@sentropic/h2a 0.85.24 → 0.86.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAoEH,OAAO,KAAK,EAOV,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAyExB,OAAO,EAUL,KAAK,0BAA0B,EAGhC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAUL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAyEpC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CACrC;AAWD,wBAAgB,aAAa,IAAI,MAAM,CA6HtC;AA8hCD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,MAAM,MAAM,GAChB;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,SAAS,CAwBZ;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAyBR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,GACrB,MAAM,CAkBR;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;CAKtB,GACA,OAAO,CAAC,MAAM,CAAC,CA4HjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,0BAA0B,EACnC,UAAU,EAAE,MAAM,KACf,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,EACtD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAwBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CA8BjB;AA4ND;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAiED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAqLD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAkH9E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAsGhF;AAwYD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAG3G,GACA,OAAO,CAAC,MAAM,CAAC,CAyJjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CA6BjB;AA8gCD;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,GACrB,MAAM,CA8FR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,IAAI,CAAC,EAAE;IACL,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,sCAAsC,EAAE,0BAA0B,CAAC;CAC3F,GACA,MAAM,CAuIR;AAmrCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB/D;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAKD,eAAO,MAAM,kBAAkB,aAG7B,CAAC;AAoBH,eAAO,MAAM,2BAA2B,aAA2C,CAAC;AAKpF,eAAO,MAAM,wBAAwB,aAGnC,CAAC;AAKH,eAAO,MAAM,kBAAkB,aAG7B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAE5E,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAsJD,wBAAgB,MAAM,CACpB,IAAI,GAAE,SAAS,MAAM,EAA0B,EAC/C,OAAO,GAAE,aAGR,GACA,MAAM,CAuIR"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAqEH,OAAO,KAAK,EAOV,eAAe,EAChB,MAAM,gBAAgB,CAAC;AA2CxB,OAAO,EAUL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AA8BnC,OAAO,EAUL,KAAK,0BAA0B,EAGhC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAUL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAoFpC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CACrC;AAWD,wBAAgB,aAAa,IAAI,MAAM,CA8ItC;AA8hCD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,MAAM,MAAM,GAChB;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC9C,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,IAAI,CAAC;CAC3B,GAAG,SAAS,CAwDZ;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAyBR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,GACrB,MAAM,CAkBR;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;CAKtB,GACA,OAAO,CAAC,MAAM,CAAC,CA4HjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,0BAA0B,EACnC,UAAU,EAAE,MAAM,KACf,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,EACtD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAwBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,EAC3E,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,GAAE,sBAA2B,GACrC,OAAO,CAAC,MAAM,CAAC,CAoDjB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,uBAAuB,EACvB,OAAO,GAAG,QAAQ,GAAG,eAAe,GAAG,cAAc,GAAG,kBAAkB,GAAG,UAAU,GAAG,KAAK,CAChG,CAAC;AAiUF;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAiED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAqLD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAkH9E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAsGhF;AAwYD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAG3G,GACA,OAAO,CAAC,MAAM,CAAC,CAyJjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CA6BjB;AA8gCD;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,GACrB,MAAM,CA8FR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,aAAa,EACtB,IAAI,CAAC,EAAE;IACL,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,sCAAsC,EAAE,0BAA0B,CAAC;CAC3F,GACA,MAAM,CAuIR;AAk2CD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB/D;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAKD,eAAO,MAAM,kBAAkB,aAG7B,CAAC;AAoBH,eAAO,MAAM,2BAA2B,aAA2C,CAAC;AAKpF,eAAO,MAAM,wBAAwB,aAGnC,CAAC;AAKH,eAAO,MAAM,kBAAkB,aAG7B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAE5E,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAsJD,wBAAgB,MAAM,CACpB,IAAI,GAAE,SAAS,MAAM,EAA0B,EAC/C,OAAO,GAAE,aAGR,GACA,MAAM,CAgLR"}

package/dist/cli.js

@@ -58,6 +58,7 @@ import { runCli as runTrackCli } from "@sentropic/track";
 // `install-skills` renders `harness-<name>` from it (no hard-coded list, no
 // skill copies committed here; SOURCE UNIQUE = the installed npm package).
 import { runHarnessCli, HARNESS_SKILLS } from "./vendor/harness/index.js";
+import { renderCommandMap } from "./cli-command-map.js";
 import { H2A_ATTESTER_COMPREHENSION_RIGHT, H2A_COMPREHENSION_ATTESTATION_BODY_KIND, H2A_DECLARATION_INTERET_BODY_KIND, H2A_ORG_MANIFEST_FILENAME, H2A_ORG_PROPOSAL_BODY_KIND, H2A_ORG_RATIFIED_BODY_KIND, H2A_ROLES, H2A_WORK_STATUSES, auditNhiPosture, buildComprehensionAttestation, canAttestComprehension, checkEnvelopeFreshness, computeHash, createEnvelope, deriveWorkspaceId, diffOrgManifest, effectiveOrgInstances, isComprehensionAttestation, nhiAttestationEnvelope, nhiInventory, deriveConnectionConfidence, nhiTrustBundle, orgAssignmentEnvelope, parseOrgManifest, signCanonical, signEnvelope, subagentAddress, validateOrgManifest, verifyComprehensionAttestation } from "@sentropic/h2a";
 import { H2A_CLAUDE_HOST } from "./hosts/claude.js";
 import { H2A_CODEX_HOST } from "./hosts/codex.js";
@@ -72,7 +73,7 @@ import { H2A_MCP_READY_FILE_ENV, H2A_MCP_READY_NONCE_ENV, runMcpStdio } from "./
 import { renderK8sSidecar } from "./runtime/deploy/k8s-sidecar.js";
 import { renderK8sTenant } from "./runtime/deploy/k8s-tenant.js";
 import { remoteServerForStore, sendRemoteEnvelope } from "./runtime/remote/index.js";
-import { buildInstanceMirror, mirrorServerForStore } from "./runtime/mirror/index.js";
+import { buildInstanceMirror, isPushableHttpUrl, mirrorPushGloballyDisabled, mirrorServerForStore, redactEndpoint, runMirrorPushDaemon, MIN_MIRROR_PUSH_INTERVAL_MS, MIRROR_PUSH_INVALID_URL_MESSAGE, MIRROR_PUSH_OFF_ENV } from "./runtime/mirror/index.js";
 import { recordStop, scanDrumbeat, clearDrumbeatEntry, runDrumbeatWatch as runDrumbeatWatchLoop, loggingRelauncher, localTmuxRelauncher, headlessRelauncher, remoteRelauncher, chainRelauncher, relanceFromInbox, loggingDecider, subagentDecider, H2A_DEFAULT_MAX_RELANCES } from "./runtime/drumbeat/index.js";
 import { gatherNhiSnapshot } from "./runtime/nhi.js";
 import { raiseBlockage, listBlockages, resolveBlockage } from "./runtime/blockage/index.js";
@@ -80,7 +81,8 @@ import { recordEscalation, listEscalations, clearEscalation } from "./runtime/es
 import { authorizeDrive, chainDriver, formatSignedDriveInstruction, headlessDriver, localTmuxDriver, loggingDriver, nativeBackchannelDriver, remoteDriveServerForStore, verifyDriveOnReceive } from "./runtime/drive/index.js";
 import { verifyEnvelopeSysmlRef } from "./runtime/sysml/index.js";
 import { checkUpgrade, performUpgrade, currentCliVersion, upgradeCachePath, canReexec, reexecSelf, H2A_AUTO_UPGRADE_CHECK_TTL_MS, H2A_REEXEC_GUARD_ENV, H2A_UPGRADE_CHECK_TTL_MS } from "./runtime/upgrade/index.js";
-import { resolveLiveIdentity } from "./runtime/identity/index.js";
+import { H2A_CLI_DECLARED_CAPABILITIES, createHostSessionNameRefresher, resolveLiveIdentity } from "./runtime/identity/index.js";
+import { buildEnrollmentProof, enrollmentProofSignedPayload, listUnusablePrivateKeys, sanitizeEnrollmentChallenge } from "./runtime/enrollment/index.js";
 import { conductorFor } from "./runtime/governance/conductor.js";
 import { appendConductorClaim } from "./runtime/governance/claims.js";
 import { conductorLaunchCheck } from "./runtime/governance/launch-check.js";
@@ -139,10 +141,19 @@ export function renderCliHelp() {
     return [
         "h2a",
         "",
-        "Human-to-agent coordination CLI.",
+        "Human-to-agent coordination CLI — the unified sentropic CLI and core.",
+        "It also fronts agent work sessions, the work record (@sentropic/track) and the",
+        "harness method; a verb it does not serve itself loads the h2a runtime on demand.",
+        "h2a runs and coordinates agents; it is not itself an agent.",
+        "",
+        "The list below is a flat usage reference, and it is NOT exhaustive. For every",
+        "command grouped by what you are trying to do — core and runtime, derived from",
+        "the frozen verb contract so it cannot go stale — run:",
+        "  h2a explain",
         "",
         "Usage:",
         "  h2a --help",
+        "  h2a explain",
         "  h2a hosts",
         "  h2a mcp-tools",
         "  h2a init [--root <path>]",
@@ -175,6 +186,13 @@ export function renderCliHelp() {
         "  entry's id, and correlationId from the previous entry's correlationId.",
         "  Explicit --causation-id / --correlation-id flags always override the",
         "  inherited default; pass them on the first offer to start a fresh thread.",
+        "",
+        // These 24 lines used to be nested under the "Auto-propagation (DEC-033):"
+        // prose block above, which described only offer/counter/sign/event causation.
+        // They have nothing to do with it — mailboxes, local servers and host wiring
+        // were appended inside someone else's section. Heading added; every usage line
+        // below is byte-identical to before.
+        "Mailboxes, local services and host wiring:",
         "  h2a inbox put --instance <id> --json <envelope> [--root <path>]",
         "  h2a inbox read --instance <id> [--root <path>]",
         "  h2a inbox pop --instance <id> --envelope <id> [--root <path>]",
@@ -185,7 +203,7 @@ export function renderCliHelp() {
         "  h2a remote serve [--port <n>] [--host <h>] [--path </h2a/envelopes>] [--root <path>]",
         "  h2a remote send --url <u> --instance <signer> --private-key <pem> --json <envelope>",
         "  h2a remote mirror-serve [--port <n>] [--host <h>] [--path </h2a/mirror>] [--enrolled-keys-file <json>] [--root <path>]   (EVO-13 instance-mirror ingester; enrolled keys also via H2A_MIRROR_ENROLLED_KEYS base64)",
-        "  h2a remote mirror --url <u> --instance <id> --private-key <pem> [--root <path>]   (push this instance's registration to a remote ingester)",
+        "  h2a remote mirror --url <u> --instance <id> --private-key <pem> [--root <path>] [--interval-ms <n> [--max <n>]]   (push this instance's registration to a remote ingester; ONE-SHOT by default. --interval-ms >= 5000 opts into the live daemon: same payload, repeated on a monotonic beat (15000-30000 recommended), overlap-guarded, backing off on transient errors and STOPPING on repeated 401/403 because re-enrollment is required. Kill-switch: H2A_MIRROR_PUSH_OFF)",
         "  h2a drive --from <instance> --to <instance> --instruction <text> --private-key <pem> [--driver logging|native|local-tmux|headless|auto] [--host <host>] [--root <path>]",
         "  h2a drive receive --to <instance> (--line <signed-line> | --stdin) [--ignore-non-drive] [--root <path>]   (verify-before-act gate for host hooks)",
         "  h2a drive serve --to <instance> --inject-command <command> [--port <n>] [--host <h>] [--path </h2a/drive>] [--root <path>]   (remote verify-before-inject service)",
@@ -209,6 +227,7 @@ export function renderCliHelp() {
         "  h2a keepalive [--root <path>] [--interval <ms>] [--once]   (external keepalive prober — refreshes presence for agents whose tmux pane is still alive)",
         "  h2a rename --instance <id> --name <name> [--root <path>]   (set a live session's display name so peers can find it via discover --name)",
         "  h2a status [--root <path>] [--scope <s>] [--instance <i>]",
+        "  h2a status --human [--watch] [--tmux-session <exact>] [--interval <duration>]   (read-only tmux/work/gateway/inbox/loop status; --bar is the terse tmux segment)",
         "  h2a sessions [--root <path>] [--scope <s>] [--instance <i>]",
         "  h2a thread --id <threadId> --instance <self> [--root <path>]   (the ordered conversation for a thread, from your inbox+outbox)",
         "  h2a keys generate --instance <id> [--out <dir>] [--root <path>]",
@@ -1191,22 +1210,53 @@ export function resolveAutoOpen(flags, cwd) {
         root: resolveRoot(flags, cwd),
         host: host ?? "agent",
         cwd: cwd(),
+        // Declared DISPLAY list only, never an authorization input (feed contract
+        // ratification condition #3). Lands in the registration's
+        // `declaredCapabilities`, never in the authority-bearing `capabilities`.
+        declaredCapabilities: H2A_CLI_DECLARED_CAPABILITIES,
         ...(flags.instance !== undefined ? { explicitInstance: flags.instance } : {}),
         ...(flags.name !== undefined ? { name: flags.name } : {}),
         ...(flags.scope !== undefined ? { scopes: [flags.scope] } : {})
     });
+    // §D1b: only follow the host title when the operator left the name implicit,
+    // and only when a real provider session id was readable (the synthetic
+    // `fallback:` id names no transcript, so there is nothing to re-read).
+    //
+    // The host gate is EXPLICIT, not incidental. `createHostSessionNameRefresher`
+    // can only read `claude` and `codex` transcripts; for any other host it returns
+    // `undefined` forever. `resolveProviderSession` does resolve a provider session
+    // id for `remote`, `gemini` and `agy`, so without this gate those three install
+    // a callback that is called on every heartbeat and can never return a name — a
+    // guard whose premise cannot hold. Installing nothing is behaviourally
+    // identical (the heartbeat keeps the previous name either way) and does not
+    // pretend to a capability the reader does not have.
+    const refreshableHost = host === "claude" || host === "codex";
+    const refreshDisplayName = flags.name === undefined &&
+        identity.providerSessionId !== undefined &&
+        refreshableHost
+        ? createHostSessionNameRefresher({
+            host,
+            cwd: cwd(),
+            sessionId: identity.providerSessionId
+        })
+        : undefined;
     return {
         instance: identity.instance,
         ...(host ? { host } : {}),
         ...(identity.workspace !== undefined ? { workspace: identity.workspace } : {}),
         ...(identity.name !== undefined ? { name: identity.name } : {}),
+        ...(refreshDisplayName ? { refreshDisplayName } : {}),
         ...(flags.scope ? { scopes: [flags.scope] } : {}),
         ...(identity.migrationNotice !== undefined
             ? { migrationNotice: identity.migrationNotice }
             : {}),
         ...(identity.privateKeyPath !== undefined
             ? { privateKeyPath: identity.privateKeyPath }
-            : {})
+            : {}),
+        // An explicit --instance is an operator-provided label, not an identity
+        // derived and owned by this sidecar. It may open presence, but it cannot
+        // cause h2a_run to be attributed to that claimed owner in the status bar.
+        ...(flags.instance === undefined ? { delegationEligible: true } : {})
     };
 }
 /**
@@ -1595,8 +1645,35 @@ export async function runMirrorServe(flags, io = { stdout: process.stdout, stder
  * `h2a remote mirror` (EVO-13 P1): build the local instance's own registration
  * mirror, sign it with `--private-key`, and POST it to a remote ingester `--url`.
  * Exit 0 on a 2xx. Async (network) → dispatched from bin.ts.
+ *
+ * ONE-SHOT BY DEFAULT. Passing `--interval-ms <n>` — and only that — opts into
+ * the live daemon (feed-contract P1 step 4a): the identical build → sign → POST
+ * cycle, repeated on a monotonic beat with overlap prevention, transient-error
+ * backoff, and a hard stop on repeated 401/403 (re-enrollment required). With no
+ * `--interval-ms` the code path below is byte-identical to the pre-daemon one.
+ * The global kill-switch `H2A_MIRROR_PUSH_OFF` disables the daemon entirely.
  */
-export async function runMirrorPush(flags, streams = { stdout: process.stdout, stderr: process.stderr }) {
+export async function runMirrorPush(flags, streams = { stdout: process.stdout, stderr: process.stderr }, signal, overrides = {}) {
+    // OPT-IN GATE, evaluated BEFORE any validation. The daemon exists only for a
+    // caller that explicitly asked for an interval — and on that path the
+    // kill-switch has to be the very first thing that runs, ahead even of the
+    // required-flag presence check. Otherwise a HALF-EDITED unit (placeholders
+    // partly replaced, a `--private-key <path>` pair accidentally dropped) exits 1
+    // and lands in systemd `failed`, while the README promises a disarmed unit is
+    // `inactive (dead)`. Mid-edit is exactly when that promise has to hold.
+    if (flags["interval-ms"] !== undefined) {
+        return runMirrorPushWatch(flags, streams, signal, overrides);
+    }
+    // `--interval-ms=20000` parses as the flag KEY `interval-ms=20000` (this CLI
+    // takes `--flag value`, never `--flag=value`), so the opt-in above would miss
+    // it and this would silently run as a one-shot. Fail loudly instead of
+    // quietly doing something other than what was asked.
+    const equalsForm = Object.keys(flags).find((k) => k.startsWith("interval-ms="));
+    if (equalsForm) {
+        streams.stderr.write(`h2a remote mirror: use "--interval-ms ${equalsForm.slice("interval-ms=".length)}", not "--${equalsForm}" (this CLI does not take --flag=value)\n`);
+        return 1;
+    }
+    // --- one-shot, byte-identical to the pre-daemon path from here down ---
     if (!flags.url || !flags.instance || !flags["private-key"]) {
         streams.stderr.write("h2a remote mirror: --url, --instance and --private-key are required\n");
         return 1;
@@ -1630,6 +1707,92 @@ export async function runMirrorPush(flags, streams = { stdout: process.stdout, s
     streams.stdout.write(`${JSON.stringify({ status: result.status, body: result.body }, null, 2)}\n`);
     return result.status >= 200 && result.status < 300 ? 0 : 1;
 }
+/**
+ * `h2a remote mirror --interval-ms <n>` (feed-contract P1 step 4a): the SAME
+ * one-shot push, live. Reached only from {@link runMirrorPush} when the operator
+ * passed an interval — never by default, never as a side effect.
+ *
+ * Emits one JSON status line per cycle on stdout (no key material, no request or
+ * response body — see `MirrorPushCycleLog`). Exit 0 when it stops cleanly
+ * (SIGTERM, `--max`, or the kill-switch), 1 when it stops because the endpoint
+ * refuses this instance's key and re-enrollment is required.
+ */
+async function runMirrorPushWatch(flags, streams, signal, overrides = {}) {
+    // KILL-SWITCH FIRST, before ANY validation and before ANY input is read. A
+    // disabled daemon short-circuits without touching the filesystem and without
+    // judging its own arguments — including whether the required ones are even
+    // present. That is what makes the promise "a disarmed unit is inactive (dead),
+    // not failed" true for a PARTIALLY edited unit, which is the state an operator
+    // is actually in while replacing the placeholders.
+    if (mirrorPushGloballyDisabled(process.env)) {
+        streams.stderr.write(`h2a remote mirror: ${MIRROR_PUSH_OFF_ENV} is set — the live push is disabled, nothing was sent\n`);
+        return 0;
+    }
+    // Armed: now the same required-flag contract as the one-shot applies.
+    if (!flags.url || !flags.instance || !flags["private-key"]) {
+        streams.stderr.write("h2a remote mirror: --url, --instance and --private-key are required\n");
+        return 1;
+    }
+    const intervalMs = Number.parseInt(flags["interval-ms"] ?? "", 10);
+    if (!Number.isInteger(intervalMs) || intervalMs < MIN_MIRROR_PUSH_INTERVAL_MS) {
+        streams.stderr.write(`h2a remote mirror: --interval-ms must be an integer >= ${MIN_MIRROR_PUSH_INTERVAL_MS} (got "${flags["interval-ms"]}")\n`);
+        return 1;
+    }
+    const max = flags.max !== undefined ? Number.parseInt(flags.max, 10) : undefined;
+    if (max !== undefined && (!Number.isInteger(max) || max < 1)) {
+        streams.stderr.write(`h2a remote mirror: --max must be an integer >= 1 (got "${flags.max}")\n`);
+        return 1;
+    }
+    // The one-shot POSTs once and surfaces the transport error; a daemon would
+    // instead classify an unusable --url as a transient failure and retry it
+    // forever (an unfilled placeholder or a typo would look "active (running)"
+    // while pushing nothing). So the daemon form requires a usable http(s) URL
+    // up front and fails fast, like the other pre-flight checks.
+    // Emits the SAME text the library's `config-invalid` stop carries, so the
+    // string an operator greps for in the journal is the one the docs document —
+    // the CLI's fail-fast makes the library branch unreachable in practice, and
+    // two different wordings for one condition would send them looking for a
+    // message that never appears.
+    if (!isPushableHttpUrl(flags.url)) {
+        streams.stderr.write(`h2a remote mirror: ${MIRROR_PUSH_INVALID_URL_MESSAGE} (got "${flags.url}")\n`);
+        return 1;
+    }
+    const cwd = streams.cwd ?? (() => process.cwd());
+    const root = resolveRoot(flags, cwd);
+    // The key is read ONCE, at start, and kept only in memory: a rotated key needs
+    // a restart, which a re-enrollment needs anyway.
+    let privateKeyPem;
+    try {
+        privateKeyPem = readFileSync(flags["private-key"], "utf8");
+    }
+    catch (error) {
+        streams.stderr.write(`h2a remote mirror: cannot read --private-key (${error.message})\n`);
+        return 1;
+    }
+    streams.stderr.write(`h2a remote mirror: pushing instance ${flags.instance} to ${redactEndpoint(flags.url)} every ${intervalMs}ms (root ${root})\n`);
+    const summary = await runMirrorPushDaemon({
+        root,
+        url: flags.url,
+        instance: flags.instance,
+        privateKeyPem,
+        intervalMs,
+        ...(max !== undefined ? { max } : {}),
+        ...(signal ? { signal } : {}),
+        ...overrides,
+        onCycle: (line) => {
+            streams.stdout.write(`${JSON.stringify(line)}\n`);
+        }
+    });
+    // Every stop that needs a human act carries its own actionable message and
+    // exits 1, so systemd's RestartPreventExitStatus=1 keeps it stopped instead of
+    // restarting into the same wall.
+    if (summary.message) {
+        streams.stderr.write(`h2a remote mirror: ${summary.message}\n`);
+        return 1;
+    }
+    streams.stderr.write(`h2a remote mirror: stopped (${summary.stopReason}) after ${summary.cycles} cycles, ${summary.ok} accepted\n`);
+    return 0;
+}
 function parseLoopRepo(value) {
     const [path, role] = value.split(":");
     if (!path)
@@ -4421,6 +4584,151 @@ function cmdKeysRevoke(flags, streams) {
     streams.stdout.write(`${JSON.stringify({ ok: true, instance: flags.instance, status: "revoked", keys: store.listInstanceKeys(flags.instance).length }, null, 2)}\n`);
     return 0;
 }
+/**
+ * `h2a keys prove-control` — the OWNER-facing half of the principal↔agent
+ * enrollment ceremony (Part B of the session-exposure feed contract ratified
+ * 2026-07-24; step 3 of the P1 joint plan).
+ *
+ * The verb is named for what it does and only what it does: it PROVES CONTROL
+ * of the live agent key over a gateway-issued challenge. It does not "enroll"
+ * anything, because h2a cannot — the 39-auth principal is the authorizing
+ * authority and sentropic mints the binding record. Naming this `enroll` would
+ * misstate the authority model in the one place the owner reads it.
+ *
+ * It makes NO network call. The proof is printed for the owner to hand to the
+ * gateway (which requires an active FIRST-PARTY session — deliberately not
+ * reachable by a bearer token). Nothing is stored: no binding, no challenge,
+ * no proof.
+ */
+function cmdKeysProveControl(flags, streams) {
+    if (!flags.host) {
+        streams.stderr.write("h2a keys prove-control: --host <codex|claude|gemini|agy|hermes|opencode|remote> is required\n");
+        return 1;
+    }
+    if (!["codex", "claude", "gemini", "agy", "hermes", "opencode", "remote"].includes(flags.host)) {
+        streams.stderr.write(`h2a keys prove-control: unknown --host "${flags.host}". Supported: codex, claude, gemini, agy, hermes, opencode, remote.\n`);
+        return 1;
+    }
+    // A NAMED instance-id ROTS. A stale recorded mapping has already sent work to
+    // the wrong instance in this project, and the 2026-06-07 identity re-anchor
+    // means yesterday's id names yesterday's key. The ceremony therefore resolves
+    // the LIVE identity itself, every run — so an override is refused loudly
+    // rather than quietly honoured.
+    if (flags.instance !== undefined) {
+        streams.stderr.write("h2a keys prove-control: --instance is refused. The ceremony must prove the key that is LIVE " +
+            "now, so the identity is resolved at run time; a recorded id would name a key that may " +
+            "already have been re-anchored away. Re-run `h2a connect` if the live identity is wrong.\n");
+        return 1;
+    }
+    if (flags.nonce !== undefined && flags.challenge !== undefined) {
+        streams.stderr.write("h2a keys prove-control: pass either --nonce <value> or --challenge <json-file>, not both\n");
+        return 1;
+    }
+    let challenge;
+    if (flags.challenge !== undefined) {
+        let raw;
+        try {
+            raw = readFileSync(flags.challenge, "utf8");
+        }
+        catch (error) {
+            streams.stderr.write(`h2a keys prove-control: cannot read --challenge (${error.message})\n`);
+            return 1;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            streams.stderr.write(`h2a keys prove-control: --challenge is not valid JSON (${error.message})\n`);
+            return 1;
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            streams.stderr.write("h2a keys prove-control: --challenge must be a JSON object { nonce, expiresAt? }\n");
+            return 1;
+        }
+        // MINIMAL DISCLOSURE is enforced by the challenge-key ALLOWLIST inside
+        // `assertSignableEnrollmentChallenge` below, not by a check here. A top-level
+        // `"principalSub" in parsed` blocklist used to live at this spot and was
+        // incomplete against its own stated harm: `{ nonce, meta: { principalSub } }`
+        // and `{ nonce, "__proto__": { principalSub } }` both put a principal id into
+        // this process while passing it. The allowlist refuses every field that is
+        // not `nonce` or `expiresAt`, so nesting is unreachable rather than hunted.
+        challenge = parsed;
+    }
+    else if (flags.nonce !== undefined && flags.nonce !== "true") {
+        // `"true"` is `parseFlags`' bare-flag sentinel (`--nonce` with no value), not
+        // a nonce. It is also not a valid nonce under the base64url + 256-bit shape,
+        // so rejecting it here only improves the error message.
+        challenge = { nonce: flags.nonce };
+    }
+    else {
+        streams.stderr.write("h2a keys prove-control: --nonce <value> or --challenge <json-file> is required " +
+            "(the gateway issues it to your authenticated session)\n");
+        return 1;
+    }
+    // The challenge is the caller's input, so a bad one is a USER error (exit 1);
+    // a broken local key state is a STATE error (exit 2). Classified by checking
+    // the two separately, never by matching on an error string.
+    //
+    // `sanitize` both validates (allowlist over own keys) and hands back a FRESH
+    // null-prototype object, so nothing downstream carries a parsed document's own
+    // `"__proto__"` key even by accident.
+    try {
+        challenge = sanitizeEnrollmentChallenge(challenge, Date.now());
+    }
+    catch (error) {
+        streams.stderr.write(`h2a keys prove-control: ${error.message}\n`);
+        return 1;
+    }
+    const cwd = streams.cwd ?? (() => process.cwd());
+    warnIfCwdRootFallback(flags, cwd, streams);
+    const root = resolveRoot(flags, cwd);
+    // NAME A DAMAGED KEY BEFORE MINTING OVER IT. A corrupt, truncated or
+    // passphrase-protected private key does not fail the ceremony: live resolution
+    // silently mints a fresh identity and this verb exits 0 on a brand-new key. The
+    // mint is defensible; doing it silently is not, because it is indistinguishable
+    // from tampering. So say which file is unusable, on stderr, before it happens.
+    for (const path of listUnusablePrivateKeys(root)) {
+        streams.stderr.write(`h2a keys prove-control: WARNING — private key at ${path} exists but cannot be loaded ` +
+            "(corrupt, truncated, or passphrase-protected). If it belongs to the identity you meant to " +
+            "re-prove, a NEW identity will be minted instead and the proof will be for a different key.\n");
+    }
+    let result;
+    try {
+        result = buildEnrollmentProof({ root, host: flags.host, cwd: cwd(), challenge });
+    }
+    catch (error) {
+        streams.stderr.write(`h2a keys prove-control: ${error.message}\n`);
+        return 2;
+    }
+    // Deliberately PATH-FREE output. This envelope exists to be copied into a
+    // browser, so it holds no `root`, no key path and no private key — the same
+    // discipline the feed applies to its descriptors, applied to the one h2a
+    // output whose purpose is to leave the machine.
+    const envelope = {
+        ok: true,
+        instance: result.instance,
+        publicKeyFingerprint: result.publicKeyFingerprint,
+        // So a MINT is never silent. `mint` means this run proved a key that did not
+        // exist before — expected after a re-anchor, but also what a damaged key
+        // produces, which is why the stderr warning above names the file.
+        ...(result.identityAction !== undefined ? { identityAction: result.identityAction } : {}),
+        // Explicit branch, not a defaulted field: h2a ships no transport at all, so
+        // "not attempted" is an established fact about this run.
+        submission: { attempted: false, reason: "no-transport-configured" },
+        proof: result.proof,
+        // Derived from the proof itself, never a hand-kept list: the signed set is
+        // whatever the proof carries minus the signature.
+        signedFields: Object.keys(enrollmentProofSignedPayload(result.proof)).sort(),
+        authority: "Proof of KEY CONTROL only. The signature covers every field of the proof except itself — " +
+            "including the versioned `type` tag, so the proof attests what it IS as well as what it " +
+            "carries. But SIGNED IS NOT AUTHORIZED: it proves this key produced this payload; it proves " +
+            "nothing about what the key may see. The 39-auth principal authorizes, and sentropic mints " +
+            "and stores the binding."
+    };
+    streams.stdout.write(`${JSON.stringify(envelope, null, 2)}\n`);
+    return 0;
+}
 function cmdConnect(flags, streams) {
     if (!flags.host) {
         streams.stderr.write("h2a connect: --host <codex|claude|gemini|agy|hermes|opencode|remote> is required\n");
@@ -4437,6 +4745,10 @@ function cmdConnect(flags, streams) {
         root,
         host: flags.host,
         cwd: cwd(),
+        // Declared DISPLAY list only, never an authorization input (feed contract
+        // ratification condition #3). Lands in the registration's
+        // `declaredCapabilities`, never in the authority-bearing `capabilities`.
+        declaredCapabilities: H2A_CLI_DECLARED_CAPABILITIES,
         ...(flags.instance !== undefined ? { explicitInstance: flags.instance } : {}),
         ...(flags.name !== undefined ? { name: flags.name } : {})
     });
@@ -5288,6 +5600,41 @@ export function runCli(argv = process.argv.slice(2), streams = {
         streams.stdout.write(`${renderCliHelp()}\n`);
         return 0;
     }
+    // `explain` — the grouped command map. Added 2026-07-25 as a NEW verb; it
+    // repurposes no existing argv and no existing output. DEC-034's no-argv-is-help
+    // rule above is untouched: bare `h2a` still renders `renderCliHelp()`.
+    //
+    // GRAMMAR, and why it is strict. Review measured that this verb accepted
+    // ANY trailing argv and returned the map with exit 0 — `explain foo`,
+    // `explain --json`, `explain --root /tmp` all "succeeded". That contradicted
+    // the contract, which declares no flags at all, and it manufactures a
+    // successful-looking result for input nobody implemented: a caller who pipes
+    // `explain --json` into a JSON parser gets prose and exit 0.
+    //
+    // The ambient convention in this file is laxer — `hosts foo` and
+    // `mcp-tools --json` also exit 0, measured. `explain` is deliberately NOT
+    // following it, because it is a NEW verb: no caller can already depend on
+    // junk argv being tolerated, so strictness is free here and impossible to
+    // retrofit later without a breaking change. Tightening the siblings is a
+    // separate change against verbs that DO have callers, and is not in scope.
+    //
+    // Accepted: bare `explain`, plus `--help`/`-h` which print the same map (the
+    // map IS this verb's help; erroring there would be user-hostile). Everything
+    // else — any other flag, any positional — is a usage error: exit 1, nothing
+    // on stdout, the offending token named on stderr. `optionalFlags: ["help"]`
+    // and `exitCodes: [0, 1]` in cli-contract.ts say exactly this.
+    if (command === "explain") {
+        const rest = argv.slice(1);
+        const unsupported = rest.filter((token) => token !== "--help" && token !== "-h");
+        if (unsupported.length > 0) {
+            streams.stderr.write(`h2a explain: unsupported argument${unsupported.length > 1 ? "s" : ""}: ${unsupported.join(", ")}\n` +
+                "  usage: h2a explain [--help]\n" +
+                "  `explain` takes no arguments; it always prints the whole grouped map.\n");
+            return 1;
+        }
+        streams.stdout.write(`${renderCommandMap([...TRACK_FACADE_VERBS])}\n`);
+        return 0;
+    }
     if (command === "hosts") {
         streams.stdout.write(`${JSON.stringify(CLI_HOSTS, null, 2)}\n`);
         return 0;
@@ -5426,7 +5773,9 @@ export function runCli(argv = process.argv.slice(2), streams = {
             return cmdKeysList(subFlags, streams);
         if (sub === "revoke")
             return cmdKeysRevoke(subFlags, streams);
-        streams.stderr.write(`h2a keys: unknown subcommand "${sub ?? ""}" (generate, add, list, revoke)\n`);
+        if (sub === "prove-control")
+            return cmdKeysProveControl(subFlags, streams);
+        streams.stderr.write(`h2a keys: unknown subcommand "${sub ?? ""}" (generate, add, list, revoke, prove-control)\n`);
         return 1;
     }
     streams.stderr.write(`Unknown command: ${command}\n`);