@appforge-ci/core 0.3.0 → 0.3.2

package/dist/vpn-attestation.js

@@ -0,0 +1,963 @@
+import { z } from "zod";
+import { canonicalJson, sha256Hex, toIsoUtcSeconds } from "./attestation.js";
+import { canonicalVpnEgressPolicy, vpnEgressPolicyHash } from "./vpn-egress.js";
+import { SANDBOX_PROFILE_VERSION } from "./vpn-sandbox.js";
+/**
+ * Per-build signed attestation (regulated-VPN program, PR-M): what the document says, how it is
+ * derived, and the evidence bundle and printable page an auditor verifies offline with
+ * `scripts/appforge-verify.mjs`. Pure and runtime-neutral (WebCrypto only), so the Worker that
+ * assembles it (apps/admin-api through `@appforge/db`), the Worker that exports it (apps/api), the
+ * agent that reports the raw evidence, and the tests that feed the real verifier all share one
+ * definition.
+ *
+ * Who says what. Three parties contribute facts, and the document records which:
+ *   - the SERVER (control plane): what it leased (the egress policy it sent, the tunnel's public
+ *     configuration), the build row, the VpnEvent timeline, the audit chain head, and everything it
+ *     can RECOMPUTE from raw data it holds (the connection log's digest, per-destination summary,
+ *     totals and completeness);
+ *   - the AGENT: what ran on the Mac (helper identity, sandbox profile hashes and the self-test
+ *     matrix, hygiene), reported in one JSON document plus the raw connection log;
+ *   - the HELPER: the connection log itself (metadata only), written by a process on the build host.
+ * Every value the agent claims that the server can also derive is compared, and a mismatch is
+ * recorded as a failing control test (the verifier exits 2 on those). Nothing is silently trusted,
+ * and nothing is ever dropped silently either: what could not be checked is listed in `crossChecks`
+ * and `gaps`.
+ *
+ * What it is not: macOS offers no remote attestation, so this proves what the server verified and
+ * what the Mac reported, not that the Mac told the truth. docs/attestation.md lists the limits.
+ */
+// ---------------------------------------------------------------- constants
+export const ATTESTATION_DOC_TYPE = "appforge.vpn.build-attestation";
+export const ATTESTATION_DOC_VERSION = 1;
+export const EVIDENCE_BUNDLE_FORMAT = "appforge-evidence-bundle";
+/** The rule that turns the helper's raw log lines into the `records` a bundle carries. Part of the signed document. */
+export const CONNECTION_RECORDS_NORMALIZATION = "appforge-conn-records-v1";
+/**
+ * The largest connection log the control plane will hold and process (the agent keeps up to 50 MiB; a log
+ * past this is reported as not retained and the attestation says so). 8 MiB is about 27,000 records, an order
+ * of magnitude above a real build, and keeps one Worker request well inside its CPU and memory limits.
+ */
+export const ATTESTATION_LOG_MAX_BYTES = 8 * 1024 * 1024;
+/** Largest `POST /agents/vpn/attestation` body. */
+export const ATTESTATION_EVIDENCE_MAX_BYTES = 256 * 1024;
+/**
+ * How long after the control plane first sees a strict/regulated build finished the agent may still report its
+ * evidence. After it, the cron issues a `server_observed_only` attestation and a late report is refused.
+ */
+export const ATTESTATION_AGENT_GRACE_SECONDS = 30 * 60;
+/** Distinct (destination, route, decision) groups a document lists; beyond it the summary is cut and the document says so. */
+export const ATTESTATION_MAX_DESTINATIONS = 1000;
+/** Chain entries one evidence bundle carries at most (one page of the audit export). */
+export const ATTESTATION_BUNDLE_MAX_CHAIN_ENTRIES = 1000;
+export const ATTESTATION_ID_PREFIX = "att_";
+export const attestationIdForBuild = (buildId) => `${ATTESTATION_ID_PREFIX}${buildId}`;
+/** A build id as the control plane makes them (UUIDs) and as the agent's evidence directory and the helper accept them. */
+export const ATTESTATION_BUILD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+const ORG_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+/** Where a build's raw connection log lives in the artifacts bucket. */
+export function connectionLogKey(orgId, buildId) {
+    if (!ORG_ID_RE.test(orgId) || !ATTESTATION_BUILD_ID_RE.test(buildId))
+        throw new Error("connectionLogKey: unsafe org or build id");
+    return `evidence/${orgId}/${buildId}/conn.jsonl`;
+}
+/** Release manifests, published next to the artifacts by scripts/r2-release.mjs. */
+export function releaseManifestKey(prefix, version) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(version))
+        throw new Error("releaseManifestKey: unsafe version");
+    return `${prefix}/${version}/manifest.json`;
+}
+/** Why a document is unsigned, in the words the API and the dashboard use. */
+export const ATTESTATION_UNSIGNED_NOTE = "This attestation is NOT signed: the platform's signing key was not available when it was issued. It is registered in the audit chain, but nothing authenticates it, and it cannot be verified offline.";
+// ---------------------------------------------------------------- small helpers
+/** Printable ASCII only, clipped: nothing an agent or a log line says can carry control characters or lone surrogates into a signed document. */
+function printable(v, max) {
+    if (typeof v !== "string")
+        return "";
+    return v.replace(/[^\x20-\x7e]/g, "?").slice(0, max);
+}
+function safeCount(v) {
+    return typeof v === "number" && Number.isSafeInteger(v) && v >= 0 ? v : 0;
+}
+const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+// ---------------------------------------------------------------- what the agent reports
+const text = (max) => z.string().max(max).transform((s) => printable(s, max));
+const hex64 = z.string().regex(/^[0-9a-f]{64}$/, "expected 64 lowercase hex characters");
+/** A count that tolerates a float or an out-of-range number from an agent: it is clamped, never the reason evidence is refused. */
+const count = z
+    .number()
+    .finite()
+    .transform((n) => Math.min(Number.MAX_SAFE_INTEGER, Math.max(0, Math.round(n))));
+const selfTestResultSchema = z.object({
+    id: text(80).pipe(z.string().min(1)),
+    area: text(32),
+    title: text(200),
+    tier: z.enum(["core", "internet", "optional"]),
+    expect: z.enum(["blocked", "allowed", "known_gap"]),
+    status: z.enum(["pass", "fail", "inconclusive", "na", "known_gap_open", "known_gap_closed"]),
+    detail: text(300).optional(),
+});
+const sandboxEvidenceSchema = z.object({
+    profileVersion: count,
+    templateSha256: hex64,
+    renderedSha256: hex64,
+    paramsSha256: hex64,
+    loopbackDenyPorts: z.array(count).max(64),
+    orgId: text(64),
+    selfTest: z.object({
+        verdict: z.enum(["pass", "fail", "inconclusive"]),
+        counts: z.record(z.string().max(32), count).refine((r) => Object.keys(r).length <= 8, "too many count keys"),
+        startedAt: text(40),
+        durationMs: count,
+        results: z.array(selfTestResultSchema).max(300),
+    }),
+    scope: text(2000).optional(),
+});
+const connectionLogReportSchema = z.object({
+    /** The raw file reached the control plane (`PUT /agents/vpn/evidence/:buildId/conn-log`). */
+    uploaded: z.boolean(),
+    omitted: z.enum(["too_large", "not_kept", "upload_failed", "unreadable"]).optional(),
+    /** sha256 of the file's exact bytes, as the agent computed it. */
+    sha256: hex64.nullable(),
+    bytes: count,
+    lines: count,
+    complete: z.boolean(),
+    incompleteReasons: z.array(text(120)).max(20),
+    /** The agent's own summary, compared with what the control plane recomputes from the file. */
+    summary: z
+        .object({ total: count, allowed: count, denied: count, connected: count, failed: count, bytesUp: count, bytesDown: count })
+        .nullable(),
+});
+/**
+ * What an agent sends to `POST /agents/vpn/attestation` after a strict-egress or regulated build ends. Unknown
+ * top-level fields are dropped (a newer agent may send more), `hygiene` is kept as an opaque, size-bounded object
+ * because its shape is owned by a change that has not shipped everywhere.
+ */
+export const agentVpnEvidenceSchema = z.object({
+    v: z.literal(1),
+    buildId: z.string().regex(ATTESTATION_BUILD_ID_RE),
+    agent: z.object({ version: text(40), os: text(80).optional(), arch: text(16).optional() }),
+    /** What the agent believes happened; the control plane's own build row is what the document records. */
+    outcome: z.object({ status: z.enum(["succeeded", "failed"]), failureKind: z.enum(["user", "infra"]).optional() }),
+    helper: z.object({ version: text(40).nullable(), sha256: hex64.nullable(), arch: z.enum(["arm64", "amd64"]).nullable() }),
+    egress: z.object({ mode: z.enum(["standard", "strict"]).nullable(), policyHash: hex64.nullable() }),
+    tunnel: z.object({ configDigest: hex64.nullable() }),
+    sandbox: sandboxEvidenceSchema.nullable(),
+    hygiene: z.record(z.unknown()).optional(),
+    connectionLog: connectionLogReportSchema.nullable(),
+});
+/**
+ * Per-(destination, route, decision) totals, sorted by `dest + route + decision` in UTF-16 code unit order.
+ * `scripts/appforge-verify.mjs` recomputes exactly this from a bundle's raw records, so the two must agree to
+ * the byte; the order is deliberately locale-independent (a collation order differs between ICU locales and
+ * would make one verifier disagree with another about the same evidence).
+ */
+export function summariseConnections(records) {
+    const m = new Map();
+    for (const r of records) {
+        const k = [r.dest, r.route, r.decision].join("|");
+        const a = m.get(k) ?? { dest: r.dest, route: r.route, decision: r.decision, conns: 0, bytesUp: 0, bytesDown: 0 };
+        a.conns += 1;
+        a.bytesUp += r.bytesUp ?? 0;
+        a.bytesDown += r.bytesDown ?? 0;
+        m.set(k, a);
+    }
+    return [...m.values()].sort((x, y) => cmp(x.dest + x.route + x.decision, y.dest + y.route + y.decision));
+}
+/** The digest the document's `connections.logSha256` holds: sha256 over the canonical records, one per line, newline-terminated. */
+export async function connectionRecordsDigest(records) {
+    return sha256Hex(records.map((r) => canonicalJson(r)).join("\n") + "\n");
+}
+const MAX_INCOMPLETE_REASONS = 20;
+const MAX_BSEQ_TRACKED = 1_000_000;
+const TALLY_COUNTS = ["conns", "allowed", "denied", "connected", "failed", "bytesUp", "bytesDown", "dropped", "forcedClosed"];
+const isCountValue = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+/** A helper `summary` line as the agent validates it (packages/agent/src/lib/evidence.ts `parseHelperSummary`), or null when it is not well-formed. */
+function parseTally(r) {
+    if (typeof r.buildId !== "string" || !ATTESTATION_BUILD_ID_RE.test(r.buildId) || typeof r.reason !== "string" || typeof r.ts !== "string")
+        return null;
+    if (typeof r.v !== "number" || typeof r.stream !== "boolean")
+        return null;
+    for (const f of TALLY_COUNTS)
+        if (!isCountValue(r[f]))
+            return null;
+    return {
+        buildId: r.buildId,
+        tally: {
+            reason: r.reason.replace(/[^a-z0-9_-]/gi, "?").slice(0, 32),
+            conns: r.conns,
+            allowed: r.allowed,
+            denied: r.denied,
+            connected: r.connected,
+            failed: r.failed,
+            bytesUp: r.bytesUp,
+            bytesDown: r.bytesDown,
+            dropped: r.dropped,
+            forcedClosed: r.forcedClosed,
+            stream: r.stream,
+        },
+    };
+}
+function token(v, max = 40) {
+    const s = typeof v === "string" ? v : "";
+    return /^[a-z0-9][a-z0-9._/-]*$/i.test(s) ? s.slice(0, max) : s === "" ? "" : "unknown";
+}
+/**
+ * Re-derives everything a document says about the connection log from the raw file, so the control plane
+ * never relies on the agent's summary. The completeness rules mirror the agent's own aggregator
+ * (packages/agent/src/lib/evidence.ts) so that, for a log nothing went wrong with, both say "complete"; a
+ * test runs the two on the same files. Trusts nothing in a line: malformed lines are counted, strings are
+ * reduced to printable ASCII and clipped, a record of another build is excluded and makes the log incomplete.
+ *
+ * `raw` is the file's text (UTF-8); callers bound its size (`ATTESTATION_LOG_MAX_BYTES`).
+ */
+export async function analyzeConnectionLog(raw, buildId) {
+    const records = [];
+    const bseqs = new Set();
+    let bseqOverflow = false;
+    let highest = 0;
+    let duplicates = 0;
+    let malformed = 0;
+    let foreign = 0;
+    let authFailures = 0;
+    let sessionRequests = 0;
+    let droppedMarkers = 0;
+    let lines = 0;
+    let tally = null;
+    const totals = { allowed: 0, denied: 0, errors: 0, bytesUp: 0, bytesDown: 0 };
+    let connected = 0;
+    let up = 0;
+    let down = 0;
+    const tornTail = raw.length > 0 && !raw.endsWith("\n");
+    const parts = raw.split("\n");
+    // A last line with no newline is a torn write: hashed as part of the file, never parsed (the agent's aggregator does the same).
+    if (tornTail)
+        parts.pop();
+    for (const line of parts) {
+        if (line === "")
+            continue;
+        lines++;
+        let m;
+        try {
+            m = JSON.parse(line);
+        }
+        catch {
+            malformed++;
+            continue;
+        }
+        if (m === null || typeof m !== "object" || Array.isArray(m)) {
+            malformed++;
+            continue;
+        }
+        const r = m;
+        if (r.type === "summary") {
+            // The same validation as the agent's `parseHelperSummary`: a tally that is not well-formed is a malformed line, not a tally of zeros.
+            const t = parseTally(r);
+            if (!t)
+                malformed++;
+            else if (t.buildId !== buildId)
+                foreign++;
+            else
+                tally = t.tally;
+            continue;
+        }
+        if (r.type === "dropped") {
+            droppedMarkers += safeCount(r.count);
+            continue;
+        }
+        if (r.type !== "conn")
+            continue; // a line type from a newer helper: kept in the raw file, not understood here
+        const id = typeof r.buildId === "string" ? r.buildId : undefined;
+        const decision = r.decision === "allow" || r.decision === "deny" ? r.decision : undefined;
+        if (decision === undefined) {
+            malformed++;
+            continue;
+        }
+        if (id !== undefined && id !== buildId) {
+            foreign++;
+            continue;
+        }
+        if (id === undefined) {
+            // Unattributed: a failed login, or a request made with the session credential.
+            if (r.auth === "session")
+                sessionRequests++;
+            else if (token(r.reason) === "auth-failed")
+                authFailures += 1 + safeCount(r.suppressed);
+            else
+                malformed++;
+            continue;
+        }
+        // A record whose own number is missing or invalid is a malformed line AND still a connection: the agent's aggregator counts it
+        // in its totals, so this must too (the agent's totals are compared with these), with number 0.
+        let bseq = 0;
+        if (typeof r.bseq === "number" && Number.isSafeInteger(r.bseq) && r.bseq > 0) {
+            bseq = r.bseq;
+            if (bseqs.has(bseq))
+                duplicates++;
+            else if (bseqs.size < MAX_BSEQ_TRACKED)
+                bseqs.add(bseq);
+            else
+                bseqOverflow = true;
+            if (bseq > highest)
+                highest = bseq;
+        }
+        else {
+            malformed++;
+        }
+        const host = printable(r.host, 253) || "<invalid>";
+        const port = typeof r.port === "number" && Number.isSafeInteger(r.port) && r.port >= 0 && r.port <= 65535 ? r.port : 0;
+        const bytesUp = safeCount(r.bytesUp);
+        const bytesDown = safeCount(r.bytesDown);
+        const isConnected = r.connected === true;
+        const rec = {
+            n: records.length + 1,
+            bseq,
+            ts: printable(r.ts, 40),
+            dest: host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`,
+            host,
+            port,
+            proto: token(r.proto, 16) || "unknown",
+            route: token(r.route) || "unknown",
+            decision,
+            reason: token(r.reason) || "unknown",
+            connected: isConnected,
+            bytesUp,
+            bytesDown,
+            durationMs: safeCount(r.durationMs),
+        };
+        const cls = token(r.class, 24);
+        if (cls)
+            rec.class = cls;
+        const failure = token(r.failure, 24);
+        if (failure)
+            rec.failure = failure;
+        records.push(rec);
+        if (decision === "allow") {
+            totals.allowed++;
+            if (isConnected)
+                connected++;
+            else
+                totals.errors++;
+        }
+        else {
+            totals.denied++;
+        }
+        up += bytesUp;
+        down += bytesDown;
+    }
+    totals.bytesUp = up;
+    totals.bytesDown = down;
+    // ---- completeness, the same rules as the agent's aggregator
+    const reasons = [];
+    const note = (why) => {
+        if (!reasons.includes(why) && reasons.length < MAX_INCOMPLETE_REASONS)
+            reasons.push(why);
+    };
+    const missing = bseqOverflow ? 0 : Math.max(0, highest - bseqs.size);
+    if (tornTail)
+        note("torn_final_line");
+    if (malformed > 0)
+        note(`malformed_lines:${malformed}`);
+    if (foreign > 0)
+        note(`foreign_records:${foreign}`);
+    if (duplicates > 0)
+        note(`duplicate_records:${duplicates}`);
+    if (missing > 0)
+        note(`missing_records:${missing}`);
+    if (droppedMarkers > 0)
+        note(`helper_dropped_records:${droppedMarkers}`);
+    let agrees = null;
+    if (!tally) {
+        note("helper_summary_missing");
+    }
+    else {
+        const mismatches = [];
+        if (tally.reason !== "unregistered")
+            note(`registration_ended:${tally.reason}`);
+        if (!tally.stream)
+            mismatches.push("stream");
+        if (records.length + tally.dropped !== tally.conns)
+            mismatches.push("conns");
+        if (tally.dropped > 0)
+            note(`helper_dropped_records:${tally.dropped}`);
+        if (missing !== tally.dropped && !bseqOverflow)
+            mismatches.push("missing");
+        if (tally.dropped === 0) {
+            if (totals.allowed !== tally.allowed)
+                mismatches.push("allowed");
+            if (totals.denied !== tally.denied)
+                mismatches.push("denied");
+            if (connected !== tally.connected)
+                mismatches.push("connected");
+            if (totals.errors !== tally.failed)
+                mismatches.push("failed");
+            if (up !== tally.bytesUp)
+                mismatches.push("bytesUp");
+            if (down !== tally.bytesDown)
+                mismatches.push("bytesDown");
+        }
+        else if (up > tally.bytesUp || down > tally.bytesDown) {
+            mismatches.push("bytes");
+        }
+        agrees = mismatches.length === 0;
+        if (!agrees)
+            note("helper_summary_mismatch");
+    }
+    const groups = summariseConnections(records);
+    const destinations = groups.length > ATTESTATION_MAX_DESTINATIONS ? [...groups].sort((a, b) => b.conns - a.conns || cmp(a.dest + a.route + a.decision, b.dest + b.route + b.decision)).slice(0, ATTESTATION_MAX_DESTINATIONS).sort((x, y) => cmp(x.dest + x.route + x.decision, y.dest + y.route + y.decision)) : groups;
+    return {
+        records,
+        destinations,
+        destinationsOmitted: groups.length - destinations.length,
+        totals,
+        connected,
+        logRecords: records.length,
+        logSha256: await connectionRecordsDigest(records),
+        rawLines: lines,
+        complete: reasons.length === 0,
+        incompleteReasons: reasons,
+        authFailures,
+        sessionCredentialRequests: sessionRequests,
+        droppedRecords: Math.max(droppedMarkers, tally?.dropped ?? 0),
+        helperTally: tally,
+        helperTallyAgrees: agrees,
+    };
+}
+export async function vpnPublicConfigDigest(job) {
+    const view = {
+        v: 1,
+        tunnelId: job.tunnelId,
+        keyVersion: job.keyVersion,
+        gatewayEndpoint: job.gatewayEndpoint,
+        gatewayPublicKey: job.gatewayPublicKey,
+        tunnelCidr: job.tunnelCidr,
+        localAddress: job.localAddress,
+        gatewayAddress: job.gatewayAddress,
+        lanCidrs: [...job.lanCidrs],
+        dnsServer: job.dnsServer ?? null,
+        allowedDomains: [...job.allowedDomains],
+        allowPrivateEndpoint: job.allowPrivateEndpoint === true,
+        egressPolicyHash: job.egress ? await vpnEgressPolicyHash(job.egress) : null,
+    };
+    return sha256Hex(canonicalJson(view));
+}
+async function wireguardKeyFingerprint(b64) {
+    if (!b64 || !/^[A-Za-z0-9+/]{43}=$/.test(b64))
+        return null;
+    try {
+        const bin = atob(b64);
+        const bytes = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            bytes[i] = bin.charCodeAt(i);
+        return (await sha256Hex(bytes)).slice(0, 32);
+    }
+    catch {
+        return null;
+    }
+}
+export async function buildTunnelFacts(job, appforgePublicKey) {
+    return {
+        id: job.tunnelId,
+        name: job.tunnelName ? printable(job.tunnelName, 100) : null,
+        keyVersion: job.keyVersion,
+        gatewayEndpoint: printable(job.gatewayEndpoint, 300),
+        lanCidrs: job.lanCidrs.map((c) => printable(c, 64)).slice(0, 64),
+        tunnelCidr: printable(job.tunnelCidr, 64),
+        dnsServer: job.dnsServer ? printable(job.dnsServer, 64) : null,
+        allowedDomains: job.allowedDomains.map((d) => printable(d, 253)).slice(0, 100),
+        appforgePublicKeyFp: await wireguardKeyFingerprint(appforgePublicKey),
+        gatewayPublicKeyFp: await wireguardKeyFingerprint(job.gatewayPublicKey),
+        configDigest: await vpnPublicConfigDigest(job),
+    };
+}
+/**
+ * The policy exactly as the helper enforces it, in the form a document inlines, with the helper's own hash of it.
+ * Throws on an invalid policy (callers validated it when they built the lease).
+ */
+export async function expandLeasedPolicy(policy) {
+    return { policy: JSON.parse(canonicalVpnEgressPolicy(policy)), helperHash: await vpnEgressPolicyHash(policy) };
+}
+// ---------------------------------------------------------------- release manifests
+/**
+ * What `scripts/r2-release.mjs` publishes next to a release's artifacts (`<prefix>/<version>/manifest.json`):
+ * the sha256 of every artifact and a few release-level facts. The control plane compares what an agent reports
+ * (the helper binary it ran, the sandbox template it rendered) with these. A release cut before manifests existed
+ * has none, which is recorded as "not checked", never as a match.
+ */
+export const releaseManifestSchema = z.object({
+    v: z.literal(1),
+    prefix: z.string().max(64),
+    version: z.string().max(64),
+    publishedAt: z.string().max(40),
+    artifacts: z.array(z.object({ name: z.string().max(128), sha256: hex64, bytes: count })).max(32),
+    meta: z.record(z.string().max(64), z.string().max(256)).optional(),
+});
+export function parseReleaseManifest(textBody) {
+    try {
+        const parsed = releaseManifestSchema.safeParse(JSON.parse(textBody));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The helper artifact name `scripts/r2-release.mjs` publishes for an architecture. */
+export const helperArtifactName = (arch) => `appforge-vpn-darwin-${arch}`;
+/** The statements every document carries, so a reader never has to guess what it does not claim. */
+export const ATTESTATION_LIMITS = [
+    "Connection records are metadata only: destination, port, decision, route and byte counts. Payloads, URLs, paths and headers are not recorded.",
+    "The connection log was written by the VPN helper on the build host and reported by the agent. The control plane verified its digest and re-derived every summary in this document from it, but macOS offers no remote attestation: this does not prove the build host told the truth.",
+    "A traffic class that bypasses the proxy (raw sockets, UDP, ICMP) is neither blocked nor recorded by the connection log; only the kernel sandbox constrains it, and only for a regulated build.",
+    "The self-test is a regression matrix of the sandbox's blocked classes on that host before the build, not a proof of confinement. Known gaps are listed in the sandbox scope.",
+    "The signature proves AppForge's signing key vouched for this document at its issue time. It does not make AppForge unable to rewrite its own history: keep the chain head you saw earlier and verify with --pin-head.",
+    "This is a technical record, not a certification (SOC 2, FIPS and similar assess an organisation's controls, not a build).",
+];
+export const ATTESTATION_PROVENANCE = {
+    server: ["subject", "host.agentId", "tunnel", "policy.egressPolicy", "policy.egressPolicySha256", "timing", "isolation.exclusiveHostLock", "connections (re-derived from the raw log)", "crossChecks", "auditChain", "result.buildStatus"],
+    agent: ["helper", "policy.enforcement", "isolation.hygiene", "controlTests (agent self-test results)", "host.agentVersion", "result.agentReportedStatus"],
+    helper: ["connections (the raw log)"],
+};
+const VERDICT_FROM_STATUS = { pass: "pass", fail: "fail", inconclusive: "inconclusive" };
+/**
+ * Turns the agent's self-test matrix into control-test results. Only checks the matrix itself counts are results:
+ * `pass`/`fail`, and an `inconclusive` core check (which cannot occur in a passing run). `na` checks, known-gap
+ * checks and inconclusive optional/internet checks are listed apart: the on-host matrix does not count them toward
+ * its verdict either, and presenting a documented gap as a "pass" would be false.
+ */
+function selfTestToResults(results) {
+    const counted = [];
+    const notCounted = [];
+    const knownGaps = [];
+    for (const r of results) {
+        if (r.expect === "known_gap" || r.status === "known_gap_open" || r.status === "known_gap_closed") {
+            knownGaps.push({ id: r.id, title: r.title, status: r.status });
+        }
+        else if (r.status === "pass" || r.status === "fail" || (r.status === "inconclusive" && r.tier === "core")) {
+            counted.push({
+                id: r.id,
+                area: r.area,
+                title: r.title,
+                expect: r.expect,
+                verdict: VERDICT_FROM_STATUS[r.status],
+                reason: r.detail ?? (r.status === "pass" ? "as expected" : "no detail recorded"),
+                source: "agent-selftest",
+            });
+        }
+        else {
+            notCounted.push({ id: r.id, tier: r.tier, status: r.status });
+        }
+    }
+    counted.sort((a, b) => cmp(a.id, b.id));
+    return { counted, notCounted: notCounted.sort((a, b) => cmp(a.id, b.id)), knownGaps: knownGaps.sort((a, b) => cmp(a.id, b.id)) };
+}
+export function summariseControls(results) {
+    const s = { pass: 0, fail: 0, inconclusive: 0 };
+    for (const r of results) {
+        if (r.verdict === "pass" || r.verdict === "fail" || r.verdict === "inconclusive")
+            s[r.verdict]++;
+    }
+    return s;
+}
+function eventTime(events, type, which) {
+    const hits = events.filter((e) => e.type === type);
+    if (hits.length === 0)
+        return null;
+    return (which === "first" ? hits[0] : hits[hits.length - 1]).at;
+}
+const MAX_OPAQUE_DEPTH = 8;
+const LONE_SURROGATES = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g;
+function opaqueValue(v, depth, state) {
+    if (depth > MAX_OPAQUE_DEPTH)
+        throw new Error("too deep");
+    if (v === null)
+        return null;
+    switch (typeof v) {
+        case "boolean":
+            return v;
+        case "string": {
+            const ok = v.replace(LONE_SURROGATES, "\ufffd");
+            if (ok !== v)
+                state.normalized = true;
+            return ok;
+        }
+        case "number": {
+            if (Number.isSafeInteger(v))
+                return v;
+            state.normalized = true; // canonical JSON has no floats: rounded (a non-finite or out-of-range number becomes null)
+            return Number.isFinite(v) && Number.isSafeInteger(Math.round(v)) ? Math.round(v) : null;
+        }
+        case "object": {
+            if (Array.isArray(v))
+                return v.map((x) => opaqueValue(x === undefined ? null : x, depth + 1, state));
+            const out = {};
+            for (const [k, x] of Object.entries(v)) {
+                if (x === undefined)
+                    continue;
+                out[k.replace(LONE_SURROGATES, "\ufffd")] = opaqueValue(x, depth + 1, state);
+            }
+            return out;
+        }
+        default:
+            state.normalized = true;
+            return null;
+    }
+}
+/**
+ * A canonical-JSON-safe copy of an object whose shape this module does not own (the agent's hygiene evidence), or null when it is
+ * too large or too deep to carry. Numbers that are not safe integers are rounded and lone surrogates replaced (`normalized` says
+ * so): the evidence is kept, not dropped, because it cannot be hashed identically everywhere as sent.
+ */
+export function sanitizeOpaque(value, maxBytes) {
+    try {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return null;
+        const state = { normalized: false };
+        const out = opaqueValue(value, 0, state);
+        if (canonicalJson(out).length > maxBytes)
+            return null;
+        return { value: out, normalized: state.normalized };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assembles the attestation document for a build, in exactly the shape `scripts/appforge-verify.mjs` reads, and
+ * decides its completeness and verdict. Every comparison between a thing the agent claims and a thing the
+ * control plane knows becomes a `crossChecks` entry; a mismatch is also a failing control-test result, which
+ * makes the verifier exit 2. Throws only on a programming error (a value canonical JSON cannot represent).
+ */
+export async function buildAttestationDocument(input) {
+    const { facts, evidence, log, rawLog } = input;
+    const regulated = facts.vpnClass === 2;
+    const degraded = evidence === null;
+    const gaps = [];
+    const crossChecks = [];
+    const serverResults = [];
+    const addCheck = (id, area, title, status, detail, expectText) => {
+        crossChecks.push({ id, status, detail });
+        if (status !== "not_checked") {
+            serverResults.push({ id, area, title, expect: expectText, verdict: status === "match" ? "pass" : "fail", reason: detail, source: "server-crosscheck" });
+        }
+    };
+    if (degraded)
+        gaps.push(input.degradedReason ?? "the agent did not report evidence for this build");
+    // ---- lease-time facts (server)
+    const lease = facts.lease;
+    if (!lease)
+        gaps.push("no lease-time record exists for this build: the policy and tunnel facts below could not be taken from what was sent to the agent");
+    const policy = lease?.policy ?? null;
+    const leaseHash = lease?.policyHash ?? null;
+    let egressPolicySha256;
+    if (policy) {
+        egressPolicySha256 = await sha256Hex(canonicalJson(policy));
+        if (leaseHash && (await vpnEgressPolicyHash(policy)) !== leaseHash) {
+            gaps.push("the stored lease record is internally inconsistent: its policy does not hash to its recorded policy hash");
+        }
+    }
+    // ---- agent claims vs the lease record
+    if (evidence) {
+        const claimedMode = evidence.egress.mode;
+        addCheck("egress-mode", "network", "the helper ran in strict-egress mode", claimedMode === "strict" ? "match" : claimedMode === null ? "not_checked" : "mismatch", claimedMode === "strict" ? "the agent reports a strict-egress helper" : claimedMode === null ? "the agent reported no egress mode" : `the agent reports ${claimedMode} mode for a strict-egress build`, "strict");
+        if (leaseHash) {
+            const claimed = evidence.egress.policyHash;
+            addCheck("policy-hash", "network", "the helper enforced the egress policy the control plane sent", claimed === null ? "not_checked" : claimed === leaseHash ? "match" : "mismatch", claimed === null ? "the agent reported no policy hash" : claimed === leaseHash ? "the policy hash the helper echoed equals the hash of the policy the control plane leased" : "the policy hash the helper echoed differs from the hash of the policy the control plane leased", "equal");
+        }
+        if (lease?.tunnel) {
+            const claimed = evidence.tunnel.configDigest;
+            addCheck("tunnel-config", "network", "the build ran against the tunnel configuration the control plane sent", claimed === null ? "not_checked" : claimed === lease.tunnel.configDigest ? "match" : "mismatch", claimed === null ? "the agent reported no tunnel configuration digest" : claimed === lease.tunnel.configDigest ? "the agent's key-free tunnel configuration digest equals the control plane's" : "the agent's tunnel configuration digest differs from what the control plane sent", "equal");
+        }
+        // ---- helper binary and sandbox template vs the release manifests
+        const helperVersion = evidence.helper.version;
+        const arch = evidence.helper.arch;
+        if (helperVersion && arch && evidence.helper.sha256) {
+            const entry = facts.manifests.vpnRelease?.version === helperVersion ? facts.manifests.vpnRelease.artifacts.find((a) => a.name === helperArtifactName(arch)) : undefined;
+            if (entry) {
+                addCheck("helper-release", "supply-chain", "the helper binary is the one published for its release", entry.sha256 === evidence.helper.sha256 ? "match" : "mismatch", entry.sha256 === evidence.helper.sha256 ? `sha256 equals the release manifest entry for ${helperArtifactName(arch)} ${helperVersion}` : `sha256 differs from the release manifest entry for ${helperArtifactName(arch)} ${helperVersion}`, "equal");
+            }
+            else {
+                crossChecks.push({ id: "helper-release", status: "not_checked", detail: `no release manifest is published for helper ${helperVersion}; the reported hash was not compared with a release` });
+            }
+        }
+        else {
+            crossChecks.push({ id: "helper-release", status: "not_checked", detail: "the agent did not report the helper's version, architecture and hash" });
+            if (regulated || claimedMode === "strict")
+                gaps.push("the agent did not report the helper binary's identity");
+        }
+        // ---- sandbox (regulated builds)
+        const sb = evidence.sandbox;
+        if (sb) {
+            addCheck("sandbox-profile-version", "sandbox", "the sandbox profile generation is the one the control plane asked for", sb.profileVersion === SANDBOX_PROFILE_VERSION ? "match" : "mismatch", sb.profileVersion === SANDBOX_PROFILE_VERSION ? `profile v${SANDBOX_PROFILE_VERSION}` : `the agent ran profile v${sb.profileVersion}, the control plane asked for v${SANDBOX_PROFILE_VERSION}`, "equal");
+            addCheck("sandbox-org", "sandbox", "the sandbox's caches were scoped to this build's organisation", sb.orgId === facts.orgId ? "match" : "mismatch", sb.orgId === facts.orgId ? "the sandbox was prepared for this organisation" : "the sandbox was prepared for a different organisation", "equal");
+            const agentVersion = evidence.agent.version;
+            const manifest = facts.manifests.agentRelease?.version === agentVersion ? facts.manifests.agentRelease : null;
+            const expectedTemplate = manifest?.meta?.sandboxTemplateSha256;
+            if (expectedTemplate) {
+                addCheck("sandbox-template", "supply-chain", "the sandbox profile template is the one published with the agent release", expectedTemplate === sb.templateSha256 ? "match" : "mismatch", expectedTemplate === sb.templateSha256 ? `template sha256 equals the release manifest entry for agent ${agentVersion}` : `template sha256 differs from the release manifest entry for agent ${agentVersion}`, "equal");
+            }
+            else {
+                crossChecks.push({ id: "sandbox-template", status: "not_checked", detail: `no release manifest with a sandbox template hash is published for agent ${agentVersion}; the reported hash was not compared with a release` });
+            }
+            if (sb.selfTest.verdict !== "pass") {
+                addCheck("sandbox-selftest", "sandbox", "the sandbox self-test passed before the build", "mismatch", `the self-test verdict was ${sb.selfTest.verdict}`, "pass");
+            }
+        }
+        else if (regulated) {
+            addCheck("sandbox-evidence", "sandbox", "a regulated build reports its sandbox evidence", "mismatch", "the agent reported no sandbox evidence for a regulated build", "present");
+        }
+        // ---- the connection log
+        const clog = evidence.connectionLog;
+        if (!clog || !clog.uploaded) {
+            gaps.push(`the connection log is not available${clog?.omitted ? ` (${clog.omitted})` : ""}`);
+        }
+        else if (!log || !rawLog) {
+            gaps.push("the connection log was reported as uploaded but the control plane holds none");
+        }
+        else {
+            if (clog.sha256 !== null) {
+                addCheck("log-digest", "evidence", "the connection log the control plane holds is the one the agent summarised", clog.sha256 === rawLog.sha256 ? "match" : "mismatch", clog.sha256 === rawLog.sha256 ? "the agent's sha256 of the file equals the digest the bucket verified at upload" : "the agent's sha256 of the file differs from the object the control plane holds", "equal");
+            }
+            if (clog.summary) {
+                const s = clog.summary;
+                const t = log.totals;
+                const same = s.total === log.logRecords && s.allowed === t.allowed && s.denied === t.denied && s.connected === log.connected && s.failed === t.errors && s.bytesUp === t.bytesUp && s.bytesDown === t.bytesDown;
+                addCheck("log-totals", "evidence", "the agent's connection summary equals what the control plane recomputes from the log", same ? "match" : "mismatch", same ? "connections, decisions and byte counts agree" : "the agent's connection counts or byte totals differ from the control plane's recomputation of the same file", "equal");
+            }
+            if (!log.complete)
+                gaps.push(`the connection log is incomplete (${log.incompleteReasons.slice(0, 5).join(", ")})`);
+            if (log.destinationsOmitted > 0)
+                gaps.push(`the connection summary lists ${ATTESTATION_MAX_DESTINATIONS} of ${ATTESTATION_MAX_DESTINATIONS + log.destinationsOmitted} destination groups`);
+        }
+    }
+    // ---- control tests
+    const agentResults = evidence?.sandbox ? selfTestToResults(evidence.sandbox.selfTest.results) : null;
+    const st = evidence?.sandbox?.selfTest;
+    const selfTestMeta = st ? { verdict: st.verdict, counts: st.counts, startedAt: st.startedAt, durationMs: st.durationMs } : null;
+    const results = [...(agentResults?.counted ?? []), ...serverResults];
+    const summary = summariseControls(results);
+    let controlsVerdict;
+    if (degraded || results.length === 0)
+        controlsVerdict = "not_evaluated";
+    else if (summary.fail > 0)
+        controlsVerdict = "violations_detected";
+    else if (regulated && agentResults && agentResults.counted.length > 0 && summary.inconclusive === 0)
+        controlsVerdict = "all_enforced";
+    else if (!regulated && summary.inconclusive === 0)
+        controlsVerdict = "network_policy_checked";
+    else
+        controlsVerdict = "not_evaluated";
+    // ---- connections section
+    const totals = log ? log.totals : null;
+    const clog = evidence?.connectionLog ?? null;
+    const connections = log && rawLog
+        ? {
+            totals: { allowed: log.totals.allowed, denied: log.totals.denied, errors: log.totals.errors, bytesUp: log.totals.bytesUp, bytesDown: log.totals.bytesDown },
+            destinations: log.destinations,
+            destinationsOmitted: log.destinationsOmitted,
+            logRecords: log.logRecords,
+            logSha256: log.logSha256,
+            normalization: CONNECTION_RECORDS_NORMALIZATION,
+            rawLogSha256: rawLog.sha256,
+            rawLogBytes: rawLog.bytes,
+            rawLogLines: log.rawLines,
+            logCompleteness: log.complete ? "complete" : "incomplete",
+            incompleteReasons: log.incompleteReasons,
+            authFailures: log.authFailures,
+            sessionCredentialRequests: log.sessionCredentialRequests,
+            droppedRecords: log.droppedRecords,
+            helperTallyAgrees: log.helperTallyAgrees,
+            note: "metadata only: destination, route, decision, bytes. No payloads, URLs, paths or headers.",
+        }
+        : {
+            totals: totals ?? { allowed: 0, denied: 0, errors: 0, bytesUp: 0, bytesDown: 0 },
+            destinations: [],
+            logRecords: 0,
+            logSha256: await connectionRecordsDigest([]),
+            normalization: CONNECTION_RECORDS_NORMALIZATION,
+            logCompleteness: "not_available",
+            incompleteReasons: clog?.omitted ? [clog.omitted] : [degraded ? "agent_did_not_report" : "log_not_held"],
+            note: degraded ? "no connection data: the agent never reported, so nothing here describes what the build connected to" : "the raw connection log is not held by the control plane; no per-destination data is recorded",
+        };
+    // ---- policy / enforcement
+    const sandbox = evidence?.sandbox ?? null;
+    const policyOut = {
+        mode: "strict",
+        ...(policy ? { egressPolicy: policy, egressPolicySha256: egressPolicySha256 } : {}),
+        helperPolicyHash: leaseHash,
+        enforcement: sandbox
+            ? {
+                mechanism: "seatbelt",
+                profileVersion: sandbox.profileVersion,
+                templateSha256: sandbox.templateSha256,
+                renderedSha256: sandbox.renderedSha256,
+                paramsSha256: sandbox.paramsSha256,
+                loopbackDenyPorts: sandbox.loopbackDenyPorts,
+                runAsDedicatedUser: false,
+            }
+            : null,
+    };
+    // ---- timing and isolation (server events)
+    const timing = {
+        queuedAt: facts.build.queuedAt,
+        leasedAt: lease?.leasedAt ?? null,
+        lockAcquiredAt: eventTime(facts.events, "lock_acquired", "first"),
+        handshakeAt: eventTime(facts.events, "handshake_ok", "first"),
+        buildStartedAt: facts.build.startedAt,
+        buildFinishedAt: facts.build.finishedAt,
+        lockReleasedAt: eventTime(facts.events, "lock_released", "last"),
+        tunnelDownEvents: facts.events.filter((e) => e.type === "tunnel_down").length,
+        handshakeFailedEvents: facts.events.filter((e) => e.type === "handshake_failed").length,
+    };
+    const isolation = {
+        exclusiveHostLock: facts.events.some((e) => e.type === "lock_acquired"),
+        note: "an exclusive-host lock separates tenants in time on a Mac; it is not kernel isolation",
+    };
+    const hygiene = evidence?.hygiene ? sanitizeOpaque(evidence.hygiene, 16 * 1024) : null;
+    if (evidence?.hygiene !== undefined && !hygiene)
+        gaps.push("the agent's hygiene evidence is too large or too deeply nested to carry and was left out");
+    if (hygiene) {
+        isolation.hygiene = hygiene.value;
+        if (hygiene.normalized)
+            isolation.hygieneNote = "the agent's hygiene evidence contained numbers that are not integers (rounded here) or unpaired surrogates (replaced): canonical JSON cannot carry them as sent";
+    }
+    // Decided last: every gap above (and the hygiene one) counts.
+    if (regulated && agentResults && agentResults.counted.length === 0)
+        gaps.push("the sandbox self-test reported no checks the matrix counts, so no isolation control is evidenced");
+    const completeness = degraded ? "server_observed_only" : gaps.length > 0 ? "partial" : "full";
+    const helper = evidence
+        ? {
+            version: evidence.helper.version,
+            sha256: evidence.helper.sha256,
+            arch: evidence.helper.arch,
+            reportedBy: "agent",
+            release: crossChecks.find((c) => c.id === "helper-release") ?? null,
+        }
+        : { reportedBy: "none", note: "no agent report: the helper's identity was not recorded" };
+    const doc = {
+        type: ATTESTATION_DOC_TYPE,
+        version: ATTESTATION_DOC_VERSION,
+        id: attestationIdForBuild(facts.buildId),
+        issuedAt: facts.issuedAt,
+        completeness,
+        subject: { orgId: facts.orgId, appId: facts.appId, buildId: facts.buildId, workflow: printable(facts.workflow, 200), branch: printable(facts.branch, 200), commitSha: facts.commitSha ? printable(facts.commitSha, 64) : null, tunnelId: facts.tunnelId },
+        host: { agentId: facts.agent.id, agentVersion: evidence?.agent.version ?? facts.agent.version, os: evidence?.agent.os ?? facts.agent.os, arch: evidence?.agent.arch ?? null },
+        helper,
+        tunnel: lease?.tunnel ? { ...lease.tunnel } : null,
+        policy: policyOut,
+        timing,
+        isolation,
+        connections,
+        ...(results.length > 0
+            ? {
+                controlTests: {
+                    packVersion: "1",
+                    phase: "preflight and post-build",
+                    results,
+                    summary,
+                    resultsSha256: await sha256Hex(canonicalJson(results)),
+                    ...(agentResults
+                        ? {
+                            selfTest: selfTestMeta,
+                            notCounted: agentResults.notCounted,
+                            knownGaps: agentResults.knownGaps,
+                        }
+                        : {}),
+                },
+            }
+            : {}),
+        crossChecks,
+        gaps,
+        scope: {
+            statement: regulated
+                ? `Regulated build: the build ran under a Seatbelt sandbox. ${sandbox?.scope ?? "The sandbox's scope statement was not reported."}`
+                : "Strict-egress build: network policy was enforced by the VPN helper. No kernel sandbox confined the build, so isolation of the build host is NOT claimed.",
+            limits: [...ATTESTATION_LIMITS],
+        },
+        provenance: Object.fromEntries(Object.entries(ATTESTATION_PROVENANCE).map(([k, v]) => [k, [...v]])),
+        auditChain: { headSeq: facts.chain.headSeq, headHash: facts.chain.headHash, firstEventSeq: facts.chain.firstEventSeq },
+        result: {
+            buildStatus: facts.build.status,
+            failureKind: facts.build.failureKind,
+            agentReportedStatus: evidence ? evidence.outcome.status : null,
+            controlsVerdict,
+            violations: summary.fail,
+        },
+    };
+    // Fails loudly (a programming error) if anything in the document cannot be hashed identically everywhere.
+    canonicalJson(doc);
+    return { doc, completeness, controlsVerdict, violations: summary.fail, gaps };
+}
+/** sha256 of the canonical document: what the chain's registration entry holds as `docSha256`. */
+export async function attestationDocumentSha256(doc) {
+    return sha256Hex(canonicalJson(doc));
+}
+const HTML_ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+const esc = (s) => String(s ?? "n/a").replace(/[&<>"']/g, (c) => HTML_ESC[c]);
+const VERDICT_LABEL = { pass: "PASS", fail: "FAIL", inconclusive: "N/A" };
+/**
+ * The printable page for a bundle. A TWIN of `renderEvidenceHtml` in scripts/appforge-verify.mjs, which cannot
+ * be imported here (it is a zero-dependency single file built on node:crypto, and these Workers do not enable
+ * Node compatibility): `--render-check` re-renders the visible page from its embedded JSON with that function
+ * and requires a byte-for-byte match, so this one must produce identical output, and packages/core's tests
+ * require it on many bundles. Only the JSON embedded in the page is authenticated; the visible text is a
+ * rendering of it.
+ */
+export function renderEvidenceHtml(bundle, { docSha256 }) {
+    const d = bundle.attestation.doc;
+    const ct = d.controlTests ?? { summary: { pass: 0, fail: 0, inconclusive: 0 }, results: [] };
+    const sig = bundle.attestation.signatures[0] ?? {};
+    const embedded = JSON.stringify(bundle).replace(/</g, "\\u003c");
+    const rows = (arr, f) => (arr ?? []).map(f).join("");
+    const verdict = d.result?.controlsVerdict;
+    const headline = verdict === "all_enforced"
+        ? "All network and isolation controls were enforced for this build."
+        : verdict === "violations_detected"
+            ? "Control violations were detected. See the control tests below."
+            : "No control-test verdict is recorded for this build.";
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>VPN build attestation ${esc(d.subject?.buildId)}</title>
+<style>
+:root{--bg:#fff;--fg:#14171a;--mut:#5b6670;--line:#d6dbe0;--ok:#0b6b2f;--bad:#a4161a;--na:#7a5a00;--card:#f6f8fa}
+@media (prefers-color-scheme:dark){:root{--bg:#101316;--fg:#e8ecef;--mut:#98a4ae;--line:#2c343b;--ok:#4cc27a;--bad:#ff7b7f;--na:#e3b341;--card:#171c20}}
+body{background:var(--bg);color:var(--fg);font:15px/1.5 -apple-system,system-ui,sans-serif;margin:0;padding:24px 16px}
+main{max-width:920px;margin:0 auto}h1{font-size:22px;margin:0 0 4px}h2{font-size:16px;margin:28px 0 8px;border-bottom:1px solid var(--line);padding-bottom:4px}
+.banner{border:2px solid var(--line);background:var(--card);padding:12px 14px;border-radius:6px;margin:12px 0}
+table{border-collapse:collapse;width:100%;font-size:13px}th,td{border-bottom:1px solid var(--line);padding:5px 8px;text-align:left;vertical-align:top;word-break:break-word}th{color:var(--mut)}
+code,.mono{font-family:ui-monospace,Menlo,monospace;font-size:12px}.PASS{color:var(--ok);font-weight:700}.FAIL{color:var(--bad);font-weight:700}.NA{color:var(--na);font-weight:700}
+dl{display:grid;grid-template-columns:200px 1fr;gap:4px 12px;margin:0}dt{color:var(--mut)}dd{margin:0;word-break:break-all}
+@media (max-width:600px){dl{grid-template-columns:1fr}}@media print{body{padding:0}tr{break-inside:avoid}}
+</style></head><body><main>
+<h1>VPN build attestation</h1>
+<div class="mono">${esc(d.id)} &middot; issued ${esc(d.issuedAt)} &middot; signature key ${esc(sig.keyId)}</div>
+<div class="banner"><b>${esc(headline)}</b><br>${esc(ct.summary?.pass)} passed &middot; ${esc(ct.summary?.fail)} failed &middot; ${esc(ct.summary?.inconclusive)} inconclusive. Completeness: ${esc(d.completeness)}.</div>
+<h2>Subject</h2><dl>
+<dt>Organisation</dt><dd>${esc(d.subject?.orgId)}</dd><dt>Build</dt><dd>${esc(d.subject?.buildId)} (app ${esc(d.subject?.appId)}, workflow ${esc(d.subject?.workflow)})</dd>
+<dt>Commit</dt><dd>${esc(d.subject?.commitSha)}</dd><dt>Tunnel</dt><dd>${esc(d.subject?.tunnelId)}</dd></dl>
+<h2>Network connections (metadata only)</h2>
+<table><tr><th>Destination</th><th>Route</th><th>Decision</th><th>Conns</th><th>Bytes up</th><th>Bytes down</th></tr>
+${rows(d.connections?.destinations, (x) => `<tr><td class="mono">${esc(x.dest)}</td><td>${esc(x.route)}</td><td>${esc(x.decision)}</td><td>${esc(x.conns)}</td><td>${esc(x.bytesUp)}</td><td>${esc(x.bytesDown)}</td></tr>`)}</table>
+<h2>Control tests</h2>
+<table><tr><th>ID</th><th>Attempt</th><th>Expected</th><th>Result</th><th>Detail</th></tr>
+${rows(ct.results, (r) => `<tr><td class="mono">${esc(r.id)}</td><td>${esc(r.title)}</td><td>${esc(r.expect)}</td><td class="${VERDICT_LABEL[r.verdict] === "N/A" ? "NA" : VERDICT_LABEL[r.verdict] ?? ""}">${esc(VERDICT_LABEL[r.verdict] ?? r.verdict)}</td><td>${esc(r.reason)}</td></tr>`)}</table>
+<h2>Tamper evidence</h2><dl>
+<dt>Audit chain head</dt><dd>seq ${esc(d.auditChain?.headSeq)}, hash <code>${esc(d.auditChain?.headHash)}</code></dd>
+<dt>Document sha256</dt><dd><code>${esc(docSha256)}</code></dd>
+<dt>Signature</dt><dd>${esc(sig.alg)} by key <code>${esc(sig.keyId)}</code> over the canonical JSON document</dd></dl>
+<h2>How to verify this offline</h2>
+<p>Save this page and run <code>node appforge-verify.mjs attestation.html --keys appforge-attestation-keys.json</code>, then <code>--render-check</code>. Only the JSON embedded below is signed: the visible text above is a rendering of it, and <code>--render-check</code> proves the two match.</p>
+<script type="application/json" id="appforge-evidence">${embedded}</script>
+</main></body></html>`;
+}
+/**
+ * The bundle and, when asked, its printable page, from an attestation's stored parts. The page is rendered from a
+ * JSON round trip of the bundle, so the bytes the verifier re-renders from the embedded JSON are the bytes written
+ * here (JS reorders integer-like object keys on a parse, and the round trip applies that once, up front).
+ */
+export async function renderEvidencePage(bundle) {
+    const roundTripped = JSON.parse(JSON.stringify(bundle));
+    return renderEvidenceHtml(roundTripped, { docSha256: await attestationDocumentSha256(roundTripped.attestation.doc) });
+}
+export function isoNowSeconds(now = new Date()) {
+    return toIsoUtcSeconds(now);
+}
+//# sourceMappingURL=vpn-attestation.js.map