@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/scripts/buildchain-cli-help.mjs

@@ -8,6 +8,11 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain architecture qualify --authority-revision <git-revision>
                                       [--candidate-revision <git-revision>]
                                       [--cwd <dir>] [--json]
+  buildchain adopter-delivery run --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery verify --input <json-or-path>
+                                      --readback <json-or-path> [--output <path>]
+  buildchain adopter-delivery bootstrap --input <json-or-path> [--output <path>]
+  buildchain adopter-delivery archive --input <json-or-path> [--output <path>]
   buildchain portable-cache plan --manifest <file-or-json> [--output <file>]
                                  [--github-output <file>] [--json]
   buildchain portable-cache receipt --plan <file-or-json> [--matched-key <key>]
@@ -44,6 +49,23 @@ export const BUILDCHAIN_USAGE = `Usage:
   buildchain release-tail init --declaration <json-or-path> [--state <path>]
   buildchain release-tail <status|verify> [--state <path>] [--output <path>]
   buildchain release-tail compat --hooks-json <json-or-path> [--output <path>]
+  buildchain release-tail rehearse --capsule <absolute-path>
+                                      --candidate-root <absolute-path>
+                                      --mode <simulate|replay>
+                                      --state <absolute-path>
+                                      --evidence <absolute-path>
+  buildchain tail-reseal plan --request <request.json> [--output <plan.json>]
+  buildchain tail-reseal admit --request <request.json> [--output <admission.json>]
+  buildchain tail-reseal verify-platform --request <request.json> --platform <id>
+                                      [--artifact-root <dir>] [--mode retained|resealed]
+                                      [--provider-readback-root <sha256:...>]
+                                      [--output <readback.json>]
+  buildchain tail-reseal seal --request <request.json> --plan <plan.json>
+                                      --readbacks <dir> --passport <passport.json>
+                                      --protected-readback-root <sha256:...>
+                                      [--output <receipt.json>]
+  buildchain next-development materialize --input <request.json> [--cwd <dir>]
+                                      [--write] [--output <path>] [--json]
   buildchain github-governance <plan|apply|rollback|protection-policy-plan|ruleset-policy-plan> ...
   buildchain release <inspect|recover|finalize|abort> ...
   buildchain transaction inspect ...
@@ -127,11 +149,20 @@ export const BUILDCHAIN_USAGE = `Usage:
                              [--from-config | --workflow <required-workflow.yml>...] [--cwd <dir>]
                              [--check-response-timeout-minutes <n>]
                              [--max-entries-to-build <n>] [--apply]
-  buildchain dev warrant <submit|select|heartbeat|recover|close|cancel-queued|observe>
+  buildchain dev warrant <submit|select|heartbeat|qualify|recover|close|settle|cancel-queued|observe>
                              --repository <owner/repo> --branch <dev/vN/vN.M>
                              [--execute] [--output <file>] [--json]
-  buildchain dev proof <source|verify-source|classify|replay|integration|verify-integration>
+  buildchain dev authority <migrate|submit|lease-qualification|heartbeat-qualification|complete-qualification|lease-landing|heartbeat-landing|recover|admit-merge-group|settle|observe>
+                             --repository <owner/repo> --branch <dev/vN/vN.M>
+                             [--environment-root <root>] [--qualification-domains <json>]
+                             [--provider-attempt <admitted-attempt.json>]
+                             [--execute] [--output <file>] [--json]
+  buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|integration|verify-integration>
                              [--output <file>] [--json]
+  buildchain dev two-phase --repository <owner/repo> --branch <dev/vN/vN.M>
+                             --pull-request <n> --expected-head <sha>
+                             --warrant-result <file> --native-command <command>
+                             [--native-proof <file>] [--output <file>] [--json]
   buildchain log <info|warn|error> --event <name> [--phase <phase>]
                  [--component <name>] [--source <name>] [--attribute key=value]...
                  [--path <jsonl>] [--json]
@@ -145,6 +176,14 @@ export const BUILDCHAIN_USAGE = `Usage:
                              [--module-fact <file>]... [--artifact <path>]...
                              [--output <file>] [--json]
   buildchain facts verify [--cwd <dir>] --fact <file> [--json]
+  buildchain facts compatibility project [--cwd <dir>] [--registry <json-or-path>]
+                                      [--output <file>] [--json]
+  buildchain facts compatibility verify [--cwd <dir>] [--registry <json-or-path>] [--json]
+  buildchain facts compatibility query --query <json-or-path>
+                                      [--registry <json-or-path>] [--cwd <dir>] [--json]
+  buildchain facts compatibility query-template --fact-root <sha256:...>
+                                      [--query-id <id>] [--registry <json-or-path>]
+                                      [--cwd <dir>] [--json]
   buildchain kfd ...
   buildchain kfd hub <init|inspect|test|explain> [--cwd <dir>]
                      [--declaration <path>] [--output-dir <path>]

package/scripts/check-ci-lane-change-budget.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { execFileSync } from "node:child_process";
+import { evaluateCiLaneChangeBudget } from "../packages/core/ci-lane-change-budget.js";
+
+const root = process.cwd();
+const workflowRoot = path.join(root, ".github", "workflows");
+const policyPath = path.join(
+  root,
+  "architecture",
+  "ci-lane-change-budget.json",
+);
+
+const workflows = fs
+  .readdirSync(workflowRoot, { withFileTypes: true })
+  .filter((entry) => entry.isFile() && /\.(?:yaml|yml)$/u.test(entry.name))
+  .map((entry) => {
+    const workflowPath = path.posix.join(".github/workflows", entry.name);
+    return {
+      path: workflowPath,
+      text: fs.readFileSync(path.join(workflowRoot, entry.name), "utf8"),
+    };
+  })
+  .sort((left, right) => left.path.localeCompare(right.path));
+
+const policy = JSON.parse(fs.readFileSync(policyPath, "utf8"));
+const baselineRevision = String(policy.baseline?.gitRevision || "").trim();
+if (!/^[0-9a-f]{40}$/u.test(baselineRevision)) {
+  throw new Error("baseline.gitRevision must be an exact Git commit");
+}
+const embeddedBaselineLanes = policy.baseline?.lanes;
+if (
+  !Array.isArray(embeddedBaselineLanes) ||
+  embeddedBaselineLanes.length === 0
+) {
+  throw new Error("baseline.lanes must contain the exact offline lane set");
+}
+const embeddedLaneSetRoot = `sha256:${crypto
+  .createHash("sha256")
+  .update(`${JSON.stringify(embeddedBaselineLanes)}\n`)
+  .digest("hex")}`;
+if (embeddedLaneSetRoot !== policy.baseline?.laneSetRoot) {
+  throw new Error("baseline laneSetRoot does not match baseline.lanes");
+}
+
+let baselineWorkflows = null;
+try {
+  execFileSync("git", ["cat-file", "-e", `${baselineRevision}^{commit}`], {
+    cwd: root,
+    stdio: "ignore",
+  });
+  const baselinePaths = execFileSync(
+    "git",
+    [
+      "ls-tree",
+      "-r",
+      "--name-only",
+      baselineRevision,
+      "--",
+      ".github/workflows",
+    ],
+    { cwd: root, encoding: "utf8" },
+  )
+    .split(/\r?\n/u)
+    .filter((value) => /\.(?:yaml|yml)$/u.test(value))
+    .sort();
+  baselineWorkflows = baselinePaths.map((workflowPath) => ({
+    path: workflowPath,
+    text: execFileSync("git", ["show", `${baselineRevision}:${workflowPath}`], {
+      cwd: root,
+      encoding: "utf8",
+    }),
+  }));
+} catch {
+  // Shallow and exported source cuts may not contain the pinned commit object.
+  // The content-rooted embedded lane set remains the exact offline authority.
+}
+
+const embeddedEvaluation = evaluateCiLaneChangeBudget({
+  policy,
+  workflows,
+});
+const evaluation = baselineWorkflows
+  ? evaluateCiLaneChangeBudget({ policy, workflows, baselineWorkflows })
+  : embeddedEvaluation;
+if (
+  baselineWorkflows &&
+  (evaluation.baselineLaneCount !== embeddedEvaluation.baselineLaneCount ||
+    JSON.stringify(evaluation.newLanes) !==
+      JSON.stringify(embeddedEvaluation.newLanes))
+) {
+  throw new Error(
+    "embedded baseline lanes do not match the pinned baseline revision",
+  );
+}
+process.stdout.write(`${JSON.stringify(evaluation, null, 2)}\n`);
+if (!evaluation.ok) process.exitCode = 1;

package/scripts/check-inventory.mjs

@@ -54,6 +54,10 @@ const requiredPaths = [
   "packages/core/homebrew.js",
   "packages/core/artifact-verification-envelope.js",
   "packages/core/anchored-version-material.js",
+  "packages/core/next-development-transition.js",
+  "packages/core/next-development-controller.js",
+  "packages/core/next-development-candidate-reservation.js",
+  "packages/core/next-development-projection.js",
   "packages/core/build-facts.js",
   "packages/core/publication-package.js",
   "packages/core/publication-reproducibility.js",
@@ -76,6 +80,8 @@ const requiredPaths = [
   "docs/auditable-demo.md",
   "contracts/auditable-demo-scenario-v1.schema.json",
   "contracts/release-candidate-recovery-v1.schema.json",
+  "contracts/next-development-request-v1.schema.json",
+  "contracts/next-development-transition-v1.schema.json",
   "contracts/auditable-demo-media-profiles-v1.json",
   "contracts/evidence/auditable-demo-web-delivery-v1.json",
   "contracts/evidence/auditable-demo-responsive-web-delivery-v1.json",
@@ -87,10 +93,15 @@ const requiredPaths = [
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/public-projection.json",
   "contracts/fixtures/auditable-demo-responsive-web-delivery-v1/scene.json",
   "docs/release-propagation.md",
+  "docs/next-development-transition.md",
   "docs/site-bundle-contract.md",
   "docs/toolkit-observability.md",
   "docs/versioning.md",
   "scripts/release-line-dry-run.mjs",
+  "scripts/next-development-transition.mjs",
+  "scripts/next-development-self-dogfood.mjs",
+  "scripts/next-development-self-dogfood-harness.mjs",
+  "scripts/generate-next-development-guidance.mjs",
   "scripts/reconcile-release-governance.mjs",
   "scripts/buildchain-channel-router.mjs",
   "scripts/generate-channel-build-workflow.mjs",
@@ -1010,16 +1021,16 @@ for (const forbiddenSnippet of [
 for (const requiredSnippet of [
   "id-token: write",
   "actions: write",
-  "uses: ./.github/workflows/.release-candidate-promote.yml",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4-alpha",
   "github.event.workflow_run.event == 'push'",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): prepare v')",
   "!startsWith(github.event.workflow_run.display_title, 'chore(release): release v')",
   "resume-candidate-run-id:",
   "resume-expected-source-tree:",
   "resume-buildchain-runtime-sha:",
-  "github-release: true",
+  "uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4",
   "release-passport-buildchain-self-kfd: true",
-  "artifact-patterns: ${{ startsWith(github.event.workflow_run.head_branch || inputs['target-ref'], 'alpha/') && 'buildchain-package-*' || '' }}",
+  "buildchain-channel: alpha",
   "release-passport-impact-json: .buildchain/release-impact.json",
 ]) {
   if (!buildchainRefPromotionWorkflow.includes(requiredSnippet)) {

package/scripts/check-v4-floating-consumer-policy-contract.mjs

@@ -6,7 +6,6 @@ import { parseYamlUses } from "../packages/core/workflow-yaml-contract.js";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const read = (relative) => fs.readFileSync(path.join(root, relative), "utf8");
-
 function fail(message) {
   throw new Error(`v4-floating-consumer-policy-contract: ${message}`);
 }
@@ -53,8 +52,13 @@ function assertOrdered(relative, markers) {
 
 export function assertPromotionCertificationWiring(source) {
   for (const marker of [
-    ".buildchain/runtime/promotion-shell/scripts/v4-consumer-policy.mjs certify",
-    '--caller-root "${{ github.workspace }}"',
+    "path: .buildchain/runtime/candidate-policy-runtime",
+    "BUILDCHAIN_EXPECTED_RUNTIME_SHA: ${{ steps.v4-policy-caller.outputs.runtime-sha }}",
+    "policy_runtime=.buildchain/runtime",
+    'node "${policy_runtime}/scripts/v4-consumer-policy.mjs" certify',
+    "passport.consumerPolicy?.receipt?.caller?.sourceSha",
+    "path: .buildchain/runtime/policy-caller",
+    '--caller-root "${{ github.workspace }}/.buildchain/runtime/policy-caller"',
     '--stable-lock "${{ inputs.buildchain-stable-contract-lock-path }}"',
     '--alpha-lock "${{ inputs.buildchain-alpha-contract-lock-path }}"',
     "release-passport-v4-consumer-policy-certification-root: ${{ steps.v4-policy-certification.outputs.v4-consumer-policy-certification-root }}",
@@ -79,13 +83,22 @@ function assertPersistedSelectors() {
       );
       if (!match) continue;
       const selector = match[2];
+      const protectedBootstrap =
+        relative ===
+          ".github/workflows/buildchain-ref-promotion-recovery.yml" &&
+        match[1] === ".github/workflows/.release-candidate-promote.yml" &&
+        selector === "alpha/v4/v4.0";
       const isV4 =
         selector === "v4" ||
         selector === "v4-alpha" ||
         /^v4(?:[./-]|$)/u.test(selector) ||
         /^[0-9a-f]{40}$/iu.test(selector) ||
         selector.includes("${{");
-      if (isV4 && !["v4", "v4-alpha"].includes(selector)) {
+      if (
+        (isV4 || protectedBootstrap) &&
+        !["v4", "v4-alpha"].includes(selector) &&
+        !protectedBootstrap
+      ) {
         offenders.push(`${relative}:${node.line} @${selector}`);
       }
     }
@@ -113,6 +126,12 @@ export function checkV4FloatingConsumerPolicyContract() {
     "Enforce v4 floating consumer policy",
     "Validate consumer package manager contract",
   ]);
+  if (
+    !read(".github/workflows/.build.yml").includes(
+      "BUILDCHAIN_EXPECTED_INVOCATION_CHANNEL: ${{ inputs.buildchain-expected-channel }}",
+    )
+  )
+    fail("channel builds must disambiguate dual-channel caller invocations");
   assertTrustGatedJobs(read(".github/workflows/.build.yml"), [
     "resolve-source",
     "resolve-contract",

package/scripts/dev-alpha-candidate-patrol.mjs

@@ -20,6 +20,7 @@ import {
   candidateFromDecision,
   selectLatestQualifiedSource,
 } from "../packages/core/dev-alpha-candidate-selection.js";
+import { readGitHubNextDevelopmentVersionReservation } from "../packages/core/next-development-candidate-reservation.js";
 
 export { reconcileActiveReleaseTrain, selectLatestQualifiedSource };
 
@@ -617,6 +618,7 @@ export async function runDevAlphaCandidatePatrol(
     comparison,
     workflowEvidence,
     skippedNewerCommitCount,
+    versionReservation,
     qualificationError,
   } = await resolvePatrolSourceInputs({
     client,
@@ -646,6 +648,7 @@ export async function runDevAlphaCandidatePatrol(
           observedSourceHeadSha,
           skippedNewerCommitCount,
           ...(targetBaseline ? { targetBaseline } : {}),
+          ...(versionReservation ? { versionReservation } : {}),
         },
         workflowEvidence,
         requiredWorkflowPaths,
@@ -992,6 +995,20 @@ export function createGitHubChannelCandidateClient({
         targetBranch,
         parseCandidate: managedCandidateFromPullRequest,
       }),
+    async readNextDevelopmentVersionReservation({
+      reservationSha,
+      candidateSha,
+      targetVersion,
+    }) {
+      return readGitHubNextDevelopmentVersionReservation({
+        api,
+        owner,
+        repo,
+        reservationSha,
+        candidateSha,
+        targetVersion,
+      });
+    },
     async listCompletedWorkflowRuns(workflowPathValue, sourceBranch) {
       const runs = [];
       for (let page = 1; page <= 10; page += 1) {
@@ -1015,7 +1032,11 @@ export function createGitHubChannelCandidateClient({
         for (const commit of rows) {
           const commitSha = text(commit.sha);
           if (commitSha === targetSha) return commits;
-          commits.push(commitSha);
+          commits.push({
+            sha: commitSha,
+            message: text(commit.commit?.message),
+            parents: (commit.parents || []).map((parent) => text(parent.sha)),
+          });
         }
         if (rows.length < 100) return commits;
       }

package/scripts/dev-delivery-authority-command-adapters.mjs

@@ -0,0 +1,206 @@
+import fs from "node:fs";
+import path from "node:path";
+import {
+  acquireDevDeliveryLandingWarrant,
+  acquireDevDeliveryQualificationLease,
+  admitDevDeliveryMergeGroup,
+  completeDevDeliveryQualification,
+  heartbeatDevDeliveryLandingWarrantWithGitHubProvider,
+  heartbeatDevDeliveryQualificationLease,
+  migrateDevDeliveryAuthorityState,
+  observeDevDeliveryAuthorityState,
+  recoverDevDeliveryAuthority,
+  submitDevDeliveryAuthorityCandidate,
+} from "../packages/core/dev-delivery-authority-landing.js";
+import { createNativeCommandContract } from "../packages/core/dev-delivery-warrant.js";
+import { settleDevDeliveryAuthorityWithProvider } from "./dev-delivery-authority-provider.mjs";
+
+function identity(options) {
+  return {
+    candidateId: options.candidateId,
+    token: options.authorityToken,
+    generation: options.authorityGeneration,
+  };
+}
+
+function rootedList(value) {
+  if (Array.isArray(value)) return value;
+  let parsed;
+  try {
+    parsed = JSON.parse(value || "[]");
+  } catch (cause) {
+    throw new Error(
+      `qualification domains must be a JSON array: ${cause.message}`,
+    );
+  }
+  if (!Array.isArray(parsed))
+    throw new Error("qualification domains must be a JSON array");
+  return parsed;
+}
+
+function migrateAuthority(state, options) {
+  if (!options.migrationSource?.exists) {
+    throw new Error("migrate requires the live v1 authority state ref");
+  }
+  return migrateDevDeliveryAuthorityState(options.migrationSource.queue, {
+    now: options.now,
+    policy: options.authorityPolicy,
+  });
+}
+
+function submitCandidate(state, options) {
+  const nativeCommandContract = options.environmentRoot
+    ? options.nativeCommandContract ||
+      createNativeCommandContract(options.nativeCommand)
+    : undefined;
+  if (
+    options.nativeCommandRoot &&
+    nativeCommandContract?.commandRoot !== options.nativeCommandRoot
+  ) {
+    throw new Error(
+      "native command contract root does not match native-command",
+    );
+  }
+  return submitDevDeliveryAuthorityCandidate(
+    state,
+    {
+      pullRequestNumber: options.pullRequestNumber,
+      sourceHead: options.sourceHead,
+      assignmentRoot: options.assignmentRoot,
+      initiativeRoot: options.initiativeRoot,
+      sourceIdentityRoot: options.sourceIdentityRoot,
+      sourcePatchRoot: options.sourcePatchRoot,
+      sourceProofRoot: options.sourceProofRoot,
+      planRoot: options.planRoot,
+      closureRoot: options.closureRoot,
+      dependencyRoot: options.dependencyRoot,
+      toolchainRoot: options.toolchainRoot,
+      environmentRoot: options.environmentRoot,
+      nativeCommandContract,
+      affectedPaths: rootedList(options.affectedPaths),
+      shardEvidenceRoots: rootedList(options.shardEvidenceRoots),
+      deliveryClass: options.deliveryClass,
+      qualificationDomains: rootedList(options.qualificationDomains),
+    },
+    { now: options.now },
+  );
+}
+
+const commandAdapters = {
+  migrate: migrateAuthority,
+  submit: submitCandidate,
+  "lease-qualification": (state, options) =>
+    acquireDevDeliveryQualificationLease(state, {
+      now: options.now,
+      leaseSeconds: options.leaseSeconds,
+    }),
+  "complete-qualification": (state, options) =>
+    completeDevDeliveryQualification(state, identity(options), {
+      sourceProof: options.sourceProof,
+      nativeProof: options.nativeProof,
+      qualificationContract: options.qualificationContract,
+      now: options.now,
+    }),
+  "heartbeat-qualification": (state, options) =>
+    heartbeatDevDeliveryQualificationLease(state, identity(options), {
+      now: options.now,
+      leaseSeconds: options.leaseSeconds,
+    }),
+  "lease-landing": (state, options) =>
+    acquireDevDeliveryLandingWarrant(state, {
+      now: options.now,
+      leaseSeconds: options.leaseSeconds,
+    }),
+  "heartbeat-landing": (state, options) =>
+    heartbeatDevDeliveryLandingWarrantWithGitHubProvider(
+      state,
+      identity(options),
+      {
+        providerAttempt: options.providerAttempt,
+        token: options.token || process.env.GITHUB_TOKEN,
+        apiUrl:
+          options.apiUrl ||
+          process.env.GITHUB_API_URL ||
+          "https://api.github.com",
+        now: options.now,
+        leaseSeconds: options.leaseSeconds,
+      },
+    ),
+  recover: (state, options) =>
+    recoverDevDeliveryAuthority(state, { now: options.now }),
+  "admit-merge-group": (state, options) =>
+    admitDevDeliveryMergeGroup(state, identity(options), {
+      mergeGroupHead: options.mergeGroupHead,
+      providerRunId: options.providerRunId,
+      providerRunAttempt: options.providerRunAttempt,
+      token: options.token || process.env.GITHUB_TOKEN,
+      apiUrl:
+        options.apiUrl ||
+        process.env.GITHUB_API_URL ||
+        "https://api.github.com",
+      now: options.now,
+    }),
+  settle: settleDevDeliveryAuthorityWithProvider,
+};
+
+function readCommandDocuments(options) {
+  for (const [field, file] of [
+    ["sourceProof", options.sourceProofPath],
+    ["nativeProof", options.nativeProofPath],
+    ["qualificationContract", options.qualificationContractPath],
+    ["providerAttempt", options.providerAttemptPath],
+  ]) {
+    if (file)
+      options[field] = JSON.parse(fs.readFileSync(path.resolve(file), "utf8"));
+  }
+}
+
+export async function runDevDeliveryAuthorityCommandAdapter(loaded, options) {
+  const loadedV2 =
+    loaded.exists &&
+    loaded.queue?.contract === "kungfu-buildchain-dev-delivery-authority" &&
+    Number(loaded.queue?.schemaVersion) === 2;
+  if (options.command === "migrate" && loadedV2) {
+    throw new Error("migration target state ref already exists");
+  }
+  if (options.command !== "migrate" && !loadedV2) {
+    throw new Error(
+      "v2 authority state is missing; explicitly migrate the exact current v1 state before mutation",
+    );
+  }
+  if (
+    options.expectedOldStateRoot &&
+    loaded.queue.stateRoot !== options.expectedOldStateRoot
+  ) {
+    throw new Error(
+      `expected-old state drift: ${loaded.queue.stateRoot} != ${options.expectedOldStateRoot}`,
+    );
+  }
+  if (options.command === "observe") {
+    return {
+      result: {
+        schema: "kungfu.buildchain.dev-delivery-authority-command-result/v1",
+        ok: true,
+        mode: "observe",
+        stateRef: options.stateRef,
+        stateCommit: loaded.commitSha,
+        observation: observeDevDeliveryAuthorityState(loaded.queue, {
+          now: options.now,
+        }),
+      },
+    };
+  }
+  readCommandDocuments(options);
+  if (options.command === "heartbeat-landing" && !options.providerAttempt) {
+    throw new Error(
+      "heartbeat-landing requires --provider-attempt with the exact persisted admitted attempt",
+    );
+  }
+  const adapter = commandAdapters[options.command];
+  if (!adapter) {
+    throw new Error(
+      `unsupported dev authority command ${options.command || "<empty>"}`,
+    );
+  }
+  return { changed: await adapter(loaded.queue, options) };
+}

package/scripts/dev-delivery-authority-provider.mjs

@@ -0,0 +1,28 @@
+import { settleDevDeliveryAuthorityCandidateWithGitHubProvider } from "../packages/core/dev-delivery-authority-landing.js";
+
+export function settleDevDeliveryAuthorityWithProvider(state, options) {
+  return settleDevDeliveryAuthorityCandidateWithGitHubProvider(
+    state,
+    {
+      pullRequestNumber: options.pullRequestNumber,
+      sourceHead: options.sourceHead,
+      outcome: options.outcome,
+      evidenceRoot: options.evidenceRoot,
+      reason: options.reason,
+      authorityToken: options.authorityToken,
+      authorityGeneration: options.authorityGeneration,
+      transferRoot: options.transferRoot,
+      finalizerBoundaryRoot: options.finalizerBoundaryRoot,
+      nativeJobId: options.nativeJobId,
+      sealJobId: options.sealJobId,
+    },
+    {
+      now: options.now,
+      token: options.token || process.env.GITHUB_TOKEN,
+      apiUrl:
+        options.apiUrl ||
+        process.env.GITHUB_API_URL ||
+        "https://api.github.com",
+    },
+  );
+}