@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.mjs

@@ -4,13 +4,27 @@ import { readFile, realpath, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
+import { configuredBranch } from "./consumer-release-preparation.mjs";
+import { sameGitDestination } from "./deploy-auth.mjs";
+import { assert, normalize, requestedDeployment } from "./deployment-request.mjs";
+import {
+  DEFAULT_POLICY,
+  POLICY_PATH,
+  validatePolicy,
+  validateProjectRestrictions,
+} from "./project-restrictions.mjs";
+import { provenPublicationAction, resolvePublicationCondition } from "./publication-conditions.mjs";
+import { bindQualifiedPublicationPlan } from "./publication-plan-binding.mjs";
+import { unsupportedPublicationPlan } from "./publication-plan-refusal.mjs";
+import { readPublicationProjectPolicy } from "./publication-project-policy.mjs";
+import {
+  assertNativePublicationAuthority,
+  assertNativePublicationContract,
+  resolveNativePublicationAuthority,
+} from "./publication-proof-schema.mjs";
+
+export { DEFAULT_POLICY, POLICY_PATH, validatePolicy };
 
-export const POLICY_PATH = ".agents/config/deploy-policy.json";
-export const DEFAULT_POLICY = Object.freeze({
-  schema_version: 1,
-  default_mode: "auto",
-  default_scope: "current-work",
-});
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const git = (root, args) =>
   execFileSync("git", args, {
@@ -19,25 +33,7 @@ const git = (root, args) =>
     windowsHide: true,
     timeout: 15000,
   }).trim();
-function assert(ok, message) {
-  if (!ok) throw new Error(message);
-}
-export function validatePolicy(policy = DEFAULT_POLICY) {
-  assert(policy && typeof policy === "object" && !Array.isArray(policy), "Invalid deploy policy");
-  assert(
-    Object.keys(policy).every((k) =>
-      ["schema_version", "default_mode", "default_scope"].includes(k),
-    ),
-    "Unsupported deploy policy field",
-  );
-  assert(
-    policy.schema_version === 1 &&
-      ["auto", "commits", "release"].includes(policy.default_mode) &&
-      policy.default_scope === "current-work",
-    "Invalid deploy policy; scope must be current-work",
-  );
-  return { ...policy };
-}
+
 export function repositoryKind({
   origin,
   rootName,
@@ -64,204 +60,84 @@ export function repositoryKind({
   );
   return "builder";
 }
-const normalize = (value) =>
-  value
-    .normalize("NFKD")
-    .replace(/[\u0300-\u036f]/g, "")
-    .toLowerCase()
-    .replace(/\s+/g, " ")
-    .trim();
-export function requestedDeployment(request) {
-  assert(
-    typeof request === "string" && request.length > 0 && request.length <= 8192,
-    "A bounded current human request is required",
-  );
-  const text = normalize(request);
-  // An explicitly named numeric patch keeps its separate signed patch route.
-  // Never truncate an ordinary release suffix into a minor version.
-  const ordinaryVersions = text.replace(
-    /\bpatch\s+v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?![\w.+-])/g,
-    "patch",
-  );
-  if (ordinaryVersions !== text && [...text.matchAll(/\bv?\d+\.\d+/g)].length !== 1)
-    return { authorized: false, reason: "conflicting-explicit-release-versions" };
-  if (/\bv\d+\.\d+(?:\.[a-z0-9_]|[-+][a-z0-9_]|[a-z_])/.test(ordinaryVersions))
-    return { authorized: false, reason: "unsupported-explicit-release-version" };
-  // Provenance and explicit human holds constrain every authorization route.
-  const quotedOrReported =
-    /[`"'“”]/.test(request) || /\b(?:disse|citou|exemplo|quoted|said)\b/.test(text);
-  const approvalHold =
-    /\b(?:ate|quando|se|apos|depois|aguard\w*|esper\w*|so|somente|apenas|depend\w*|condicion\w*)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
-      text,
-    );
-  if (quotedOrReported || approvalHold)
-    return { authorized: false, reason: "not-a-direct-deployment-request" };
-  // A separate, literal imperative paragraph can authorize implementation and
-  // publication together. Do not rewrite the user's request or accept reported,
-  // quoted, conditional or merely mentioned publication language.
-  const implementAndPublish =
-    !/[`"'“”]/.test(request) &&
-    !/\b(?:disse|citou|exemplo|quoted|said)\b/.test(text) &&
-    !/\b(?:nao|nunca|jamais|sem|proibido|proibo|evite|aguarde)\b[^.!?]*\b(?:public\w*|publiqu\w*|release|deploy|versao)\b/.test(
-      text,
-    ) &&
-    !/\b(?:ate|quando|se|apos|depois)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
-      text,
-    ) &&
-    !/\b(?:aguard\w*|esper\w*|so|somente|apenas|depend\w*|condicion\w*)\b[^.!?]*\b(?:revis\w*|autor\w*|aprov\w*|confirm\w*)\b/.test(
-      text,
-    ) &&
-    request
-      .split(/\r?\n|(?<=[.!])\s+/)
-      .map(normalize)
-      .some((line) =>
-        /^(?:(?:(?:faca|realize|execute)\s+(?:as mudancas necessarias|(?:todos os |os )(?:ajustes|ajuates)(?: necessarios)?|as melhorias|todos os testes)(?:\s+e\s+(?:todos os testes|as validacoes|os testes))?|pode (?:implementar|executar))\s+e\s+|depois\s+|apos\s+os\s+ajustes\s+e\s+(?:os\s+)?testes\s+)(?:publique|publica|publicar)\s+(?:(?:em|como)\s+)?(?:uma\s+|a\s+)?(?:(?:nova|proxima)\s+versao|v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?:\s+com\s+uma\s+versao\s+final\s+pronta\s+(?:para|pra)\s+producao)?[.!]?$/.test(
-          line,
-        ),
-      );
-  const resumedSpecPublication =
-    /^pode retomar a execucao da spec ate finalizar todas as tasks e fazer publicacao deploy da v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?: com release(?: e npm publicado)?)?$/.exec(
-      text,
-    );
-  if (resumedSpecPublication)
-    return {
-      authorized: true,
-      override: "release",
-      version: resumedSpecPublication[1],
-      phase: "publish",
-      scope: "current-work",
-    };
-  // Only a direct publication imperative is executable. References, questions and quoted
-  // historical instructions are not authority; unknown wording never upgrades the mode.
-  const withoutCourtesy = text.replace(/^(?:(?:ok|por favor|agora|please)[, ]+)+/, "");
-  const finalAdjustmentsAndPublish =
-    /^(?:faca|realize|execute)\s+(?:esses|os)\s+(?:ultimos\s+)?(?:ajustes|ajuates)(?:\s+necessarios)?\s+e\s+publique\s+(?:a\s+)?(?:versao\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
-      withoutCourtesy,
-    );
-  const sequencedDirect =
-    /^primeiro passo entao e corrigir\b[^\n?]*\bfazer merge\b[^\n?]*,\s*fazer deploy\b/.test(
-      withoutCourtesy,
-    ) && !/\b(?:nao|sem)\s+fazer deploy\b/.test(withoutCourtesy);
-  const releaseDirective =
-    /^(?:resolva essas pendencias,\s*)?preciso que crie (?:uma |a )?nova versao\s+v?\d+\.\d+\b/.test(
-      withoutCourtesy,
-    );
-  const proceedToVersion =
-    /^(?:pode\s+)?(?:seguir|continue|avancar)\s+para\s+(?:a\s+)?v\d+\.\d+\b/.test(withoutCourtesy);
-  const finalAdjustmentsToPublish =
-    /^(?:ativei\s+(?:o\s+hook|os\s+hooks)[, ]+)?(?:faca|realize|execute)\s+(?:as\s+validacoes\s+finais(?:\s+e\s+os\s+ajustes\s+necessarios)?|os\s+ajustes\s+necessarios)\s+(?:pra|para)\s+publicar\s+(?:a\s+)?v\d+\.\d+\b/.test(
-      withoutCourtesy,
-    );
-  const unit = "zero|um|uma|dois|duas|tres|quatro|cinco|seis|sete|oito|nove";
-  const shortPublication = new RegExp(
-    `^(?:boa, boa\\.\\s*)?(?:eu\\s+)?quero publicar\\s+(?:(?:a\\s+)?versao\\s+)?(?:v?((?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*))|(${unit})\\s+ponto\\s+(${unit}))(?:,?\\s+sim)?\\.?$`,
-  ).exec(withoutCourtesy);
-  const unitValue = {
-    zero: "0",
-    um: "1",
-    uma: "1",
-    dois: "2",
-    duas: "2",
-    tres: "3",
-    quatro: "4",
-    cinco: "5",
-    seis: "6",
-    sete: "7",
-    oito: "8",
-    nove: "9",
-  };
-  const shortPublicationVersion = shortPublication
-    ? (shortPublication[1] ?? `${unitValue[shortPublication[2]]}.${unitValue[shortPublication[3]]}`)
-    : null;
-  const waitsForAuthorization =
-    /\b(?:quando|se|apos|depois)\b[^?]*\b(?:autorizar|aprovar|confirmar|autorizacao|aprovacao|confirmacao)\b/.test(
-      text,
-    );
-  const pendingWorkAndPublish =
-    /^(?:execute|conclua|finalize)\s+o\s+que(?:\s+que)?\s+ficou\s+pendente,\s*atualize\s+(?:as\s+)?documentacoes\s+e\s+publique\s+(?:a\s+)?(?:versao\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)[.!]?$/.test(
-      withoutCourtesy,
-    );
-  const approvedAdjustmentsAndPublish =
-    /^pode\s+(?:criar\s+sim\s+e\s+finalize\s+os\s+ajustes\s+e\s+publique\s+(?:a\s+)?v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)|fazer\s+os\s+ajustes\s+e\s+publicar)[.!]?$/.test(
-      withoutCourtesy,
-    );
-  const direct =
-    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:deploy|dpeloy|depoly|push|commit|publique|publicar|publish|envie|release|prepare|preparar)\b/.test(
-      withoutCourtesy,
-    ) ||
-    sequencedDirect ||
-    releaseDirective ||
-    proceedToVersion ||
-    finalAdjustmentsToPublish ||
-    finalAdjustmentsAndPublish ||
-    pendingWorkAndPublish ||
-    approvedAdjustmentsAndPublish ||
-    implementAndPublish ||
-    shortPublicationVersion !== null;
-  if (!direct || (/\?/.test(text) && !implementAndPublish) || waitsForAuthorization)
-    return { authorized: false, reason: "not-a-direct-deployment-request" };
-  const noRelease =
-    /\b(?:sem|nao)\s+(?:(?:quero|criar|fazer|publicar|publique|crie|faca)\s+)?(?:(?:um|uma|o|a|novo|nova)\s+)*(?:release|nova versao|proxima versao|versao)\b/.test(
-      text,
-    ) ||
-    /\b(?:apenas|somente|so)\s+(?:(?:os|dos|o)\s+)?(?:commits?|push)\b/.test(text) ||
-    /\bdeploy\s+dos?\s+com{1,2}its?\s+na\s+versao\s+atual\b/.test(text);
-  const releaseTarget =
-    "(?:(?:do|da|de|um|uma|o|a|novo|nova|proximo|proxima|the|new|next)\\s+)*(?:release|versao|version|v\\d+\\.\\d+)";
-  const releaseMention =
-    new RegExp(
-      `\\b(?:deploy|dpeloy|depoly|publique|publicar|publish|release|prepare|preparar)\\s+(?:com\\s+)?${releaseTarget}\\b`,
-    ).test(text) ||
-    /^release\b/.test(withoutCourtesy) ||
-    releaseDirective ||
-    proceedToVersion ||
-    implementAndPublish ||
-    shortPublicationVersion !== null;
-  const nonPublication = text.replace(
-    /\bnao\s+(?:publique|publicar)\s+(?:(?:um|uma|o|a|novo|nova)\s+)*release\b/g,
-    "",
-  );
-  const preparation =
-    /^(?:(?:pode)\s+)?(?:prepare|preparar)\b/.test(withoutCourtesy) ||
-    /\b(?:apenas|somente|so)\s+prepar/.test(text) ||
-    /\b(?:sem publicar|nao publique|nao publicar)\b/.test(nonPublication);
-  const contradictory =
-    noRelease && /\be\s+(?:publique|crie|faca)\s+(?:(?:um|o|novo)\s+)*release\b/.test(text);
-  assert(!contradictory, "Conflicting publication instructions; no action is authorized");
-  const pushOnly =
-    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:push|commit)\b/.test(
-      withoutCourtesy,
-    );
-  const versions = [...text.matchAll(/\bv((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?!\d|\.\d)/g)].map(
-    (x) => x[1],
-  );
-  if (releaseDirective)
-    versions.push(/\bpreciso que crie (?:uma |a )?nova versao\s+v?(\d+\.\d+)\b/.exec(text)[1]);
-  if (shortPublicationVersion !== null) versions.push(shortPublicationVersion);
-  assert(new Set(versions).size <= 1, "Conflicting explicit release versions");
-  return {
-    authorized: true,
-    override: noRelease ? "commits" : releaseMention ? "release" : pushOnly ? "commits" : null,
-    version: !noRelease && releaseMention ? (versions[0] ?? null) : null,
-    phase: preparation ? "prepare" : "publish",
-    scope: /\b(?:deploy|push|publicar|publique)\s+(?:de\s+)?tudo\b/.test(text)
-      ? "all-worktree"
-      : "current-work",
-  };
-}
-export function resolveDeployment({ request, policy, identity }) {
+
+export function resolveDeployment({
+  request,
+  policy,
+  identity,
+  conditionProof,
+  nativeAuthority,
+  candidate,
+  destination,
+  projectRestrictions,
+}) {
   const preference = validatePolicy(policy);
   const kind = repositoryKind(identity);
-  const intent = requestedDeployment(request);
+  const refusal = unsupportedPublicationPlan(request);
+  if (refusal) return refusal;
+  const intent = requestedDeployment(provenPublicationAction(request, conditionProof));
   if (!intent.authorized)
     return { schema_version: 1, mode: "none", phase: "none", reason: intent.reason };
+  if (intent.completionOnly && kind !== "builder")
+    return {
+      schema_version: 1,
+      mode: "none",
+      phase: "none",
+      reason: "builder-distribution-required",
+    };
   const configuredMode =
     preference.default_mode === "auto"
       ? kind === "builder"
         ? "release"
         : "commits"
       : preference.default_mode;
-  const mode = intent.override ?? configuredMode;
+  let mode = intent.override ?? configuredMode;
+  const project = validateProjectRestrictions(
+    projectRestrictions
+      ? {
+          schema_version: 1,
+          constraints: projectRestrictions.constraints,
+          rule_sources: projectRestrictions.rule_sources,
+        }
+      : undefined,
+  );
+  if (project.constraints.release === "forbidden") {
+    assert(intent.override !== "release", "Project Rules forbid the explicit release request");
+    mode = "commits";
+  }
+  if (nativeAuthority) {
+    assertNativePublicationAuthority(nativeAuthority, request);
+    if (nativeAuthority.constraints.release === "forbidden") {
+      assert(
+        intent.override !== "release",
+        "Later human restriction forbids the explicit release request",
+      );
+      mode = "commits";
+    }
+  }
+  const text = normalize(request);
+  const sshOnly =
+    project.constraints.git_transport === "ssh-only" ||
+    nativeAuthority?.constraints.git_transport === "ssh-only" ||
+    /\b(?:somente|apenas|exclusivamente|so)\s+(?:(?:por|via|com)\s+)?ssh\b|\bssh[- ]only\b/.test(
+      text,
+    );
+  const noApi =
+    project.constraints.github_api === "forbidden" ||
+    nativeAuthority?.constraints.github_api === "forbidden" ||
+    /\b(?:sem|nao\s+(?:use|usar|utilize|utilizar)|proibid[ao])\s+(?:a\s+)?api\s+(?:(?:do|de)\s+)?github\b/.test(
+      text,
+    );
+  assert(
+    !(noApi && mode === "release"),
+    "GitHub API is forbidden by the request; release requires a separately authorized API route",
+  );
+  // Builder delivery may query Actions even in commits mode. Never silently
+  // substitute that route for an explicitly API-free request.
+  assert(
+    !(noApi && kind === "builder"),
+    "GitHub API is forbidden; the builder delivery route cannot prove API-free execution",
+  );
   const authorization = {
     schema_version: 1,
     kind,
@@ -271,12 +147,55 @@ export function resolveDeployment({ request, policy, identity }) {
     version: intent.version,
     policy_sha256: digest(preference),
     request_sha256: digest(request),
+    ...(intent.completionOnly ? { completion_only: "github-and-npm" } : {}),
     identity_sha256: digest(identity),
     changes_preference: false,
     qualification: mode === "release" ? "release-essential" : "impact",
     npm_publication: kind === "builder" && mode === "release" && intent.phase === "publish",
     chat_output: "brief",
     release_notes: mode === "release" ? "reviewed-full-range" : "none",
+    ...(projectRestrictions
+      ? { project_restrictions: { ...project, policy_sha256: projectRestrictions.policy_sha256 } }
+      : {}),
+    ...(nativeAuthority
+      ? {
+          authorization: {
+            binding_id: nativeAuthority.binding_id,
+            source_run_id: nativeAuthority.source_run_id,
+            source_sha256: nativeAuthority.source_sha256,
+            steering_sha256: nativeAuthority.steering_sha256,
+            repository_sha256: nativeAuthority.repository_sha256,
+            records_workspace_sha256: nativeAuthority.records_workspace_sha256,
+            native_workspace_sha256: nativeAuthority.native_workspace_sha256,
+            client_thread_id: nativeAuthority.client_thread_id,
+            client_turn_id: nativeAuthority.client_turn_id,
+            git_only: nativeAuthority.git_only,
+            constraints: nativeAuthority.constraints,
+          },
+          candidate,
+          destination,
+        }
+      : {}),
+    ...(conditionProof
+      ? {
+          condition: {
+            task_id: conditionProof.task_id,
+            validation_id: conditionProof.validation_id,
+            authorization_run_id: conditionProof.authorization_run_id,
+            request_sha256: conditionProof.request_sha256,
+            validation_sha256: conditionProof.validation_sha256,
+            commit_sha: conditionProof.commit_sha,
+          },
+        }
+      : {}),
+    ...(sshOnly || noApi
+      ? {
+          channel_constraints: {
+            git_transport: sshOnly || noApi ? "ssh-only" : "default",
+            github_api: noApi ? "forbidden" : "default",
+          },
+        }
+      : {}),
   };
   return { ...authorization, contract_sha256: digest(authorization) };
 }
@@ -290,6 +209,8 @@ export function verifyContract(plan, input, expectedMode, expectedPhase = "publi
     JSON.stringify(plan) === JSON.stringify(actual),
     "Deployment contract changed; resolve again before any mutation",
   );
+  if (input.nativeAuthority && actual.phase === "publish")
+    assertNativePublicationContract(input.nativeAuthority, actual);
   return actual;
 }
 export function nextRelease(
@@ -347,12 +268,21 @@ export function nextRelease(
       : `${last[1]}.${BigInt(last[2]) + 1n}`;
   return { action: "new", tag: `v${version}`, version, create_release: true };
 }
-export async function readDeploymentInput(repository, request) {
+export async function readDeploymentInput(repository, request, options = {}) {
   const root = await realpath(resolve(repository));
   assert(
     (await realpath(git(root, ["rev-parse", "--show-toplevel"]))) === root,
     "Use the exact Git workspace root",
   );
+  const sourceRunId = options.source_run_id ?? options.condition?.authorization_run_id;
+  const nativeAuthority = await resolveNativePublicationAuthority(root, request, sourceRunId);
+  if (requestedDeployment(request).completionOnly) {
+    const policy = JSON.parse(git(root, ["show", "HEAD:.github/ci-validation.json"]));
+    assert(
+      policy.mode === "local_catalog",
+      "Dual-destination completion requires the idempotent local catalog publisher",
+    );
+  }
   const readJson = async (path, fallback = null) => {
     try {
       return JSON.parse(await readFile(resolve(root, path), "utf8"));
@@ -369,27 +299,68 @@ export async function readDeploymentInput(repository, request) {
   ]);
   let origin = null;
   try {
-    origin = git(root, ["remote", "get-url", "--push", "origin"]);
-  } catch {}
+    const pushes = git(root, ["remote", "get-url", "--push", "--all", "origin"])
+      .split(/\r?\n/)
+      .filter(Boolean);
+    const fetches = git(root, ["remote", "get-url", "--all", "origin"])
+      .split(/\r?\n/)
+      .filter(Boolean);
+    assert(
+      pushes.length === 1 && fetches.length === 1 && sameGitDestination(pushes[0], fetches[0]),
+      "Deployment requires one coherent origin fetch/push destination; unresolved SSH aliases require prepared authentication",
+    );
+    origin = pushes[0];
+  } catch (error) {
+    if (
+      error.message?.includes("one coherent") ||
+      error.message === "Unsafe Git destination metadata"
+    )
+      throw error;
+    throw Error("Unable to verify the exact publication origin");
+  }
+  const identity = {
+    origin,
+    rootName: manifest?.name ?? null,
+    cliName: cli?.name ?? null,
+    rootVersion: manifest?.version ?? null,
+    cliVersion: cli?.version ?? null,
+    workspaceVersion: workspace?.version ?? null,
+  };
+  const scope =
+    options.scope ?? (repositoryKind(identity) === "builder" ? "framework" : "frontend");
+  const branch = scope === "framework" ? "main" : await configuredBranch(root, scope);
   return {
     request,
-    policy,
-    identity: {
-      origin,
-      rootName: manifest?.name ?? null,
-      cliName: cli?.name ?? null,
-      rootVersion: manifest?.version ?? null,
-      cliVersion: cli?.version ?? null,
-      workspaceVersion: workspace?.version ?? null,
+    nativeAuthority,
+    projectRestrictions: await readPublicationProjectPolicy(root),
+    candidate: {
+      sha: git(root, ["rev-parse", "HEAD"]),
+      repository_sha256: nativeAuthority.repository_sha256,
     },
+    destination: { remote: "origin", url: origin, scope, branch },
+    conditionProof: await resolvePublicationCondition(
+      root,
+      request,
+      options.condition,
+      nativeAuthority,
+    ),
+    policy,
+    identity,
   };
 }
-async function main() {
+export async function main() {
   const { values } = parseArgs({
     options: {
       repository: { type: "string", default: "." },
       "request-file": { type: "string" },
       "plan-file": { type: "string" },
+      "condition-task": { type: "string" },
+      "condition-validation": { type: "string" },
+      "condition-run": { type: "string" },
+      "authorization-run": { type: "string" },
+      scope: { type: "string" },
+      "codex-hook-id": { type: "string" },
+      "codex-hook-thread": { type: "string" },
     },
     strict: true,
   });
@@ -397,8 +368,23 @@ async function main() {
   const input = await readDeploymentInput(
     values.repository,
     await readFile(resolve(values["request-file"]), "utf8"),
+    {
+      source_run_id: values["authorization-run"],
+      scope: values.scope,
+      condition:
+        values["condition-task"] || values["condition-validation"] || values["condition-run"]
+          ? {
+              task_id: values["condition-task"],
+              validation_id: values["condition-validation"],
+              authorization_run_id: values["condition-run"],
+            }
+          : undefined,
+    },
   );
   const plan = resolveDeployment(input);
+  // Discovery before qualification must not consume the immutable candidate binding.
+  if (input.nativeAuthority && values["plan-file"])
+    await bindQualifiedPublicationPlan(values.repository, values["plan-file"], input, plan, git);
   if (values["plan-file"])
     await writeFile(resolve(values["plan-file"]), `${JSON.stringify(plan, null, 2)}\n`, {
       flag: "wx",
@@ -410,3 +396,5 @@ if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.ur
     process.stderr.write(`${error.message}\n`);
     process.exitCode = 1;
   });
+
+export { requestedDeployment } from "./deployment-request.mjs";