import type { SurfaceRouteFamily } from "../surfaces/boundary-manifest"; import { CLI_SCHEMA_VERSION } from "./output"; export type CliCommandStatus = "active" | "deferred"; export type CliCommandPlane = "operator" | "evidence"; export type CliCommandCustodyRole = "none" | "review_custody"; export type CliCommandManifestEntry = { readonly id: string; readonly aliases: readonly string[]; readonly status: CliCommandStatus; readonly plane: CliCommandPlane; readonly custodyRole: CliCommandCustodyRole; readonly routeFamilies: readonly SurfaceRouteFamily[]; readonly filesystemReads: readonly string[]; readonly filesystemWrites: readonly string[]; readonly childProcessEnvInheritance: "none"; readonly outputSchema: typeof CLI_SCHEMA_VERSION; readonly agentSafe: boolean; readonly redactionPosture: "redacted_projection_only" | "local_certificate_verification" | "manifest_only"; readonly nonGoals: readonly string[]; }; export declare const cliServiceWorkflowPosture: "CLI surface only: local setup, readiness, and evidence readback; does not create ServiceWorkflowAdmission, ServiceWorkflowHandle, clearance, policy decision, greenlight, gateway check, mutation, receipt export, or certificate."; export declare const cliCommandManifest: readonly [{ readonly id: "schema"; readonly aliases: readonly ["schema"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly []; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "manifest_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "init"; readonly aliases: readonly ["init"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly []; readonly filesystemWrites: readonly [".handshake/project.json", "external role credential profile without token values"]; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "manifest_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "doctor"; readonly aliases: readonly ["doctor"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly [".handshake/project.json", "external role credential profile", "explicit trust bundle ref"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "manifest_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "evidence.aps-report"; readonly aliases: readonly ["evidence aps-report"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly ["explicit aps report json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "evidence.fetch"; readonly aliases: readonly ["evidence fetch"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly ["evidence_projection_read"]; readonly filesystemReads: readonly ["optional local .handshake/evidence/operations readback json when --cwd is set", "HANDSHAKE_BASE_URL or --base-url HTTP evidence readback"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "evidence.contract-view"; readonly aliases: readonly ["evidence contract-view"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly ["evidence_projection_read"]; readonly filesystemReads: readonly ["explicit redacted contract projection json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "evidence.receipt-timeline"; readonly aliases: readonly ["evidence receipt-timeline"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly ["evidence_projection_read"]; readonly filesystemReads: readonly ["explicit redacted receipt timeline projection json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "cert.verify"; readonly aliases: readonly ["cert verify"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly ["certificate_verify_local"]; readonly filesystemReads: readonly ["explicit certificate json path", "explicit trust bundle json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "local_certificate_verification"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "support.bundle"; readonly aliases: readonly ["support bundle"]; readonly status: "active"; readonly plane: "evidence"; readonly custodyRole: "review_custody"; readonly routeFamilies: readonly ["evidence_projection_read", "install_health_read"]; readonly filesystemReads: readonly ["explicit support bundle input json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "receipt export", "raw record dump", "trusted install readiness"]; }, { readonly id: "install.x402-payment"; readonly aliases: readonly ["install x402-payment"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly ["explicit x402 install proposal json path", ".handshake/project.json"]; readonly filesystemWrites: readonly ["external local x402 install posture ref when --record-local is supplied"]; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "signer use", "live control-plane registration", "broad x402 compatibility"]; }, { readonly id: "probes.x402-payment"; readonly aliases: readonly ["probes x402-payment"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly ["install_health_read"]; readonly filesystemReads: readonly ["explicit x402 gateway posture json path", ".handshake/project.json"]; readonly filesystemWrites: readonly ["external local x402 probe report ref when --record-local is supplied"]; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "gateway check", "provider certification"]; }, { readonly id: "register.x402-gateway-readiness"; readonly aliases: readonly ["register x402-gateway-readiness"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly ["install_health_read"]; readonly filesystemReads: readonly ["explicit x402 gateway readiness registration json path", ".handshake/project.json", "external local x402 install/probe refs"]; readonly filesystemWrites: readonly ["external local x402 trusted readiness ref when --record-local is supplied"]; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "policy evaluation", "greenlight creation", "gateway check", "signer use", "payment payload creation"]; }, { readonly id: "install.health"; readonly aliases: readonly ["install health"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly ["install_health_read"]; readonly filesystemReads: readonly [".handshake/project.json", "external local x402 install/probe refs"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"]; }, { readonly id: "host.doctor"; readonly aliases: readonly ["host doctor"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly [".handshake/project.json", "external role credential profile"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "manifest_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "parallel identity system", "gateway readiness certification"]; }, { readonly id: "quickstart.x402"; readonly aliases: readonly ["quickstart x402"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly [".handshake/project.json", "optional x402 install input json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live control-plane registration", "signer use"]; }, { readonly id: "quickstart.agent-spine"; readonly aliases: readonly ["quickstart agent-spine"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly [".handshake/project.json"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "bundled execute API", "greenlight reuse", "authority creation", "live x402 operation beyond quickstart scope"]; }, { readonly id: "simulate.x402-payment"; readonly aliases: readonly ["simulate x402-payment"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly [".handshake/project.json"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live wallet operation", "bundled execute API", "greenlight reuse"]; }, { readonly id: "conformance.x402-payment"; readonly aliases: readonly ["conformance x402-payment"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly []; readonly filesystemReads: readonly []; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: true; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "broad x402 compatibility"]; }, { readonly id: "service.bootstrap"; readonly aliases: readonly ["service bootstrap"]; readonly status: "active"; readonly plane: "operator"; readonly custodyRole: "none"; readonly routeFamilies: readonly ["install_health_read"]; readonly filesystemReads: readonly [".handshake/project.json", "optional x402 install input json path"]; readonly filesystemWrites: readonly []; readonly childProcessEnvInheritance: "none"; readonly outputSchema: "handshake.cli.v1"; readonly agentSafe: false; readonly redactionPosture: "redacted_projection_only"; readonly nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live wallet mutation", "second action-family install", "orphan catalog without compiled-records transition", "signer use"]; }]; export declare function cliSchemaOutput(): { id: "schema" | "init" | "doctor" | "evidence.aps-report" | "evidence.fetch" | "evidence.contract-view" | "evidence.receipt-timeline" | "cert.verify" | "support.bundle" | "install.x402-payment" | "probes.x402-payment" | "register.x402-gateway-readiness" | "install.health" | "host.doctor" | "quickstart.x402" | "quickstart.agent-spine" | "simulate.x402-payment" | "conformance.x402-payment" | "service.bootstrap"; aliases: readonly ["schema"] | readonly ["init"] | readonly ["doctor"] | readonly ["evidence aps-report"] | readonly ["evidence fetch"] | readonly ["evidence contract-view"] | readonly ["evidence receipt-timeline"] | readonly ["cert verify"] | readonly ["support bundle"] | readonly ["install x402-payment"] | readonly ["probes x402-payment"] | readonly ["register x402-gateway-readiness"] | readonly ["install health"] | readonly ["host doctor"] | readonly ["quickstart x402"] | readonly ["quickstart agent-spine"] | readonly ["simulate x402-payment"] | readonly ["conformance x402-payment"] | readonly ["service bootstrap"]; status: "active"; plane: "evidence" | "operator"; custodyRole: "review_custody" | "none"; outputSchema: "handshake.cli.v1"; agentSafe: boolean; redactionPosture: "redacted_projection_only" | "local_certificate_verification" | "manifest_only"; nonGoals: readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "receipt export", "raw record dump", "trusted install readiness"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "signer use", "live control-plane registration", "broad x402 compatibility"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "gateway check", "provider certification"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "policy evaluation", "greenlight creation", "gateway check", "signer use", "payment payload creation"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "parallel identity system", "gateway readiness certification"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live control-plane registration", "signer use"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "bundled execute API", "greenlight reuse", "authority creation", "live x402 operation beyond quickstart scope"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live wallet operation", "bundled execute API", "greenlight reuse"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "broad x402 compatibility"] | readonly ["policy evaluation", "gateway check", "protected mutation", "credential custody", "raw record access", "process startup", "workflow handle authority", "live wallet mutation", "second action-family install", "orphan catalog without compiled-records transition", "signer use"]; workflowPosture: "CLI surface only: local setup, readiness, and evidence readback; does not create ServiceWorkflowAdmission, ServiceWorkflowHandle, clearance, policy decision, greenlight, gateway check, mutation, receipt export, or certificate."; }[];