Sync public tree to cab9305

scripts/cli-first-contract-smoke.js

@@ -92,6 +92,11 @@ expect(
   "artifact export explicit local byte write",
   /artifact export <id> --to <path>` writes bytes[\s\S]*explicit bounded download stream[\s\S]*complete staged content is available/
 );
+expect(
+  criteria,
+  "artifact download grant disclosure criteria",
+  /artifact download <id>` creates a secure[\s\S]*explicit artifact-download grant disclosure[\s\S]*Download links or sessions are not guessable public URLs[\s\S]*guessable_public_url: false[\s\S]*cross-tenant no-reuse[\s\S]*unauthorized-project no-reuse[\s\S]*Every command that grants[\s\S]*artifact download ability[\s\S]*grant_disclosures/
+);
 expect(
   criteria,
   "locality failure safe guidance",
@@ -351,6 +356,11 @@ expect(
   "CLI exposes node attach grant disclosures",
   /struct CapabilityGrantDisclosure[\s\S]*coordinator_policy_limited[\s\S]*fn capability_grant_disclosures/
 );
+expect(
+  cli,
+  "CLI exposes artifact download grant disclosures",
+  /fn artifact_download_grant_disclosures[\s\S]*"grant": "artifact_download"[\s\S]*"coordinator_policy_limited": true[\s\S]*"authorization_required": true[\s\S]*"guessable_public_url": false[\s\S]*"cross_tenant_reuse_allowed": false[\s\S]*"unauthorized_project_reuse_allowed": false/
+);
 expect(
   cli,
   "CLI exposes normalized node enrollment grants",
@@ -471,6 +481,11 @@ expect(
   "CLI artifact export keeps content out of reports",
   /fn artifact_stream_summary[\s\S]*content_material_returned_in_report[\s\S]*false/
 );
+expect(
+  cli,
+  "CLI artifact export carries download grant disclosure",
+  /fn artifact_export_local_write_followup[\s\S]*artifact_download_grant_disclosures[\s\S]*"grant_disclosures": grant_disclosures/
+);
 expect(
   cli,
   "CLI exposes admin bootstrap self-hosted path",