persona-harness 0.7.0 → 0.8.0-beta.2

package/CHANGELOG.md

@@ -8,6 +8,28 @@ preparation alone does not establish stable support or channel state.
 
 ## Unreleased
 
+## [0.8.0-beta.1] - 2026-07-24
+
+- Prepares the immutable Consumer Authority Beta source candidate for a
+  staging-only lifecycle. At candidate creation, no `0.8.0-beta.1` package,
+  tag, GitHub release, registry channel, or promotion fact is asserted.
+- Adds the packaged public enrollment/fetch/status boundary for original public
+  project finish artifacts. It stays user-scoped, fixed-origin, non-consuming,
+  and fail-closed; local receipts, copied JSON, and package-release evidence
+  cannot supply consumer authority. GitHub credentials authenticate fixed
+  public Actions reads only; they are not identity inputs and are never sent to
+  artifact-storage redirects.
+- Makes live Sigstore trust availability observable without weakening
+  authority: verification now distinguishes bounded DNS, network, trust-root,
+  timeout, signature, certificate, transparency, and malformed-bundle states;
+  `ph doctor` reports live network/trust-root readiness through a fixed
+  whole-worker deadline and a parent-cleaned temporary cache.
+- Requires the eventual manual staging publish to bind an existing immutable
+  `v0.8.0-beta.1` tag to the exact protected-main commit, then records bounded
+  registry version, gitHead, SHA-1, SRI, SHA-256, and selected-tag readback.
+  The sanitized readback is retained with its Actions artifact digest.
+  Exact-artifact provenance remains a separate staged producer/audit gate.
+
 ## [0.7.0] - 2026-07-17
 
 - Prepares the immutable `0.7.0` stable source candidate. At candidate

package/README.ja.md

@@ -10,7 +10,7 @@
 
 [![npm version](https://img.shields.io/npm/v/persona-harness?color=369eff&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
 [![npm downloads](https://img.shields.io/npm/dt/persona-harness?color=ff6b35&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![node](https://img.shields.io/badge/node-%3E%3D20-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
+[![node](https://img.shields.io/badge/node-%5E20.17.0%20%7C%7C%20%3E%3D22.9.0-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
 [![License](https://img.shields.io/badge/license-Apache--2.0-white?labelColor=black&style=flat-square)](./LICENSE)
 
 [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-cn.md)
@@ -50,7 +50,7 @@ AI エージェントが行う Java/Spring バックエンド作業のための
 
 ## インストール
 
-Node.js 20+、Java 21+ / Gradle、そしてプロバイダーが設定済みの OpenCode CLI が必要です。
+Node.js ^20.17.0 || >=22.9.0（Node 21 は未対応）、Java 21+ / Gradle、そしてプロバイダーが設定済みの OpenCode CLI が必要です。
 
 ```bash
 # OpenCode

package/README.ko.md

@@ -10,7 +10,7 @@
 
 [![npm version](https://img.shields.io/npm/v/persona-harness?color=369eff&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
 [![npm downloads](https://img.shields.io/npm/dt/persona-harness?color=ff6b35&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![node](https://img.shields.io/badge/node-%3E%3D20-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
+[![node](https://img.shields.io/badge/node-%5E20.17.0%20%7C%7C%20%3E%3D22.9.0-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
 [![License](https://img.shields.io/badge/license-Apache--2.0-white?labelColor=black&style=flat-square)](./LICENSE)
 
 [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-cn.md)
@@ -50,7 +50,7 @@ AI 에이전트가 수행하는 Java/Spring 백엔드 작업을 위한 workflow
 
 ## 설치
 
-Node.js 20+, Java 21+ / Gradle, 그리고 프로바이더가 설정된 OpenCode CLI가 필요합니다.
+Node.js ^20.17.0 || >=22.9.0 (Node 21은 지원하지 않음), Java 21+ / Gradle, 그리고 프로바이더가 설정된 OpenCode CLI가 필요합니다.
 
 ```bash
 # OpenCode

package/README.md

@@ -10,7 +10,7 @@
 
 [![npm version](https://img.shields.io/npm/v/persona-harness?color=369eff&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
 [![npm downloads](https://img.shields.io/npm/dt/persona-harness?color=ff6b35&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![node](https://img.shields.io/badge/node-%3E%3D20-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
+[![node](https://img.shields.io/badge/node-%5E20.17.0%20%7C%7C%20%3E%3D22.9.0-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
 [![License](https://img.shields.io/badge/license-Apache--2.0-white?labelColor=black&style=flat-square)](./LICENSE)
 
 [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-cn.md)
@@ -58,7 +58,7 @@ earned by measurement first — see [MEASURED-CLAIMS](docs/MEASURED-CLAIMS.md).
 
 ## Install
 
-Requires Node.js 20+, Java 21+ / Gradle, and the OpenCode CLI with a configured provider.
+Requires Node.js ^20.17.0 || >=22.9.0 (Node 21 is unsupported), Java 21+ / Gradle, and the OpenCode CLI with a configured provider.
 
 ```bash
 # OpenCode
@@ -137,6 +137,7 @@ npx ph workflow check | implement | finish implement | archive <ticket-id>
 npx ph workflow split README.md && npx ph workflow next   # multi-ticket
 npx ph bearshell --shell 'gradle test'                    # bounded execution
 npx ph evidence summary | metrics --json | ab-report --json | pminus-report --json
+npx ph authority status | enroll github <owner/repository> --workflow <path> | fetch github [owner/repository]
 npx ph review backend-shape
 ```
 
@@ -151,13 +152,40 @@ do not change the P0-3 root CLI discovery contract.
 
 ## Platform And Host Support
 
+### Node runtime floor
+
+The packaged CLI and its product-owned Sigstore authority verifiers require
+Node.js ^20.17.0 || >=22.9.0. `ph doctor` reports this range without reflecting
+unsafe runtime input; a lower or malformed runtime blocks CLI authority work
+before verification. Repository source tests use a stricter Vite toolchain
+floor (Node 20.19.0 or Node 22.12.0+), which is distinct from the published
+package engine.
+
+On a supported runtime, `ph doctor` makes fixed, read-only npm registry
+readbacks for this installed package version's deprecation field and the
+`latest`, `next`, `staging`, and legacy (`legacy`/`alpha`) channels. Missing,
+malformed, oversized, or unsafe registry data becomes a bounded diagnostic.
+Registry channels never grant Finish authority. External assurance readiness is
+a separate non-consuming inspection and does not move registry or trust state.
+For a public enrolled project, `ph authority enroll github ...` requires an
+interactive confirmation, and `ph authority fetch github` retrieves only a
+matching original public artifact through fixed GitHub policy. Set `GH_TOKEN`
+or `GITHUB_TOKEN` to a credential with Actions read access; the credential
+authenticates fixed GitHub API requests only and cannot supply repository,
+workflow, source, digest, or redirect identity. When more than one repository
+is enrolled, pass the selected enrolled `owner/repository` to `fetch github`.
+Neither command publishes a package, moves a channel, or consumes Finish
+authority.
+
 | Surface | Status | Evidence boundary |
 | --- | --- | --- |
-| Linux + OpenCode | Supported matrix | Node 20, 22, and 24 each run source-built checks plus a fresh local-tarball installed black-box check. |
-| macOS + OpenCode | Limited smoke | macOS Node 22 smoke only; this is not a promise of macOS Node 20/24 coverage. |
+| Linux + OpenCode | Product: Node ^20.17.0 || >=22.9.0; source checks: Node 20.19.0 | Required Verify repository runs Linux Node 20.19.0 source-built, packed-tarball, and fresh local-tarball installed checks on pull requests and main pushes. The dispatch-only support matrix retains exact product-floor Linux Node 20.17.0 and 22.9.0 imports plus latest Linux Node 20, 22, and 24 on demand. |
+| macOS + OpenCode | Manual limited smoke | The dispatch-only support matrix retains macOS Node 22 smoke only; this is not a promise of macOS Node 20/24 coverage. |
 | Windows | Unverified / nonblocking | No Windows matrix job or support claim. Lock identity device/inode behavior and stale-lock/concurrency conclusions are not measured or verified. |
 | Codex adapter | Planned | No current Codex adapter or Codex product evidence; this is a planned adapter only. |
 
+Automatic CI boundary: Verify repository is the required Linux Node 20.19.0 PR/main gate. The dispatch-only support matrix is deferred multi-runtime evidence, not a required PR/main gate. It is distinct from the canonical clean-CI builder's main-push signed evidence and the ordinary path-filtered diagnostic selftest.
+
 ## Boundaries & safety
 
 Evidence answers one bounded question — *"What did this PH workflow observe for

package/README.zh-cn.md

@@ -10,7 +10,7 @@
 
 [![npm version](https://img.shields.io/npm/v/persona-harness?color=369eff&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
 [![npm downloads](https://img.shields.io/npm/dt/persona-harness?color=ff6b35&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![node](https://img.shields.io/badge/node-%3E%3D20-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
+[![node](https://img.shields.io/badge/node-%5E20.17.0%20%7C%7C%20%3E%3D22.9.0-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
 [![License](https://img.shields.io/badge/license-Apache--2.0-white?labelColor=black&style=flat-square)](./LICENSE)
 
 [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-cn.md)
@@ -50,7 +50,7 @@
 
 ## 安装
 
-需要 Node.js 20+、Java 21+ / Gradle，以及已配置供应商的 OpenCode CLI。
+需要 Node.js ^20.17.0 || >=22.9.0（不支持 Node 21）、Java 21+ / Gradle，以及已配置供应商的 OpenCode CLI。
 
 ```bash
 # OpenCode

package/dist/cli/authority-artifact-store.d.ts

@@ -0,0 +1,20 @@
+import { type AuthorityEnrollmentStoreOptions } from "./authority-enrollment.js";
+export type AuthorityArtifact = {
+    readonly archive: Buffer;
+    readonly artifactDigest: string;
+    readonly fetchedAt: string;
+    readonly repositoryId: number;
+    readonly runId: string;
+    readonly sourceHead: string;
+};
+export type AuthorityArtifactRead = {
+    readonly state: "invalid";
+} | {
+    readonly state: "missing";
+} | {
+    readonly state: "ready";
+    readonly value: AuthorityArtifact;
+};
+export declare function authorityArtifactPath(repositoryId: number, options?: Pick<AuthorityEnrollmentStoreOptions, "storeRoot">): string | undefined;
+export declare function readAuthorityArtifact(repositoryId: number, options?: Pick<AuthorityEnrollmentStoreOptions, "storeRoot">): AuthorityArtifactRead;
+export declare function writeAuthorityArtifact(artifact: AuthorityArtifact, options?: AuthorityEnrollmentStoreOptions): boolean;

package/dist/cli/authority-artifact-store.js

@@ -0,0 +1,176 @@
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeSync, } from "node:fs";
+import { join } from "node:path";
+import { extractOriginalArtifactMembers } from "../../scripts/consumer-authority-artifact-archive.mjs";
+import { authorityStoreRoot, } from "./authority-enrollment.js";
+import { captureNoFollowDirectory, readNoFollowRegularFile, } from "../io/no-follow-file.js";
+const AUTHORITY_ARTIFACT_SCHEMA = "consumer-authority-original-artifact.1";
+const MAX_ARCHIVE_BYTES = 8 * 1024 * 1024;
+const MAX_STORE_BYTES = 12 * 1024 * 1024;
+export function authorityArtifactPath(repositoryId, options = {}) {
+    return isPositiveInteger(repositoryId)
+        ? join(authorityStoreRoot(options), `consumer-authority-artifact-${repositoryId}.json`)
+        : undefined;
+}
+export function readAuthorityArtifact(repositoryId, options = {}) {
+    const path = authorityArtifactPath(repositoryId, options);
+    if (path === undefined)
+        return { state: "invalid" };
+    const root = authorityStoreRoot(options);
+    const directory = captureNoFollowDirectory(root);
+    if (directory.kind === "absent")
+        return { state: "missing" };
+    if (directory.kind !== "ready")
+        return { state: "invalid" };
+    const source = readNoFollowRegularFile(path, MAX_STORE_BYTES, root);
+    if (source.kind === "absent")
+        return { state: "missing" };
+    if (source.kind !== "ready")
+        return { state: "invalid" };
+    return parseStoredArtifact(source.value.bytes) ?? { state: "invalid" };
+}
+export function writeAuthorityArtifact(artifact, options = {}) {
+    if (!isAuthorityArtifact(artifact))
+        return false;
+    const path = authorityArtifactPath(artifact.repositoryId, options);
+    if (path === undefined)
+        return false;
+    const root = authorityStoreRoot(options);
+    const directory = preparePrivateStoreRoot(root);
+    if (directory === undefined)
+        return false;
+    const payload = `${JSON.stringify({
+        archiveBase64: artifact.archive.toString("base64"),
+        artifactDigest: artifact.artifactDigest,
+        fetchedAt: artifact.fetchedAt,
+        repositoryId: artifact.repositoryId,
+        runId: artifact.runId,
+        schemaVersion: AUTHORITY_ARTIFACT_SCHEMA,
+        sourceHead: artifact.sourceHead,
+    })}\n`;
+    return writePrivateStoreFile(root, path, payload, directory);
+}
+function parseStoredArtifact(bytes) {
+    try {
+        const value = JSON.parse(bytes.toString("utf8"));
+        if (!isRecord(value) || !exactKeys(value, [
+            "archiveBase64",
+            "artifactDigest",
+            "fetchedAt",
+            "repositoryId",
+            "runId",
+            "schemaVersion",
+            "sourceHead",
+        ])) {
+            return undefined;
+        }
+        if (value.schemaVersion !== AUTHORITY_ARTIFACT_SCHEMA
+            || typeof value.archiveBase64 !== "string"
+            || typeof value.artifactDigest !== "string"
+            || typeof value.fetchedAt !== "string"
+            || !isPositiveInteger(value.repositoryId)
+            || typeof value.runId !== "string"
+            || typeof value.sourceHead !== "string") {
+            return undefined;
+        }
+        const archive = Buffer.from(value.archiveBase64, "base64");
+        const artifact = {
+            archive,
+            artifactDigest: value.artifactDigest,
+            fetchedAt: value.fetchedAt,
+            repositoryId: value.repositoryId,
+            runId: value.runId,
+            sourceHead: value.sourceHead,
+        };
+        return isAuthorityArtifact(artifact) ? { state: "ready", value: artifact } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isAuthorityArtifact(value) {
+    if (value.archive.byteLength === 0
+        || value.archive.byteLength > MAX_ARCHIVE_BYTES
+        || !isDigest(value.artifactDigest)
+        || value.artifactDigest !== digest(value.archive)
+        || !isTimestamp(value.fetchedAt)
+        || !isPositiveInteger(value.repositoryId)
+        || !isRunId(value.runId)
+        || !isCommit(value.sourceHead)) {
+        return false;
+    }
+    try {
+        extractOriginalArtifactMembers(value.archive);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function preparePrivateStoreRoot(root) {
+    try {
+        mkdirSync(root, { mode: 0o700, recursive: true });
+    }
+    catch {
+        return undefined;
+    }
+    const directory = captureNoFollowDirectory(root);
+    return directory.kind === "ready" ? directory.value : undefined;
+}
+function writePrivateStoreFile(root, path, payload, before) {
+    const temporaryPath = join(root, `.consumer-authority-artifact-${randomUUID()}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_WRONLY, 0o600);
+        writeSync(descriptor, payload, 0, "utf8");
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        const afterWrite = captureNoFollowDirectory(root);
+        if (afterWrite.kind !== "ready" || !sameDirectoryLocation(before, afterWrite.value))
+            return false;
+        renameSync(temporaryPath, path);
+        const afterRename = captureNoFollowDirectory(root);
+        if (afterRename.kind !== "ready" || !sameDirectoryLocation(before, afterRename.value))
+            return false;
+        const source = readNoFollowRegularFile(path, MAX_STORE_BYTES, root);
+        return source.kind === "ready" && source.value.bytes.toString("utf8") === payload;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        rmSync(temporaryPath, { force: true });
+    }
+}
+function exactKeys(value, keys) {
+    const actual = Object.keys(value).sort();
+    return actual.length === keys.length && actual.every((key, index) => key === keys[index]);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPositiveInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function isRunId(value) {
+    return /^[1-9][0-9]{0,18}$/u.test(value);
+}
+function isCommit(value) {
+    return /^[a-f0-9]{40}$/iu.test(value);
+}
+function isTimestamp(value) {
+    return Number.isFinite(Date.parse(value));
+}
+function isDigest(value) {
+    return /^sha256:[a-f0-9]{64}$/iu.test(value);
+}
+function digest(bytes) {
+    return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function sameDirectoryLocation(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+//# sourceMappingURL=authority-artifact-store.js.map

package/dist/cli/authority-artifact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-artifact-store.js","sourceRoot":"","sources":["../../src/cli/authority-artifact-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,UAAU,EACV,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EACL,kBAAkB,GAEnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GAExB,MAAM,yBAAyB,CAAA;AAEhC,MAAM,yBAAyB,GAAG,wCAAiD,CAAA;AACnF,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACzC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAgBxC,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,UAA8D,EAAE;IAEhE,OAAO,iBAAiB,CAAC,YAAY,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,+BAA+B,YAAY,OAAO,CAAC;QACvF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,UAA8D,EAAE;IAEhE,MAAM,IAAI,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC5D,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC3D,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACxD,OAAO,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA2B,EAC3B,UAA2C,EAAE;IAE7C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,yBAAyB;QACxC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,IAAI,CAAA;IACN,OAAO,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YACxC,eAAe;YACf,gBAAgB;YAChB,WAAW;YACX,cAAc;YACd,OAAO;YACP,eAAe;YACf,YAAY;SACb,CAAC,EAAE,CAAC;YACH,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IACE,KAAK,CAAC,aAAa,KAAK,yBAAyB;eAC9C,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;eACvC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;eACxC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;eACnC,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC;eACtC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;eAC/B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAsB;YAClC,OAAO;YACP,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAA;QACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACnD,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,CAAC;WAC3B,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,iBAAiB;WAC5C,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;WAC/B,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;WAC9C,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;WAC7B,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC;WACtC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WACrB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjE,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,MAA4B;IAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,gCAAgC,UAAU,EAAE,MAAM,CAAC,CAAA;IACpF,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC7H,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;QACzC,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,SAAS,CAAC,UAAU,CAAC,CAAA;QACrB,UAAU,GAAG,SAAS,CAAA;QACtB,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACjG,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACnG,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAA;QACnE,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,OAAO,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAuB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACrE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA0B,EAAE,KAA2B;IACpF,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAA;AACrF,CAAC"}

package/dist/cli/authority-command-surface.d.ts

@@ -0,0 +1,27 @@
+import type { CliRunResult } from "./bearshell.js";
+export type AuthorityStatus = {
+    readonly authorityEligible: boolean;
+    readonly consumptionState: "consumed" | "not-applicable" | "unconsumed";
+    readonly enrollment: "available" | "unavailable";
+    readonly githubAuthentication: "available" | "unavailable";
+    readonly next: "authority-enroll-github" | "authority-fetch-github" | "github-authenticate" | "workflow-finish";
+    readonly state: "authentication-unavailable" | "enrollment-unavailable" | "missing" | "trusted";
+};
+export type AuthorityFetchArgs = {
+    readonly json: boolean;
+    readonly repositorySlug?: string;
+};
+export declare function authorityUsage(invocationName?: string): string;
+export declare function parseReadOnlyArgs(args: readonly string[]): {
+    readonly json: boolean;
+} | undefined;
+export declare function parseFetchArgs(args: readonly string[]): AuthorityFetchArgs | undefined;
+export declare function parseEnrollmentArgs(args: readonly string[]): {
+    readonly repositorySlug: string;
+    readonly workflowPath: string;
+} | undefined;
+export declare function textStatus(summary: AuthorityStatus, explain: boolean): CliRunResult;
+export declare function jsonStatus(summary: AuthorityStatus): CliRunResult;
+export declare function invalidAuthorityCommand(invocationName: string): CliRunResult;
+export declare function blockedFetch(json: boolean, state: string, next?: AuthorityStatus["next"]): CliRunResult;
+export declare function githubAuthenticationRequired(): CliRunResult;

package/dist/cli/authority-command-surface.js

@@ -0,0 +1,109 @@
+import { authorityEnrollmentFromReadback } from "./authority-enrollment.js";
+export function authorityUsage(invocationName = "ph") {
+    return [
+        `Usage: ${invocationName} authority <status|explain|enroll|fetch> [args...]`,
+        "",
+        "Commands:",
+        "  status [--json]                         Inspect non-consuming external authority readiness.",
+        "  explain [--json]                        Explain the bounded next authority step.",
+        "  enroll github <owner/repository> --workflow <path>",
+        "                                         Interactively enroll a public GitHub workflow pin.",
+        "  fetch github [owner/repository] [--json]",
+        "                                         Fetch matching original public evidence without consuming it.",
+    ].join("\n");
+}
+export function parseReadOnlyArgs(args) {
+    return args.length === 0 ? { json: false } : args.length === 1 && args[0] === "--json" ? { json: true } : undefined;
+}
+export function parseFetchArgs(args) {
+    if (args.length === 1 && args[0] === "github")
+        return { json: false };
+    if (args.length === 2 && args[0] === "github" && args[1] === "--json")
+        return { json: true };
+    const repositorySlug = args[1];
+    if (args[0] !== "github" || !isPublicRepositorySlug(repositorySlug))
+        return undefined;
+    if (args.length === 2)
+        return { json: false, repositorySlug };
+    return args.length === 3 && args[2] === "--json" ? { json: true, repositorySlug } : undefined;
+}
+export function parseEnrollmentArgs(args) {
+    if (args.length !== 4 || args[0] !== "github" || args[2] !== "--workflow")
+        return undefined;
+    const repositorySlug = args[1];
+    const workflowPath = args[3];
+    const enrollment = authorityEnrollmentFromReadback({
+        callerWorkflowPath: workflowPath,
+        repositoryId: 1,
+        repositorySlug: repositorySlug ?? "",
+        reusableWorkflowSha: "a".repeat(40),
+    });
+    return enrollment === undefined || repositorySlug === undefined
+        ? undefined
+        : { repositorySlug, workflowPath: enrollment.callerWorkflowPath };
+}
+export function textStatus(summary, explain) {
+    const state = summary.state === "trusted" ? "TRUSTED" : "BLOCKED";
+    return {
+        status: summary.authorityEligible ? 0 : 1,
+        stdout: [
+            `Enrollment: ${summary.enrollment}`,
+            `GitHub authentication: ${summary.githubAuthentication}`,
+            `External authority: ${state}`,
+            `Consumption: ${summary.consumptionState}`,
+            `Next: ${nextText(summary.next, explain)}`,
+        ].join("\n") + "\n",
+        stderr: "",
+    };
+}
+export function jsonStatus(summary) {
+    return {
+        status: summary.authorityEligible ? 0 : 1,
+        stdout: `${JSON.stringify({ schemaVersion: "consumer-authority-status.1", ...summary })}\n`,
+        stderr: "",
+    };
+}
+export function invalidAuthorityCommand(invocationName) {
+    return { status: 1, stdout: "", stderr: `${authorityUsage(invocationName)}\n` };
+}
+export function blockedFetch(json, state, next = "authority-fetch-github") {
+    return {
+        status: 1,
+        stdout: json
+            ? `${JSON.stringify({
+                authorityEligible: false,
+                consumptionState: "not-applicable",
+                next,
+                schemaVersion: "consumer-authority-fetch.1",
+                state,
+            })}\n`
+            : `Consumer authority fetch: BLOCKED (${state}). No evidence was retained or consumed.\n`,
+        stderr: "",
+    };
+}
+export function githubAuthenticationRequired() {
+    return {
+        status: 1,
+        stdout: "",
+        stderr: "GitHub authentication is required. Set GH_TOKEN or GITHUB_TOKEN to a credential with Actions read access for the public repository.\n",
+    };
+}
+function nextText(next, explain) {
+    if (next === "github-authenticate")
+        return explain
+            ? "Set GH_TOKEN or GITHUB_TOKEN to a credential with Actions read access for the enrolled public repository."
+            : "github-authenticate";
+    if (next === "authority-enroll-github")
+        return explain ? "Enroll a public GitHub workflow through an interactive confirmation." : "authority-enroll-github";
+    if (next === "authority-fetch-github")
+        return explain ? "Fetch matching original public evidence without consuming it." : "authority-fetch-github";
+    return explain ? "Run workflow finish; only Finish may consume external authority." : "workflow-finish";
+}
+function isPublicRepositorySlug(value) {
+    return typeof value === "string"
+        && value.length > 0
+        && value.length <= 256
+        && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(value)
+        && !value.split("/").some((part) => part === "." || part === "..");
+}
+//# sourceMappingURL=authority-command-surface.js.map

package/dist/cli/authority-command-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-command-surface.js","sourceRoot":"","sources":["../../src/cli/authority-command-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAiB3E,MAAM,UAAU,cAAc,CAAC,cAAc,GAAG,IAAI;IAClD,OAAO;QACL,UAAU,cAAc,oDAAoD;QAC5E,EAAE;QACF,WAAW;QACX,+FAA+F;QAC/F,oFAAoF;QACpF,sDAAsD;QACtD,6FAA6F;QAC7F,4CAA4C;QAC5C,wGAAwG;KACzG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACrH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC5F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAA;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IAIzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAA;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,UAAU,GAAG,+BAA+B,CAAC;QACjD,kBAAkB,EAAE,YAAY;QAChC,YAAY,EAAE,CAAC;QACf,cAAc,EAAE,cAAc,IAAI,EAAE;QACpC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAC7D,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,OAAgB;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE;YACN,eAAe,OAAO,CAAC,UAAU,EAAE;YACnC,0BAA0B,OAAO,CAAC,oBAAoB,EAAE;YACxD,uBAAuB,KAAK,EAAE;YAC9B,gBAAgB,OAAO,CAAC,gBAAgB,EAAE;YAC1C,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;SAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;QACnB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI;QAC3F,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,KAAa,EACb,OAAgC,wBAAwB;IAExD,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,gBAAgB,EAAE,gBAAgB;gBAClC,IAAI;gBACJ,aAAa,EAAE,4BAA4B;gBAC3C,KAAK;aACN,CAAC,IAAI;YACN,CAAC,CAAC,sCAAsC,KAAK,4CAA4C;QAC3F,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,uIAAuI;KAChJ,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA6B,EAAE,OAAgB;IAC/D,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,OAAO;YAChD,CAAC,CAAC,2GAA2G;YAC7G,CAAC,CAAC,qBAAqB,CAAA;IACzB,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,yBAAyB,CAAA;IAC3J,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAClJ,OAAO,OAAO,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,iBAAiB,CAAA;AACzG,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;WAChB,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAA;AACtE,CAAC"}

package/dist/cli/authority-command.d.ts

@@ -0,0 +1,18 @@
+import { type AuthorityArtifact } from "./authority-artifact-store.js";
+import { type AuthorityEnrollment, type AuthorityEnrollmentReadback, type AuthorityEnrollmentStoreOptions } from "./authority-enrollment.js";
+import { type AuthorityStatus } from "./authority-command-surface.js";
+import { type ProjectFinishAttestationVerifierAssessment } from "./project-finish-attestation-verifier.js";
+import type { CliRunResult } from "./bearshell.js";
+type AuthorityCommandOptions = AuthorityEnrollmentStoreOptions & {
+    readonly artifactFetch?: (projectDir: string, enrollment: AuthorityEnrollment) => AuthorityArtifact | undefined;
+    readonly artifactInspector?: (projectDir: string, enrollment: AuthorityEnrollment, archive: Buffer, now: Date) => ProjectFinishAttestationVerifierAssessment;
+    readonly confirmEnrollment?: boolean;
+    readonly enrollmentReadback?: (repositorySlug: string, workflowPath: string) => AuthorityEnrollmentReadback | undefined;
+    readonly githubToken?: string;
+    readonly projectDir?: string;
+};
+export { authorityUsage } from "./authority-command-surface.js";
+export { authorityEnrollmentFromReadback, readAuthorityEnrollment, } from "./authority-enrollment.js";
+export type { AuthorityStatus } from "./authority-command-surface.js";
+export declare function runAuthorityCommand(args: readonly string[], options?: AuthorityCommandOptions, invocationName?: string): CliRunResult;
+export declare function readAuthorityStatus(options?: AuthorityCommandOptions): AuthorityStatus;