@rosthq/cli 0.7.116 → 0.7.118

package/README.md

@@ -31,6 +31,28 @@ rost runner serve --once
 
 Node does not have a separate registry to register with. `npx` and `npm i -g` resolve from registry.npmjs.org, so `npm publish --access public` is the public registration step.
 
+## Public implementation Skill (v0 preview)
+
+The installer fetches a signed release from GitHub and turns a general-purpose agent into a mode-aware ROST implementer. Regular mode is available today.
+
+```bash
+rost skills install-implementation --client claude-code
+rost skills install-implementation --client codex
+rost skills install-implementation --client cursor
+# Or without a prior install:
+npx @rosthq/cli@latest skills install-implementation --client codex
+```
+
+What the installer verifies before any file is used:
+
+1. The annotated release tag is signed against the CLI-held trust root.
+2. The manifest's repository owner matches the trusted source.
+3. The manifest checksum matches the pinned default release, when available.
+4. Every fetched file matches its manifest checksum.
+5. The release's skill protocol range is compatible with this CLI version.
+
+v0 preview: Full Operator external-effect handoff is not yet available and activates only through live capability discovery.
+
 ## Reference corpus
 
 The CLI includes the public implementation reference corpus for local agents and operators:
@@ -41,3 +63,45 @@ rost reference search "agent tools"
 rost reference get agent-reference-map
 pnpm --filter @rosthq/cli dev -- reference get agent-reference-map
 ```
+
+## Implementation access (agent-led setup)
+
+A local setup agent can run under a bounded, owner-approved implementation credential instead of the human operator's personal session. This is useful when an external agent (Claude Code, Codex, Cursor, or another headless shell) is driving onboarding on a separate machine.
+
+There are two credential families:
+
+- **Human operator session** — the ordinary Supabase session created by `rost login` or `rost login --device`. It is stored in the user credential slot (OS keychain or the owner-only file store with `ROST_CLI_ALLOW_FILE_TOKEN_STORE=1`). An interactive human operator can approve their own confirmations in a TTY.
+- **Implementation credential** — a short-lived, run-bound `rost_impl_` bearer minted only after a human owner approves the device-code flow at `/auth/device`. It is stored in a separate implementation-bootstrap slot (`implementation-bootstrap` account / `implementation-bootstrap.json`), never in the user session slot.
+
+Start a bounded implementation run:
+
+```bash
+npx @rosthq/cli@latest implementation access start --source-client claude-code
+npx @rosthq/cli@latest implementation access start --source-client codex
+npx @rosthq/cli@latest implementation access start --source-client cursor
+```
+
+Check, complete, or abandon the run:
+
+```bash
+rost implementation access status
+rost implementation access complete
+rost implementation access abandon
+```
+
+Read onboarding state and resume context:
+
+```bash
+rost onboard status
+rost onboard resume
+```
+
+Register the same `rost_impl_` bearer with an MCP client. This uses the bearer directly; there is no `mcp_token.create` step and no second token:
+
+```bash
+rost implementation access install-mcp --client claude-code
+rost implementation access install-mcp --client codex
+rost implementation access install-mcp --client cursor
+```
+
+The implementation credential is intentionally narrow and fail-closed. It can run vetted reads (for example `onboarding.status`, `graph.get`, `charter.get/list`, `compass.get_current`, `goal.list`, `agent.list_fleet`, `system.health`), stage human-gated drafts (`agent.create_custom`, `agent.create_from_template`, `compass.set`, `compass.approve_version`, `onboarding.finish`), and close its own run. Everything else, including direct durable mutations and `confirmation.approve`, is denied. The policy module is `packages/commands/src/implementation-bootstrap-policy.ts` and is enforced by both the runtime guard and a CI drift test.

package/dist/cli-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-version.d.ts","sourceRoot":"","sources":["../src/cli-version.ts"],"names":[],"mappings":"AA0BA,wBAAsB,cAAc,CAClC,eAAe,GAAE,MAAM,GAAG,SAAuF,GAChH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}
+{"version":3,"file":"cli-version.d.ts","sourceRoot":"","sources":["../src/cli-version.ts"],"names":[],"mappings":"AA2BA,wBAAsB,cAAc,CAClC,eAAe,GAAE,MAAM,GAAG,SAAuF,GAChH,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}

package/dist/command-client.d.ts

@@ -28,12 +28,15 @@ export declare class CommandClientError extends Error {
 export type CommandClientOptions = {
     appUrl: string;
     token: string;
+    credentialKind: "user_session" | "implementation_bootstrap";
     fetchImpl?: typeof fetch;
 };
 export declare class CommandClient {
     private readonly appUrl;
     private readonly token;
     private readonly fetchImpl;
+    private readonly _credentialKind;
+    get credentialKind(): "user_session" | "implementation_bootstrap";
     constructor(options: CommandClientOptions);
     execute(commandId: string, body?: unknown, options?: {
         targetSeatId?: string;

package/dist/command-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-client.d.ts","sourceRoot":"","sources":["../src/command-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;0BAchC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;gBAExB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe;CAQxE;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AAEF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,oBAAoB;IAMnC,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,OAAY,EAClB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC;CA2CnC"}
+{"version":3,"file":"command-client.d.ts","sourceRoot":"","sources":["../src/command-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;0BAchC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;gBAExB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe;CAQxE;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,cAAc,GAAG,0BAA0B,CAAC;IAC5D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,CAAC;AAEF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8C;IAE9E,IAAI,cAAc,IAAI,cAAc,GAAG,0BAA0B,CAEhE;gBAEW,OAAO,EAAE,oBAAoB;IAOnC,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,OAAY,EAClB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC;CA2CnC"}

package/dist/commands/implementation-access.d.ts

@@ -0,0 +1,22 @@
+import { CommandClient } from "../command-client.js";
+import { pollDeviceAuthorizationHandoff } from "../device-auth.js";
+import { type ImplementationCredentialStore } from "../implementation-credential-store.js";
+export type ImplementationAccessAction = "start" | "status" | "complete" | "abandon";
+type CliIo = {
+    stdout: Pick<NodeJS.WriteStream, "write">;
+    stderr: Pick<NodeJS.WriteStream, "write">;
+};
+export type ImplementationAccessDeps = {
+    appUrl: string;
+    createImplementationStore(): ImplementationCredentialStore;
+    pollDeviceAuthorizationHandoff: typeof pollDeviceAuthorizationHandoff;
+    CommandClient: typeof CommandClient;
+};
+export declare class ImplementationAccessError extends Error {
+    constructor(message: string);
+}
+export declare function runImplementationAccess(args: string[], io: CliIo, deps: ImplementationAccessDeps): Promise<number>;
+export declare function isDeadRunError(error: unknown): boolean;
+export declare function defaultImplementationAccessDeps(appUrl: string): ImplementationAccessDeps;
+export {};
+//# sourceMappingURL=implementation-access.d.ts.map

package/dist/commands/implementation-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"implementation-access.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAGzE,OAAO,EACL,8BAA8B,EAI/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAe/C,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAErF,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,IAAI,6BAA6B,CAAC;IAC3D,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAKD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA8BjB;AA2ID,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAStD;AAiGD,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,CAOxF"}

package/dist/commands/implementation-access.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=implementation-access.test.d.ts.map

package/dist/commands/implementation-access.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"implementation-access.test.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.test.ts"],"names":[],"mappings":""}

package/dist/commands/onboarding.d.ts

@@ -0,0 +1,11 @@
+import { CommandClient } from "../command-client.js";
+type CliIo = {
+    stdout: Pick<NodeJS.WriteStream, "write">;
+    stderr: Pick<NodeJS.WriteStream, "write">;
+};
+export type OnboardingDeps = {
+    makeClient(): Promise<CommandClient>;
+};
+export declare function runOnboarding(args: string[], io: CliIo, deps: OnboardingDeps): Promise<number>;
+export {};
+//# sourceMappingURL=onboarding.d.ts.map

package/dist/commands/onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAIzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC,CAAC;AAEF,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBpG"}

package/dist/commands/onboarding.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=onboarding.test.d.ts.map

package/dist/commands/onboarding.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.test.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.test.ts"],"names":[],"mappings":""}

package/dist/device-auth.d.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import type { CliConfig } from "./config.js";
 import type { CliSession } from "./token-store.js";
 type CliIo = {
@@ -14,9 +15,36 @@ export type DeviceLoginDeps = {
     }) => Promise<CliSession>;
     now?: () => number;
 };
+declare const startResponseSchema: z.ZodObject<{
+    device_code: z.ZodString;
+    user_code: z.ZodString;
+    verification_uri: z.ZodString;
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodNumber;
+    interval: z.ZodNumber;
+    operator_poll_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type StartSession = z.infer<typeof startResponseSchema>;
+type OperatorPollProof = {
+    installation_fingerprint_hash: string;
+    installation_public_key: string;
+    challenge_signature: string;
+};
+declare const approvedPollResponseSchema: z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+}, z.core.$loose>;
+export type ApprovedPoll = z.infer<typeof approvedPollResponseSchema>;
 export declare class DeviceLoginError extends Error {
     constructor(message: string);
 }
 export declare function loginWithDeviceCode(config: CliConfig, io: CliIo, deps?: DeviceLoginDeps): Promise<CliSession>;
+export declare function pollDeviceAuthorizationHandoff<TApproved>(config: CliConfig, io: CliIo, options: {
+    purpose?: "user_session" | "implementation_bootstrap" | "operator_grant";
+    sourceClient?: string;
+    startBody?: Record<string, unknown>;
+    operatorPollProof?: (session: StartSession) => OperatorPollProof;
+    onStart?: (session: StartSession) => void;
+    silent?: boolean;
+}, deps: DeviceLoginDeps, mapApproved: (approved: ApprovedPoll) => TApproved | null): Promise<TApproved>;
 export {};
 //# sourceMappingURL=device-auth.d.ts.map

package/dist/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAwBF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAiCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAuFrB"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAcnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,QAAA,MAAM,mBAAmB;;;;;;;;iBAWf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,6BAA6B,EAAE,MAAM,CAAC;IACtC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAqBF,QAAA,MAAM,0BAA0B;;iBAEhB,CAAC;AAMjB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEtE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAiCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED,wBAAsB,8BAA8B,CAAC,SAAS,EAC5D,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE;IACP,OAAO,CAAC,EAAE,cAAc,GAAG,0BAA0B,GAAG,gBAAgB,CAAC;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,iBAAiB,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,EACD,IAAI,EAAE,eAAe,EACrB,WAAW,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,SAAS,GAAG,IAAI,GACxD,OAAO,CAAC,SAAS,CAAC,CA2IpB"}

package/dist/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAWA,wBAAgB,eAAe,IAAI,MAAM,CAexC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAkD/C"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAWA,wBAAgB,eAAe,IAAI,MAAM,CAexC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAoD/C"}

package/dist/forge-workspace.d.ts

@@ -1,8 +1,29 @@
 import { type StepLedger } from "./step-ledger.js";
 export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
-export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string): NodeJS.ProcessEnv;
+export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string, codexHomeDir?: string): NodeJS.ProcessEnv;
 export declare function resolveSourceClaudeConfigDir(base: NodeJS.ProcessEnv): string;
-export declare function provisionIsolatedClaudeConfigDir(base: NodeJS.ProcessEnv, configDir: string): Promise<string>;
+export declare function provisionIsolatedClaudeConfigDir(base: NodeJS.ProcessEnv, configDir: string, onRepair?: (message: string) => void): Promise<string>;
+export declare function resolveSourceCodexHomeDir(base: NodeJS.ProcessEnv): string;
+export declare const CODEX_HOME_TMP_PREFIX = ".rost-tmp-";
+export declare function writeFileAtomicNoFollow(dest: string, data: Buffer | string, options?: {
+    mode?: number;
+    exclusive?: boolean;
+    requireAtomic?: boolean;
+    durable?: boolean;
+}): Promise<void>;
+export declare function ensureVerifiedPrivateDir(dir: string, label: string, onRepair?: (message: string) => void): Promise<void>;
+export declare function ensureVerifiedCodexHomeDir(homeDir: string, onRepair?: (message: string) => void): Promise<string>;
+export declare function commitCodexHomeSeedMarker(homeDir: string): Promise<void>;
+export declare function provisionIsolatedCodexHomeDir(base: NodeJS.ProcessEnv, homeDir: string, projectRoot?: string, onRepair?: (message: string) => void): Promise<string>;
+export type CodexHomeLock = {
+    release: () => Promise<void>;
+};
+export declare function codexHomeBusySummary(waitedMs: number): string;
+export declare const CODEX_HOME_BUSY_SUMMARY: string;
+export declare function acquireCodexHomeLock(homeDir: string, options?: {
+    waitMs?: number;
+    staleMs?: number;
+}): Promise<CodexHomeLock | null>;
 export type ForgeCredential = {
     token: string;
     expiresAt: string;
@@ -36,6 +57,9 @@ export type PrepareForgeWorkspaceOptions = {
     remoteUrl?: string;
     ledger?: StepLedger;
 };
+export declare function isNonFastForwardRejection(message: string): boolean;
+export declare function isCredentialExpiryFailure(message: string, credential: ForgeCredential, now?: Date): boolean;
+export declare function withCredentialRemint<T>(credential: ForgeCredential, remintCredential: (() => Promise<ForgeCredential>) | undefined, op: (credential: ForgeCredential) => Promise<T>): Promise<T>;
 export declare function prepareAskpassTurnDir(baseDir: string): Promise<string>;
 export declare function prepareForgeWorkspace(options: PrepareForgeWorkspaceOptions): Promise<ForgeWorkspace>;
 export type PrepareMergeWorkspaceOptions = {
@@ -53,8 +77,11 @@ export type PrepareMergeWorkspaceOptions = {
     ledger?: StepLedger;
 };
 export declare function prepareMergeWorkspace(options: PrepareMergeWorkspaceOptions): Promise<ForgeWorkspace>;
-export declare function pushChangeset(ws: ForgeWorkspace, credential: ForgeCredential, ledger?: StepLedger): Promise<{
+export declare function pushChangeset(ws: ForgeWorkspace, credential: ForgeCredential, ledger?: StepLedger, options?: {
+    remintCredential?: () => Promise<ForgeCredential>;
+}): Promise<{
     commitSha: string;
+    credential: ForgeCredential;
 } | null>;
 export declare function computeChangedPaths(ws: ForgeWorkspace): Promise<string[]>;
 export type OpenDraftPullRequestOptions = {
@@ -70,6 +97,7 @@ export type OpenDraftPullRequestOptions = {
     apiBaseUrl?: string;
     fetchImpl?: typeof fetch;
     ledger?: StepLedger;
+    remintCredential?: () => Promise<ForgeCredential>;
 };
 export type ForgePullRequest = {
     url: string;

package/dist/forge-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAAC,UAAU,CAiBnB;AAcD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAOD,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAejB;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,EAMxB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAAC,UAAU,CA0BnB;AAcD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAOD,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,EAGjB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAYD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQzE;AAyBD,eAAO,MAAM,qBAAqB,eAAe,CAAC;AASlD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/F,OAAO,CAAC,IAAI,CAAC,CAsFf;AAkED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EAIb,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC,CAiDf;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EAKf,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAuCD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO9E;AA2BD,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,OAAO,EAAE,MAAM,EAkBf,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CA6OjB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAU7D,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAID,eAAO,MAAM,uBAAuB,QAA0B,CAAC;AA2B/D,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwM/B;AAmMD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAmLF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOlE;AAgBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAMvH;AAOD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,UAAU,EAAE,eAAe,EAC3B,gBAAgB,EAAE,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,SAAS,EAC9D,EAAE,EAAE,CAAC,UAAU,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAWZ;AA4DD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAsED,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,EACnB,OAAO,CAAC,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,GAAG,IAAI,CAAC,CAgEpE;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;IAIpB,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAM1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA0R3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAiS3D,CAAC"}

package/dist/generator/flags.d.ts

@@ -4,6 +4,7 @@ export type FlagOverrides = {
     flagAliases?: Readonly<Record<string, string>>;
     primaryPositional?: string;
     defaults?: Readonly<Record<string, unknown>>;
+    negatedFlags?: Readonly<Record<string, string>>;
 };
 export declare function booleanFlagsFor(entry: CommandManifestEntry, overrides?: FlagOverrides): Set<string>;
 export declare function buildBodyFromFlags(entry: CommandManifestEntry, parsed: ParsedFlags, positional?: string, overrides?: FlagOverrides): Record<string, unknown>;

package/dist/generator/flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/generator/flags.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAwB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AA2BlF,MAAM,MAAM,aAAa,GAAG;IAG1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C,CAAC;AAKF,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,GAAE,aAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,CAcvG;AAwDD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,GAAE,aAAkB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoFzB"}
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/generator/flags.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAwB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AA2BlF,MAAM,MAAM,aAAa,GAAG;IAG1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAI3B,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAI7C,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD,CAAC;AAMF,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,GAAE,aAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,CAsBvG;AA6GD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,SAAS,GAAE,aAAkB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsFzB"}

package/dist/generator/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAotCF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmPjD,CAAC"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAi3CF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAyQjD,CAAC"}

package/dist/generator/verbs.d.ts

@@ -15,5 +15,4 @@ export declare function manifestById(commandId: string): CommandManifestEntry |
 export declare function renderVerbSchema(entry: CommandManifestEntry): string;
 export declare function groupUsage(bin: string, group: string, spec: GroupSpec): string;
 export declare function makeGroupWrapper(group: string, spec: GroupSpec): Wrapper;
-export declare function autoGroupSpec(namespace: string): GroupSpec;
 //# sourceMappingURL=verbs.d.ts.map

package/dist/generator/verbs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verbs.d.ts","sourceRoot":"","sources":["../../src/generator/verbs.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EAOL,KAAK,OAAO,EAEb,MAAM,cAAc,CAAC;AAItB,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAIrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IAEtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEhF;AAGD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA2BpE;AAYD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAa9E;AA2CD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAMxE;AAMD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAU1D"}
+{"version":3,"file":"verbs.d.ts","sourceRoot":"","sources":["../../src/generator/verbs.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAuC,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EAOL,KAAK,OAAO,EAEb,MAAM,cAAc,CAAC;AAItB,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAIrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IAEtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEhC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEhF;AAGD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA2BpE;AAYD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAa9E;AA4CD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAMxE"}

package/dist/implementation-credential-store.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { type ExecFile } from "./token-store.js";
+declare const implementationBootstrapCredentialSchema: z.ZodObject<{
+    token: z.ZodString;
+    token_id: z.ZodString;
+    tenant_id: z.ZodString;
+    implementation_run_id: z.ZodString;
+    scope: z.ZodLiteral<"implementation_bootstrap">;
+    expires_at: z.ZodString;
+}, z.core.$strict>;
+export type ImplementationBootstrapCredential = z.infer<typeof implementationBootstrapCredentialSchema>;
+export type ImplementationCredentialStore = {
+    read(): Promise<ImplementationBootstrapCredential | null>;
+    write(credential: ImplementationBootstrapCredential): Promise<void>;
+    clear(): Promise<void>;
+    describe(): string;
+};
+export declare class ImplementationFileTokenStore implements ImplementationCredentialStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    read(): Promise<ImplementationBootstrapCredential | null>;
+    write(credential: ImplementationBootstrapCredential): Promise<void>;
+    clear(): Promise<void>;
+    describe(): string;
+    private chmodOwnerOnly;
+}
+export type CreateImplementationCredentialStoreOptions = {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    execFile?: ExecFile;
+    stderr?: Pick<NodeJS.WriteStream, "write">;
+};
+export declare function createImplementationCredentialStore(options?: CreateImplementationCredentialStoreOptions): ImplementationCredentialStore;
+export {};
+//# sourceMappingURL=implementation-credential-store.d.ts.map

package/dist/implementation-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAOL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AA8OF,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { CommandClient } from "./command-client.js";
 import { loginWithBrowser, refreshCliSessionIfNeeded } from "./auth.js";
 import { loginWithDeviceCode } from "./device-auth.js";
 import { type TokenStore } from "./token-store.js";
@@ -14,6 +15,7 @@ type MainOptions = {
     login?: typeof loginWithBrowser;
     deviceLogin?: typeof loginWithDeviceCode;
     refreshSession?: typeof refreshCliSessionIfNeeded;
+    commandClient?: typeof CommandClient;
 };
 export declare function main(argv?: string[], options?: MainOptions): Promise<number>;
 export declare function isCliEntrypoint(moduleUrl: string, argvPath: string | undefined): boolean;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAQA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAyBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkSnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA6BrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;CACtC,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0ZnG;AA4hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}