approvedBuilds = await approvedCandidates(approvalOptions);
+            let reviews = await reviewBuildCandidates(approvalOptions);
+            approvedBuilds = reviews.filter((review) => review.decision === "approved");
             if (approvedBuilds.length < builds.length &&
                 options.requestBuildApproval) {
-                const pending = builds.filter((build) => !approvedBuilds.some((item) => item.sourceId === build.sourceId));
-                const selected = await options.requestBuildApproval(pending);
+                const pending = reviews.filter((review) => review.decision === "pending");
+                const selected = pending.length
+                    ? await options.requestBuildApproval(pending)
+                    : [];
                 if (selected.length) {
                     await approveCandidate({
                         project: root,
@@ -479,7 +490,8 @@ export async function installWorkspaceProject(options) {
                         policy,
                         portable: true,
                     });
-                    approvedBuilds = await approvedCandidates(approvalOptions);
+                    reviews = await reviewBuildCandidates(approvalOptions);
+                    approvedBuilds = reviews.filter((review) => review.decision === "approved");
                 }
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zyrk",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Storage-efficient Node package manager: one verified store per user, shared across projects through links.",
   "license": "MIT",
   "type": "module",