@ai-dossier/core 1.12.1 → 1.13.0

package/dist/index.d.ts

@@ -39,6 +39,7 @@ export type { ConfigLayer as TraceConfigLayer, ResolvedTraceConfig, TraceConfigO
 export { resolveTraceConfig } from './trace-config';
 export type { DossierTraceInfo, StepInput as TraceStepInput, TraceInput, TraceRecorder, TraceRecorderOptions, TraceStatus, TraceUpdate, } from './trace-recorder';
 export { createTraceRecorder, VALID_TRACE_STATUSES } from './trace-recorder';
+export { isTrustedAuthorAssociation, TRUSTED_AUTHOR_ASSOCIATIONS } from './trusted-author';
 export * from './types';
 export { sha256Hash, sha256Hex } from './utils/crypto';
 export { getErrorMessage, getErrorStack } from './utils/errors';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE3F,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -27,7 +27,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseTrustedKeys = exports.loadTrustedKeys = exports.isKmsKeyIdentifier = exports.findTrustedIdentifier = exports.scanMarkdown = exports.scanDossierFile = exports.scanDossier = exports.SecurityRuleRegistry = exports.defaultSecurityRules = exports.buildReport = exports.runsLogPath = exports.assessVerificationRisk = exports.assessContentRisk = exports.validateFrontmatter = exports.VALID_STATUSES = exports.VALID_RISK_LEVELS = exports.REQUIRED_FIELDS = exports.RECOMMENDED_FIELDS = exports.parseDossierFile = exports.parseDossierContent = exports.loadLintConfig = exports.lintDossierFile = exports.lintDossier = exports.LintRuleRegistry = exports.defaultRules = exports.formatDossierFile = exports.formatDossierContent = exports.validateEvidence = exports.parseEvidence = exports.evidenceMatchesDossier = exports.EVIDENCE_SCHEMA_VERSION = exports.EVIDENCE_MAX_RATIONALE_CHARS = exports.EVIDENCE_MAX_BYTES = exports.createEvidenceRecord = exports.levelForScore = exports.DRY_RUN_SCHEMA_VERSION = exports.DRY_RUN_DISCLAIMER = exports.analyzeDryRun = exports.validateStepCoherence = exports.validateCoherence = exports.verifyIntegrity = exports.calculateChecksum = exports.usageParserFor = exports.SCHED_DISPATCH_EVENT = exports.parseOpenCodeUsage = exports.parseLastToolUse = exports.parseDispatchApiError = exports.parseAnnouncedWait = exports.parseAgentUsage = exports.isOpenCodeUsageStream = void 0;
-exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = exports.collectDeclaredUrls = exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpkiPem = exports.signatureCoverage = exports.publicKeysMatch = exports.normalizePublicKey = exports.isSupportedPublicKey = exports.canonicalizeFrontmatter = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.trustedKeysFromContent = exports.reportTrustedKeyProblems = void 0;
+exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = exports.collectDeclaredUrls = exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.TRUSTED_AUTHOR_ASSOCIATIONS = exports.isTrustedAuthorAssociation = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpkiPem = exports.signatureCoverage = exports.publicKeysMatch = exports.normalizePublicKey = exports.isSupportedPublicKey = exports.canonicalizeFrontmatter = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.trustedKeysFromContent = exports.reportTrustedKeyProblems = void 0;
 var agent_usage_1 = require("./agent-usage");
 Object.defineProperty(exports, "isOpenCodeUsageStream", { enumerable: true, get: function () { return agent_usage_1.isOpenCodeUsageStream; } });
 Object.defineProperty(exports, "parseAgentUsage", { enumerable: true, get: function () { return agent_usage_1.parseAgentUsage; } });
@@ -121,6 +121,10 @@ Object.defineProperty(exports, "resolveTraceConfig", { enumerable: true, get: fu
 var trace_recorder_1 = require("./trace-recorder");
 Object.defineProperty(exports, "createTraceRecorder", { enumerable: true, get: function () { return trace_recorder_1.createTraceRecorder; } });
 Object.defineProperty(exports, "VALID_TRACE_STATUSES", { enumerable: true, get: function () { return trace_recorder_1.VALID_TRACE_STATUSES; } });
+// Trusted comment-author check shared by every issue-artifact reader (#808)
+var trusted_author_1 = require("./trusted-author");
+Object.defineProperty(exports, "isTrustedAuthorAssociation", { enumerable: true, get: function () { return trusted_author_1.isTrustedAuthorAssociation; } });
+Object.defineProperty(exports, "TRUSTED_AUTHOR_ASSOCIATIONS", { enumerable: true, get: function () { return trusted_author_1.TRUSTED_AUTHOR_ASSOCIATIONS; } });
 // Type exports
 __exportStar(require("./types"), exports);
 // Crypto utilities

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;AAIH,6CASuB;AARrB,oHAAA,qBAAqB,OAAA;AACrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,oHAAA,qBAAqB,OAAA;AACrB,+GAAA,gBAAgB,OAAA;AAChB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AAEhB,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAYjD,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA;AAClB,iHAAA,sBAAsB,OAAA;AACtB,wGAAA,aAAa,OAAA;AAIf,uCAQoB;AAPlB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,wHAAA,4BAA4B,OAAA;AAC5B,mHAAA,uBAAuB,OAAA;AACvB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAGlB,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGlD,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AAYpB,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAId,yCAUqB;AATnB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,qHAAA,wBAAwB,OAAA;AACxB,mHAAA,sBAAsB,OAAA;AACtB,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AAEf,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAQ2B;AAPzB,qHAAA,kBAAkB,OAAA;AAClB,0HAAA,uBAAuB,OAAA;AACvB,uHAAA,oBAAoB,OAAA;AACpB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AASX,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;AAIH,6CASuB;AARrB,oHAAA,qBAAqB,OAAA;AACrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,oHAAA,qBAAqB,OAAA;AACrB,+GAAA,gBAAgB,OAAA;AAChB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AAEhB,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAYjD,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA;AAClB,iHAAA,sBAAsB,OAAA;AACtB,wGAAA,aAAa,OAAA;AAIf,uCAQoB;AAPlB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,wHAAA,4BAA4B,OAAA;AAC5B,mHAAA,uBAAuB,OAAA;AACvB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAGlB,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGlD,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AAYpB,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAId,yCAUqB;AATnB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,qHAAA,wBAAwB,OAAA;AACxB,mHAAA,sBAAsB,OAAA;AACtB,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AAEf,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAQ2B;AAPzB,qHAAA,kBAAkB,OAAA;AAClB,0HAAA,uBAAuB,OAAA;AACvB,uHAAA,oBAAoB,OAAA;AACpB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AASX,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,4EAA4E;AAC5E,mDAA2F;AAAlF,4HAAA,0BAA0B,OAAA;AAAE,6HAAA,2BAA2B,OAAA;AAChE,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}

package/dist/trusted-author.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Which issue-comment authors an artifact reader may act on (#808).
+ *
+ * `plan:v1` and `runstate:v1` artifacts are ordinary issue comments, so anyone who can
+ * comment can forge one. GitHub's `author_association` for the comment is the check every
+ * reader shares: repo OWNER, org MEMBER, or COLLABORATOR. It is a coarse "belongs to the
+ * project" signal, NOT a proof of write permission (a MEMBER need not have push access; a
+ * COLLABORATOR may be read/triage only) — it needs no extra API call and is what `gh issue
+ * view --json comments` already returns.
+ *
+ * GitHub's `CommentAuthorAssociation` has no BOT value, and a comment posted with a GitHub
+ * App / Actions token reports NONE or CONTRIBUTOR: such artifacts are NOT trusted. The
+ * fleet posts as the operator's own user (OWNER/MEMBER), so no allowlist is needed.
+ */
+export declare const TRUSTED_AUTHOR_ASSOCIATIONS: ReadonlySet<string>;
+/**
+ * True only for a string naming a trusted association. Fails closed: an absent field (a gh
+ * that does not report it) or any non-string is untrusted.
+ */
+export declare function isTrustedAuthorAssociation(value: unknown): boolean;
+//# sourceMappingURL=trusted-author.d.ts.map

package/dist/trusted-author.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-author.d.ts","sourceRoot":"","sources":["../src/trusted-author.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElE"}

package/dist/trusted-author.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRUSTED_AUTHOR_ASSOCIATIONS = void 0;
+exports.isTrustedAuthorAssociation = isTrustedAuthorAssociation;
+/**
+ * Which issue-comment authors an artifact reader may act on (#808).
+ *
+ * `plan:v1` and `runstate:v1` artifacts are ordinary issue comments, so anyone who can
+ * comment can forge one. GitHub's `author_association` for the comment is the check every
+ * reader shares: repo OWNER, org MEMBER, or COLLABORATOR. It is a coarse "belongs to the
+ * project" signal, NOT a proof of write permission (a MEMBER need not have push access; a
+ * COLLABORATOR may be read/triage only) — it needs no extra API call and is what `gh issue
+ * view --json comments` already returns.
+ *
+ * GitHub's `CommentAuthorAssociation` has no BOT value, and a comment posted with a GitHub
+ * App / Actions token reports NONE or CONTRIBUTOR: such artifacts are NOT trusted. The
+ * fleet posts as the operator's own user (OWNER/MEMBER), so no allowlist is needed.
+ */
+exports.TRUSTED_AUTHOR_ASSOCIATIONS = new Set([
+    'OWNER',
+    'MEMBER',
+    'COLLABORATOR',
+]);
+/**
+ * True only for a string naming a trusted association. Fails closed: an absent field (a gh
+ * that does not report it) or any non-string is untrusted.
+ */
+function isTrustedAuthorAssociation(value) {
+    return typeof value === 'string' && exports.TRUSTED_AUTHOR_ASSOCIATIONS.has(value);
+}
+//# sourceMappingURL=trusted-author.js.map

package/dist/trusted-author.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-author.js","sourceRoot":"","sources":["../src/trusted-author.ts"],"names":[],"mappings":";;;AAwBA,gEAEC;AA1BD;;;;;;;;;;;;;GAaG;AACU,QAAA,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IACtE,OAAO;IACP,QAAQ;IACR,cAAc;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,0BAA0B,CAAC,KAAc;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mCAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-dossier/core",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "description": "Parsing, verification, and signing for dossiers — portable, signed, versioned skills for any LLM tool.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",