@rosthq/cli 0.7.156 → 0.7.158

package/dist/acting-principal.d.ts

@@ -0,0 +1,82 @@
+import { z } from "zod";
+export declare const ACTING_PRINCIPAL_KINDS: readonly ["none", "unknown", "user_session", "implementation_bootstrap"];
+export declare const actingPrincipalSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        unknown: "unknown";
+        none: "none";
+        user_session: "user_session";
+        implementation_bootstrap: "implementation_bootstrap";
+    }>;
+    subject: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    tenant_id: z.ZodNullable<z.ZodString>;
+    tenant_name: z.ZodNullable<z.ZodString>;
+    role: z.ZodNullable<z.ZodString>;
+    source: z.ZodNullable<z.ZodString>;
+    principal_switch: z.ZodNullable<z.ZodString>;
+    note: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ActingPrincipal = z.infer<typeof actingPrincipalSchema>;
+/** The canonical `none` projection — no credential resolved at all. */
+export declare function noneActingPrincipal(note?: string): ActingPrincipal;
+/**
+ * Decode the self-describing identity claims out of a session's own JWT. This
+ * is a LOCAL read of a token the CLI already holds — never a network call and
+ * never a signature check (the server re-authenticates every request). It is
+ * used only to render whose authority a command acts under, so every failure
+ * mode resolves to nulls rather than throwing: a non-JWT test token, a token
+ * with no email claim, or malformed base64 all yield an unresolved identity,
+ * which the projection reports as `user_session` with a null email — never a
+ * fabricated one.
+ */
+export declare function decodeSessionIdentity(accessToken: string | undefined): {
+    email: string | null;
+    tenantId: string | null;
+};
+/**
+ * Project the acting principal for a resolved user session. `accessToken` is
+ * the session's JWT (decoded locally for the email/tenant); `source` is the
+ * token store's describe() string. Identity that does not decode stays null —
+ * the projection is `user_session` with a null email, distinct from `none`.
+ */
+export declare function userSessionActingPrincipal(params: {
+    accessToken: string | undefined;
+    source: string | null;
+    tenantName?: string | null;
+}): ActingPrincipal;
+/**
+ * Project the acting principal for the bounded implementation-run credential.
+ * The tenant id and run id are proven facts carried on the credential itself;
+ * `source` is the credential store's describe() string. `otherCredential`,
+ * when set, records that a competing credential (typically the caller's own
+ * logged-in user session) was also available and this bounded principal was
+ * selected over it — the explicit switch note the dual-credential control
+ * requires.
+ */
+export declare function implementationActingPrincipal(params: {
+    tenantId: string;
+    implementationRunId: string;
+    source: string | null;
+    otherCredential?: string | null;
+}): ActingPrincipal;
+/**
+ * The one-line human header rendered BEFORE a command's payload. It states
+ * whose authority the command acts under and never renders an unproven
+ * identity as a proven one: `none`/`unknown` say exactly that, and a user
+ * session whose JWT did not decode reports the credential without inventing an
+ * email.
+ */
+export declare function renderActingPrincipalHeader(principal: ActingPrincipal): string;
+/**
+ * The stable --json envelope: the acting principal alongside the command's own
+ * result. Chosen over sibling-key injection because most --json command
+ * outputs are opaque to the CLI (it never inspects their shape), so a
+ * top-level envelope cannot collide with a result field and is uniform across
+ * every command. Documented in the PR so downstream consumers read
+ * `.output` for the former raw result.
+ */
+export declare function actingPrincipalEnvelope(principal: ActingPrincipal, output: unknown): {
+    acting_principal: ActingPrincipal;
+    output: unknown;
+};
+//# sourceMappingURL=acting-principal.d.ts.map

package/dist/acting-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acting-principal.d.ts","sourceRoot":"","sources":["../src/acting-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB,eAAO,MAAM,sBAAsB,0EAKzB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;kBAuBvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAcpE,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAgCnD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,eAAe,CAalB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GAAG,eAAe,CAclB;AAYD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAE9E;AAuCD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,OAAO,GACd;IAAE,gBAAgB,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAExD"}

package/dist/acting-principal.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=acting-principal.test.d.ts.map

package/dist/acting-principal.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acting-principal.test.d.ts","sourceRoot":"","sources":["../src/acting-principal.test.ts"],"names":[],"mappings":""}

package/dist/commands/auth-device-status.d.ts

@@ -0,0 +1,13 @@
+import { type DeviceExchangeStore } from "../device-exchange-store.js";
+type CliIo = {
+    stdout: Pick<NodeJS.WriteStream, "write">;
+    stderr: Pick<NodeJS.WriteStream, "write">;
+};
+export type AuthDeviceStatusDeps = {
+    createDeviceExchangeStore(): DeviceExchangeStore;
+    now?: () => number;
+};
+export declare function defaultAuthDeviceStatusDeps(): AuthDeviceStatusDeps;
+export declare function runAuthDeviceStatus(args: string[], io: CliIo, deps: AuthDeviceStatusDeps): Promise<number>;
+export {};
+//# sourceMappingURL=auth-device-status.d.ts.map

package/dist/commands/auth-device-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-status.d.ts","sourceRoot":"","sources":["../../src/commands/auth-device-status.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,6BAA6B,CAAC;AAUrC,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,yBAAyB,IAAI,mBAAmB,CAAC;IACjD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAgB,2BAA2B,IAAI,oBAAoB,CAElE;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,MAAM,CAAC,CAiEjB"}

package/dist/commands/implementation-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implementation-access.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EACL,8BAA8B,EAI/B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,oCAAoC,CAAC;AAe5C,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAErF,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,IAAI,6BAA6B,CAAC;IAC3D,oBAAoB,CAAC,IAAI,+BAA+B,CAAC;IACzD,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAKD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA2DjB;AA0JD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAiID,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,CAOxF"}
+{"version":3,"file":"implementation-access.d.ts","sourceRoot":"","sources":["../../src/commands/implementation-access.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EACL,8BAA8B,EAI/B,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,oCAAoC,CAAC;AA2B5C,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAErF,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,IAAI,6BAA6B,CAAC;IAC3D,oBAAoB,CAAC,IAAI,+BAA+B,CAAC;IACzD,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAKD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAmMD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AA4JD,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,CAOxF"}

package/dist/commands/onboarding-preflight.d.ts

@@ -0,0 +1,86 @@
+import { z } from "zod";
+import { type ActingPrincipal } from "../acting-principal.js";
+type CliIo = {
+    stdout: Pick<NodeJS.WriteStream, "write">;
+    stderr: Pick<NodeJS.WriteStream, "write">;
+};
+export type PreflightCheckStatus = "pass" | "fail" | "unknown";
+export declare const preflightCheckSchema: z.ZodObject<{
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        unknown: "unknown";
+        pass: "pass";
+        fail: "fail";
+    }>;
+    detail: z.ZodString;
+}, z.core.$strict>;
+export declare const preflightResultSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    acting_principal: z.ZodObject<{
+        kind: z.ZodEnum<{
+            unknown: "unknown";
+            none: "none";
+            user_session: "user_session";
+            implementation_bootstrap: "implementation_bootstrap";
+        }>;
+        subject: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        tenant_id: z.ZodNullable<z.ZodString>;
+        tenant_name: z.ZodNullable<z.ZodString>;
+        role: z.ZodNullable<z.ZodString>;
+        source: z.ZodNullable<z.ZodString>;
+        principal_switch: z.ZodNullable<z.ZodString>;
+        note: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    checks: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            unknown: "unknown";
+            pass: "pass";
+            fail: "fail";
+        }>;
+        detail: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PreflightCheck = z.infer<typeof preflightCheckSchema>;
+export type PreflightResult = z.infer<typeof preflightResultSchema>;
+/**
+ * The implementation-credential fact the preflight reports. `present` carries
+ * the expiry decision and the store the credential was read from (`stored_in`);
+ * `error` is a store read failure (never proof of absence).
+ */
+export type PreflightImplementationCredential = {
+    kind: "present";
+    expired: boolean;
+    storedIn: string;
+} | {
+    kind: "absent";
+} | {
+    kind: "error";
+    detail: string;
+};
+export type PreflightDeps = {
+    json: boolean;
+    principal: ActingPrincipal;
+    sessionRefreshError: string | null;
+    implementationCredential: PreflightImplementationCredential;
+    cliVersion: string | null;
+    fetchLatestVersion: () => Promise<string | null>;
+    probeDeployment: () => Promise<{
+        ok: boolean;
+        status: number | null;
+        detail: string;
+    }>;
+    readOnboardingState: (() => Promise<{
+        ok: boolean;
+        alreadyOnboarded: boolean;
+        detail: string;
+    }>) | null;
+};
+/**
+ * Run the preflight and render it. Returns 0 only when EVERY check passed; any
+ * `fail` or `unknown` returns 1 (unproven is not green).
+ */
+export declare function runOnboardingPreflight(io: CliIo, deps: PreflightDeps): Promise<number>;
+export {};
+//# sourceMappingURL=onboarding-preflight.d.ts.map

package/dist/commands/onboarding-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-preflight.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAEhC,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AASF,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/D,eAAO,MAAM,oBAAoB;;;;;;;;kBAMtB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMvB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,iCAAiC,GACzC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,OAAO,CAAC;IAEd,SAAS,EAAE,eAAe,CAAC;IAO3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,wBAAwB,EAAE,iCAAiC,CAAC;IAE5D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAI1B,kBAAkB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAIjD,eAAe,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAIvF,mBAAmB,EACf,CAAC,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAC3E,IAAI,CAAC;CACV,CAAC;AAgIF;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B5F"}

package/dist/commands/onboarding-preflight.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=onboarding-preflight.test.d.ts.map

package/dist/commands/onboarding-preflight.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-preflight.test.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding-preflight.test.ts"],"names":[],"mappings":""}

package/dist/commands/onboarding.d.ts

@@ -1,4 +1,5 @@
 import { CommandClient } from "../command-client.js";
+import { type ActingPrincipal } from "../acting-principal.js";
 type CliIo = {
     stdout: Pick<NodeJS.WriteStream, "write">;
     stderr: Pick<NodeJS.WriteStream, "write">;
@@ -6,6 +7,7 @@ type CliIo = {
 export type OnboardingDeps = {
     makeClient(): Promise<CommandClient>;
     readFile?: (path: string) => Promise<Buffer>;
+    actingPrincipal?: ActingPrincipal;
 };
 /**
  * The largest source file this invocation can actually send: the smallest of the
@@ -48,9 +50,12 @@ export declare function runOnboarding(args: string[], io: CliIo, deps: Onboardin
  * policy errors before shared rendering; the caller handles an intercepted
  * outcome as terminal rather than retrying under an owner session.
  */
-export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient): Promise<number>;
+export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient, options?: {
+    actingPrincipal?: ActingPrincipal;
+}): Promise<number>;
 export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient, options: {
     onError: (error: unknown) => "handled" | "print";
+    actingPrincipal?: ActingPrincipal;
 }): Promise<number | "fall-through">;
 /**
  * Resolve the local file reads a parsed invocation deferred: the source bytes

package/dist/commands/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAMzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAGrC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAkDF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,MAAsC,GACnD,MAAM,CAMR;AAqBD,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EACL,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,cAAc,CAAC;IAInG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAepG;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;AAoCpC;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,oBAAoB,EAChC,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAY,GACzD,OAAO,CAAC,IAAI,CAAC,CAqEf;AAgDD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CA+G9E;AA2FD,wBAAgB,eAAe,IAAI,MAAM,CAUxC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,OAAO,GACd,MAAM,CAoBR"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAMhC,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAGrC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAI7C,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AAkDF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,YAAY,GAAE,MAAsC,GACnD,MAAM,CAMR;AAqBD,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EACL,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,cAAc,CAAC;IAInG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBpG;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,eAAe,CAAA;CAAE,GAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAAE,GAC/F,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;AAiDpC;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,oBAAoB,EAChC,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAY,GACzD,OAAO,CAAC,IAAI,CAAC,CAqEf;AAgDD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CA+G9E;AA2FD,wBAAgB,eAAe,IAAI,MAAM,CAWxC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,OAAO,GACd,MAAM,CAoBR"}

package/dist/device-auth.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { CliConfig } from "./config.js";
+import type { DeviceExchangeStore } from "./device-exchange-store.js";
 import type { CliSession } from "./token-store.js";
 type CliIo = {
     stdout: Pick<NodeJS.WriteStream, "write">;
@@ -14,6 +15,7 @@ export type DeviceLoginDeps = {
         type: string;
     }) => Promise<CliSession>;
     now?: () => number;
+    deviceExchangeStore?: DeviceExchangeStore;
 };
 declare const startResponseSchema: z.ZodObject<{
     device_code: z.ZodString;
@@ -37,7 +39,9 @@ export type ApprovedPoll = z.infer<typeof approvedPollResponseSchema>;
 export declare class DeviceLoginError extends Error {
     constructor(message: string);
 }
-export declare function loginWithDeviceCode(config: CliConfig, io: CliIo, deps?: DeviceLoginDeps): Promise<CliSession>;
+export declare function loginWithDeviceCode(config: CliConfig, io: CliIo, deps?: DeviceLoginDeps, options?: {
+    pairingCode?: string;
+}): Promise<CliSession>;
 export declare function pollDeviceAuthorizationHandoff<TApproved>(config: CliConfig, io: CliIo, options: {
     purpose?: "user_session" | "implementation_bootstrap" | "operator_grant";
     sourceClient?: string;

package/dist/device-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAcnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,QAAA,MAAM,mBAAmB;;;;;;;;iBAWf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,6BAA6B,EAAE,MAAM,CAAC;IACtC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAqBF,QAAA,MAAM,0BAA0B;;iBAEhB,CAAC;AAMjB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEtE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAiCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED,wBAAsB,8BAA8B,CAAC,SAAS,EAC5D,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE;IACP,OAAO,CAAC,EAAE,cAAc,GAAG,0BAA0B,GAAG,gBAAgB,CAAC;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,iBAAiB,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,EACD,IAAI,EAAE,eAAe,EACrB,WAAW,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,SAAS,GAAG,IAAI,GACxD,OAAO,CAAC,SAAS,CAAC,CA2IpB"}
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAyB,MAAM,4BAA4B,CAAC;AAE7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAcnD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAGF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAGhD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAQnB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,QAAA,MAAM,mBAAmB;;;;;;;;iBAWf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,6BAA6B,EAAE,MAAM,CAAC;IACtC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAqBF,QAAA,MAAM,0BAA0B;;iBAEhB,CAAC;AAMjB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEtE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAiCD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,eAAoB,EAC1B,OAAO,GAAE;IAKP,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,GACL,OAAO,CAAC,UAAU,CAAC,CAsBrB;AAED,wBAAsB,8BAA8B,CAAC,SAAS,EAC5D,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE;IACP,OAAO,CAAC,EAAE,cAAc,GAAG,0BAA0B,GAAG,gBAAgB,CAAC;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,iBAAiB,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,EACD,IAAI,EAAE,eAAe,EACrB,WAAW,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,SAAS,GAAG,IAAI,GACxD,OAAO,CAAC,SAAS,CAAC,CAsKpB"}

package/dist/device-exchange-store.d.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { type ExecFile } from "./token-store.js";
+declare const pendingDeviceExchangeSchema: z.ZodObject<{
+    purpose: z.ZodEnum<{
+        user_session: "user_session";
+        implementation_bootstrap: "implementation_bootstrap";
+        operator_grant: "operator_grant";
+    }>;
+    device_code: z.ZodString;
+    user_code: z.ZodString;
+    verification_uri: z.ZodString;
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodString;
+}, z.core.$strict>;
+export type PendingDeviceExchange = z.infer<typeof pendingDeviceExchangeSchema>;
+export type DeviceExchangeStore = {
+    read(): Promise<PendingDeviceExchange | null>;
+    write(exchange: PendingDeviceExchange): Promise<void>;
+    clear(): Promise<void>;
+    describe(): string;
+};
+export type DeviceExchangeStoreBackend = "macOS Keychain" | "owner-only file store" | "Windows Credential Manager" | "Secret Service";
+/**
+ * A backend was reached but could not produce a trustworthy read result. The
+ * message intentionally carries only the backend class — never the subprocess
+ * error, stdout, stderr, file path, device code, or user code.
+ */
+export declare class DeviceExchangeStoreReadError extends Error {
+    readonly backend: DeviceExchangeStoreBackend;
+    constructor(backend: DeviceExchangeStoreBackend);
+}
+export declare class DeviceExchangeFileStore implements DeviceExchangeStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    read(): Promise<PendingDeviceExchange | null>;
+    write(exchange: PendingDeviceExchange): Promise<void>;
+    clear(): Promise<void>;
+    describe(): string;
+    private chmodOwnerOnly;
+}
+export type CreateDeviceExchangeStoreOptions = {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    execFile?: ExecFile;
+    stderr?: Pick<NodeJS.WriteStream, "write">;
+};
+export declare function createDeviceExchangeStore(options?: CreateDeviceExchangeStoreOptions): DeviceExchangeStore;
+export {};
+//# sourceMappingURL=device-exchange-store.d.ts.map

package/dist/device-exchange-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-exchange-store.d.ts","sourceRoot":"","sources":["../src/device-exchange-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAWL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AA6B1B,QAAA,MAAM,2BAA2B;;;;;;;;;;;kBAOtB,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;gBAEjC,OAAO,EAAE,0BAA0B;CAKhD;AA4VD,qBAAa,uBAAwB,YAAW,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAwB;IAEvD,IAAI,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAe7C,KAAK,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAaD,MAAM,MAAM,gCAAgC,GAAG;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,mBAAmB,CAyBrB"}

package/dist/generated/command-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-discovery.d.ts","sourceRoot":"","sources":["../../src/generated/command-discovery.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,eAAO,MAAM,iBAAiB,EAAE,SAAS,qBAAqB,EAuS7D,CAAC;AAKF,eAAO,MAAM,sBAAsB,EAAE,iBACyk6F,CAAC"}
+{"version":3,"file":"command-discovery.d.ts","sourceRoot":"","sources":["../../src/generated/command-discovery.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,eAAO,MAAM,iBAAiB,EAAE,SAAS,qBAAqB,EAwS7D,CAAC;AAKF,eAAO,MAAM,sBAAsB,EAAE,iBACq56F,CAAC"}

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAyS3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA0S3D,CAAC"}

package/dist/implementation-bootstrap.d.ts

@@ -14,6 +14,20 @@ export declare function resolveImplementationBootstrapClass(commandId: string):
 export declare function implementationBootstrapCommandIds(): string[];
 /** Whether the production registry marks this id as a human-decision command. */
 export declare function isHumanDecisionCommand(commandId: string): boolean;
+/** Whether this id names a registered command at all (as opposed to a typo). */
+export declare function isKnownCommandId(commandId: string): boolean;
+/**
+ * DER-3255 (correctness review F4): a MISTYPED command id under a live bounded
+ * credential must not be described as an authority refusal.
+ *
+ * The class map fails closed, so an unknown id resolves to `deny` exactly like a
+ * real deny-class command — and the route-unavailable message would then tell an
+ * operator that `onboarding.attach_referenc` "is not available to the
+ * implementation credential", which reads as a permissions problem and sends
+ * them to re-mint or end their run over a missing character. Same fail-closed
+ * outcome, truthful reason.
+ */
+export declare function unknownCommandMessage(commandId: string): string;
 /** Treat malformed or equal-to-now expiries as unusable before any network send. */
 export declare function isImplementationCredentialExpired(expiresAt: string, now?: Date): boolean;
 /**
@@ -25,10 +39,37 @@ export declare class ImplementationBootstrapDeniedError extends Error {
     readonly commandId: string;
     constructor(commandId: string);
 }
-/** A stable operator message for a credential that cannot be retried as owner. */
+/**
+ * A stable operator message for a credential that cannot be retried as owner.
+ *
+ * DER-3255: an EXPIRED credential during an ACTIVE run is the same leak through a
+ * different door, so this path is fail-closed exactly like the route-unavailable
+ * one — the run being active is the operative fact, and usability only decides
+ * WHICH message the operator reads. That makes naming the recovery command load
+ * bearing rather than decorative: this is the message a bounded agent hits when
+ * its credential ages out mid-run, which is the state the DER-2965 observation
+ * produced.
+ */
 export declare function implementationCredentialExpiredMessage(hasUserSession: boolean): string;
 /** Refuse a noninteractive human-decision command while a bounded run is active. */
 export declare function implementationHumanDecisionMessage(commandId: string): string;
+/**
+ * DER-3255: refuse a noninteractive deny-class command while a bounded run is
+ * active, NAMING the route that does not exist.
+ *
+ * The sibling message above covers the human-decision half of the deny class
+ * (DER-3023). This one covers the rest — the 160-odd deny-class commands that
+ * are not human decisions, of which `onboarding.attach_reference` is the member
+ * DER-3045's acceptance run caught executing under owner authority. Reusing the
+ * human-decision wording for them would be a false claim: `attach_reference` is
+ * not a human-decision command, it simply has no implementation route.
+ *
+ * The two messages are deliberately distinct rather than merged. The operator's
+ * remedy differs: a human-decision command is waiting for a HUMAN, so the TTY is
+ * the intended path; a deny-class command has no implementation route at all, so
+ * the honest remedy is to end the run.
+ */
+export declare function implementationRouteUnavailableMessage(commandId: string, hasUserSession: boolean): string;
 /**
  * A server response means the bearer is unusable only for authentication
  * failures. Authorization/policy refusals are not liveness signals and must not

package/dist/implementation-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implementation-bootstrap.d.ts","sourceRoot":"","sources":["../src/implementation-bootstrap.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,aAAa,EAAsB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AA0D5E;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE7F;AAED,4FAA4F;AAC5F,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAG9F;AAED;;;;GAIG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B;AAED,kFAAkF;AAClF,wBAAgB,sCAAsC,CAAC,cAAc,EAAE,OAAO,GAAG,MAAM,CAStF;AAED,oFAAoF;AACpF,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ1E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mCAAmC,CACjD,iBAAiB,EAAE,OAAO,aAAa,EACvC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,GACpD,aAAa,CAUf"}
+{"version":3,"file":"implementation-bootstrap.d.ts","sourceRoot":"","sources":["../src/implementation-bootstrap.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,aAAa,EAAsB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AA8E5E;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAE7F;AAED,4FAA4F;AAC5F,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEjE;AAOD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAG9F;AAED;;;;GAIG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,cAAc,EAAE,OAAO,GAAG,MAAM,CA0BtF;AAED,oFAAoF;AACpF,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,GAAG,MAAM,CAexG;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ1E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mCAAmC,CACjD,iBAAiB,EAAE,OAAO,aAAa,EACvC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,GACpD,aAAa,CAUf"}

package/dist/implementation-credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAUL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAC5C,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,qBAAa,6CAA8C,SAAQ,KAAK;gBAEpE,OAAO,SAAwE;CAKlF;AAED;;;;GAIG;AACH,qBAAa,sCAAuC,SAAQ,KAAK;IAC/D,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAE3C,OAAO,EAAE,oCAAoC;CAK1D;AAmVD,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAaD,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}
+{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAWL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAC5C,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,qBAAa,6CAA8C,SAAQ,KAAK;gBAEpE,OAAO,SAAwE;CAKlF;AAED;;;;GAIG;AACH,qBAAa,sCAAuC,SAAQ,KAAK;IAC/D,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAE3C,OAAO,EAAE,oCAAoC;CAK1D;AA2VD,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAaD,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@
 import { CommandClient } from "./command-client.js";
 import { loginWithBrowser, refreshCliSessionIfNeeded } from "./auth.js";
 import { loginWithDeviceCode } from "./device-auth.js";
+import { type DeviceExchangeStore } from "./device-exchange-store.js";
 import { type TokenStore } from "./token-store.js";
 import { type ImplementationCredentialStore } from "./implementation-credential-store.js";
 import { type ImplementationRunTombstoneStore } from "./implementation-run-tombstone.js";
@@ -22,6 +23,7 @@ type MainOptions = {
     commandClient?: typeof CommandClient;
     implementationCredentialStore?: ImplementationCredentialStoreFactory;
     implementationRunTombstoneStore?: () => ImplementationRunTombstoneStore;
+    deviceExchangeStore?: DeviceExchangeStore;
 };
 export declare function main(argv?: string[], options?: MainOptions): Promise<number>;
 export declare function isCliEntrypoint(moduleUrl: string, argvPath: string | undefined): boolean;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,sCAAsC,CAAC;AAW9C,OAAO,EAKL,KAAK,+BAA+B,EACrC,MAAM,mCAAmC,CAAC;AAyC3C,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAoBF,KAAK,oCAAoC,GAAG,MAAM,6BAA6B,CAAC;AAgOhF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAuBD,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IAGrC,6BAA6B,CAAC,EAAE,oCAAoC,CAAC;IACrE,+BAA+B,CAAC,EAAE,MAAM,+BAA+B,CAAC;CACzE,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAosBnG;AA+iBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,sCAAsC,CAAC;AAc9C,OAAO,EAKL,KAAK,+BAA+B,EACrC,MAAM,mCAAmC,CAAC;AAqE3C,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAoBF,KAAK,oCAAoC,GAAG,MAAM,6BAA6B,CAAC;AA4PhF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAuBD,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IAGrC,6BAA6B,CAAC,EAAE,oCAAoC,CAAC;IACrE,+BAA+B,CAAC,EAAE,MAAM,+BAA+B,CAAC;IAIxE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAy8BnG;AA2yBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}