@appforge-ci/core 0.3.0 → 0.3.2

package/dist/attestation-workerd.test.js

@@ -0,0 +1,183 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Ed25519 signing and verification in the real Workers runtime (workerd, the
+ * engine production runs on), not only in Node. PR-J only had this from the
+ * documentation; this runs the actual signing module inside workerd, with the
+ * compatibility date apps/admin-api deploys with.
+ *
+ * What it proves, in workerd: WebCrypto `Ed25519` import of a PKCS#8 key (the
+ * form `ATTESTATION_SIGNING_KEY` takes), public-key derivation through JWK
+ * export (how the signer learns its own key id), signing, verification, and
+ * that the bytes equal the pinned vectors an independent Node implementation
+ * produced (Ed25519 is deterministic, so any runtime must agree exactly).
+ *
+ * The workerd binary and esbuild are not direct dependencies: they come with
+ * `wrangler` (a root devDependency) and are resolved from there, so the
+ * lockfile does not change. workerd is run directly rather than through
+ * Miniflare, whose 5.x alpha configuration API is still moving. If they cannot
+ * be loaded this skips locally, and FAILS when CI is set, so the check cannot
+ * silently disappear from the pipeline.
+ */
+const COMPAT_DATE = "2025-04-01"; // apps/admin-api/wrangler.jsonc
+async function loadTooling() {
+    try {
+        const req = createRequire(import.meta.url);
+        const fromWrangler = createRequire(req.resolve("wrangler/package.json"));
+        const workerdMod = (await import(fromWrangler.resolve("workerd")));
+        const esbuild = (await import(fromWrangler.resolve("esbuild")));
+        const build = esbuild.build ?? esbuild.default?.build;
+        if (!build || typeof workerdMod.default !== "string")
+            return "workerd or esbuild did not expose the expected entry points";
+        return { workerd: workerdMod.default, build };
+    }
+    catch (err) {
+        return `wrangler's workerd/esbuild could not be loaded (${err instanceof Error ? err.message : String(err)})`;
+    }
+}
+function freePort() {
+    return new Promise((resolve, reject) => {
+        const srv = createServer();
+        srv.once("error", reject);
+        srv.listen(0, "127.0.0.1", () => {
+            const { port } = srv.address();
+            srv.close(() => resolve(port));
+        });
+    });
+}
+const WORKER_ENTRY = `
+import { ed25519KeyId, ed25519SeedToPkcs8, bytesToBase64, auditCheckpointStatement, signAuditCheckpoint, createEd25519Signer, verifyEd25519, hexToBytes, bytesToHex } from ${JSON.stringify(fileURLToPath(new URL("./attestation.ts", import.meta.url)))};
+import { ATTESTATION_DOMAIN, buildAttestationKeySet, loadAttestationSigner, signWithDomain, verifyAuditCheckpoint, verifyWithDomain } from ${JSON.stringify(fileURLToPath(new URL("./attestation-signing.ts", import.meta.url)))};
+
+export default {
+  async fetch() {
+    const out = {};
+    // The same deterministic test key the Node tests pin (derived from a label, never a production key).
+    const seed = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode("appforge-test-vector-seed-v1")));
+    const pkcs8 = ed25519SeedToPkcs8(seed);
+    const secret = bytesToBase64(pkcs8);
+
+    // RFC 8032 test vector 1: the runtime's Ed25519 is the standard algorithm.
+    const rfcSigner = await createEd25519Signer("k", ed25519SeedToPkcs8(hexToBytes("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60")));
+    const rfcSig = await rfcSigner.sign(new Uint8Array());
+    out.rfc8032 = bytesToHex(rfcSig) === "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b"
+      && (await verifyEd25519(hexToBytes("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"), new Uint8Array(), rfcSig));
+
+    // Derive the public key from the PKCS#8 secret exactly as the production signer does (JWK export), and publish it.
+    const probe = await loadAttestationSigner(secret, [], new Date("2026-10-02T00:00:00Z"));
+    out.unpublishedKeyId = probe.state === "unpublished" ? probe.keyId : probe.state;
+    const pub = await crypto.subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+    const jwk = await crypto.subtle.exportKey("jwk", pub);
+    const x = jwk.x.replace(/-/g, "+").replace(/_/g, "/");
+    const entry = { kid: probe.keyId, alg: "Ed25519", publicKey: x + "=".repeat((4 - (x.length % 4)) % 4), notBefore: "2026-01-01T00:00:00Z", status: "active" };
+
+    const state = await loadAttestationSigner(secret, [entry], new Date("2026-10-02T00:00:00Z"));
+    out.state = state.state;
+    out.keyId = state.keyId;
+    const keys = await buildAttestationKeySet([entry]);
+    out.keySetOk = keys.ok;
+
+    const stmt = auditCheckpointStatement({ orgId: "org_acme", seq: 7, hash: "ab".repeat(32), issuedAt: "2026-10-02T14:03:50Z" });
+    out.checkpointSignature = await signAuditCheckpoint(state.signer, stmt);
+    out.checkpointVerifies = (await verifyAuditCheckpoint(keys.keys, { orgId: "org_acme", seq: 7, hash: "ab".repeat(32), issuedAt: "2026-10-02T14:03:50Z", keyId: state.keyId, signature: out.checkpointSignature })).ok;
+    out.tamperRejected = (await verifyAuditCheckpoint(keys.keys, { orgId: "org_acme", seq: 8, hash: "ab".repeat(32), issuedAt: "2026-10-02T14:03:50Z", keyId: state.keyId, signature: out.checkpointSignature })).ok === false;
+
+    const doc = { issuedAt: "2026-10-02T14:03:50Z", subject: { buildId: "bld_1", orgId: "org_acme" } };
+    out.attestationSignature = await signWithDomain(state.signer, ATTESTATION_DOMAIN, doc);
+    out.attestationVerifies = (await verifyWithDomain(keys.keys, { domain: ATTESTATION_DOMAIN, value: doc, keyId: state.keyId, signature: out.attestationSignature, issuedAt: doc.issuedAt })).ok;
+
+    // A non-Ed25519 / garbage secret is refused in this runtime too.
+    out.garbageRefused = (await loadAttestationSigner("AAAA", [entry])).state === "invalid";
+    return Response.json(out);
+  },
+};
+`;
+test("Ed25519 signing, key derivation and verification work in workerd and match the pinned vectors", async (t) => {
+    const tooling = await loadTooling();
+    if (typeof tooling === "string") {
+        if (process.env.CI)
+            assert.fail(tooling);
+        t.skip(tooling);
+        return;
+    }
+    const built = await tooling.build({
+        stdin: { contents: WORKER_ENTRY, resolveDir: fileURLToPath(new URL(".", import.meta.url)), sourcefile: "worker-entry.js", loader: "js" },
+        bundle: true,
+        format: "esm",
+        platform: "neutral",
+        target: "es2022",
+        write: false,
+        logLevel: "silent",
+        // The sources import each other with ".js" specifiers that name their ".ts" files (NodeNext style).
+        plugins: [
+            {
+                name: "ts-js-specifiers",
+                setup(b) {
+                    const src = fileURLToPath(new URL(".", import.meta.url));
+                    b.onResolve({ filter: /^\.\.?\/.*\.js$/ }, (args) => {
+                        if (!args.resolveDir.startsWith(src.replace(/\/$/, "")))
+                            return undefined; // only this package's own sources (zod etc. resolve normally)
+                        return { path: fileURLToPath(new URL(args.path.replace(/\.js$/, ".ts"), `file://${args.resolveDir}/`)) };
+                    });
+                },
+            },
+        ],
+    });
+    const dir = mkdtempSync(join(tmpdir(), "appforge-workerd-"));
+    let child;
+    try {
+        writeFileSync(join(dir, "worker.mjs"), built.outputFiles[0].text);
+        const port = await freePort();
+        writeFileSync(join(dir, "config.capnp"), `using Workerd = import "/workerd/workerd.capnp";
+const config :Workerd.Config = (
+  services = [(name = "main", worker = .w)],
+  sockets = [(name = "http", address = "127.0.0.1:${port}", http = (), service = "main")]
+);
+const w :Workerd.Worker = (
+  modules = [(name = "worker", esModule = embed "worker.mjs")],
+  compatibilityDate = "${COMPAT_DATE}",
+);
+`);
+        child = spawn(tooling.workerd, ["serve", "config.capnp"], { cwd: dir, stdio: ["ignore", "pipe", "pipe"] });
+        let log = "";
+        child.stdout?.on("data", (d) => (log += d.toString()));
+        child.stderr?.on("data", (d) => (log += d.toString()));
+        let res;
+        for (let i = 0; i < 100 && !res; i++) {
+            try {
+                res = await fetch(`http://127.0.0.1:${port}/`);
+            }
+            catch {
+                if (child.exitCode !== null)
+                    assert.fail(`workerd exited early: ${log}`);
+                await new Promise((r) => setTimeout(r, 100));
+            }
+        }
+        assert.ok(res, `workerd never answered: ${log}`);
+        assert.equal(res.status, 200, log);
+        const out = (await res.json());
+        assert.equal(out.rfc8032, true, "RFC 8032 vector 1 reproduces in workerd");
+        assert.equal(out.state, "ready");
+        assert.equal(out.keyId, "fa0e09426c7aabe2", "public-key derivation (JWK export) in workerd yields the same key id as Node");
+        assert.equal(out.unpublishedKeyId, "fa0e09426c7aabe2");
+        assert.equal(out.keySetOk, true);
+        assert.equal(out.checkpointSignature, "WaJ3iUH1znI8fEAV3o/zvtO6LaP9VIpOTcuuzE0PVqFb/DHJ636nUZXal7I1qME9CJcxGiQMb9S28CsmLHO5DQ==", "byte-identical to the signature Node produces");
+        assert.equal(out.attestationSignature, "5SPJuifSVWrD32lYkGeUQUGi9WZ9IP4axfjWSj0kDmaz3J9UUiBN99/zApL0zCtXr8cxnDRaSLwcAQuphHfvBA==");
+        assert.equal(out.checkpointVerifies, true);
+        assert.equal(out.attestationVerifies, true);
+        assert.equal(out.tamperRejected, true);
+        assert.equal(out.garbageRefused, true);
+    }
+    finally {
+        child?.kill("SIGKILL");
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=attestation-workerd.test.js.map

package/dist/attestation-workerd.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-workerd.test.js","sourceRoot":"","sources":["../src/attestation-workerd.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,gCAAgC;AAIlE,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAyB,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAwE,CAAC;QACvI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,6DAA6D,CAAC;QAC3H,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IAChH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAsB,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG;6KACwJ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;6IAC3G,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4C/N,CAAC;AAEF,IAAI,CAAC,+FAA+F,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChH,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE;QACxI,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ;QAClB,oGAAoG;QACpG,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,kBAAkB;gBACxB,KAAK,CAAC,CAAkJ;oBACtJ,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;wBAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;4BAAE,OAAO,SAAS,CAAC,CAAC,8DAA8D;wBACzI,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3G,CAAC,CAAC,CAAC;gBACL,CAAC;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7D,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB;;;oDAG8C,IAAI;;;;yBAI/B,WAAW;;CAEnC,CACI,CAAC;QACF,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,GAAyB,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,yCAAyC,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,8EAA8E,CAAC,CAAC;QAC5H,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,0FAA0F,EAAE,+CAA+C,CAAC,CAAC;QACnL,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,0FAA0F,CAAC,CAAC;QACnI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/attestation.d.ts

@@ -73,19 +73,53 @@ export declare const auditVpnEventDataSchema: z.ZodObject<{
     detail: string | null;
 }>;
 /**
- * What a chain entry's `payload` column holds. Extended by later PRs with
- * further `kind`s (`attestation`, `gap`, ...); a verifier must reject a
- * kind it does not know rather than skip it.
+ * A chain entry that registers a per-build attestation (PR-M): "this exact document, by this key (or by none),
+ * was issued". `docSha256` is the sha256 of the document's canonical JSON, which is what ties the entry to the
+ * signed document; the offline verifier requires the entry right after the document's own chain head to carry
+ * the document's hash and build id. `keyId` is null for an attestation issued while signing was unavailable.
+ */
+export declare const auditAttestationDataSchema: z.ZodObject<{
+    buildId: z.ZodString;
+    docSha256: z.ZodString;
+    keyId: z.ZodNullable<z.ZodString>;
+    completeness: z.ZodEnum<["full", "partial", "server_observed_only"]>;
+}, "strict", z.ZodTypeAny, {
+    buildId: string;
+    docSha256: string;
+    keyId: string | null;
+    completeness: "full" | "partial" | "server_observed_only";
+}, {
+    buildId: string;
+    docSha256: string;
+    keyId: string | null;
+    completeness: "full" | "partial" | "server_observed_only";
+}>;
+export type AuditAttestationData = z.infer<typeof auditAttestationDataSchema>;
+/**
+ * A chain entry that records evidence which was expected and is missing, so the absence itself is part of the
+ * tamper-evident history (PR-M: a regulated build whose agent never reported).
+ */
+export declare const auditGapDataSchema: z.ZodObject<{
+    buildId: z.ZodString;
+    reason: z.ZodString;
+    detail: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    buildId: string;
+    detail: string;
+    reason: string;
+}, {
+    buildId: string;
+    detail: string;
+    reason: string;
+}>;
+export type AuditGapData = z.infer<typeof auditGapDataSchema>;
+/**
+ * What a chain entry's `payload` column holds. The known `kind`s are `vpn_event`, `attestation` and `gap`;
+ * a verifier must reject a kind it does not know rather than skip it, and `scripts/appforge-verify.mjs`
+ * (KNOWN_KINDS) is kept to this list by a test.
  */
 export declare const auditEntryPayloadSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    seq: z.ZodNumber;
-    orgId: z.ZodString;
     kind: z.ZodLiteral<"vpn_event">;
-    /** `VpnEvent.id` */
-    ref: z.ZodString;
-    /** When the source event was recorded (UTC). */
-    at: z.ZodString;
     data: z.ZodObject<{
         type: z.ZodString;
         tunnelId: z.ZodNullable<z.ZodString>;
@@ -105,13 +139,31 @@ export declare const auditEntryPayloadSchema: z.ZodDiscriminatedUnion<"kind", [z
         agentId: string | null;
         detail: string | null;
     }>;
+    v: z.ZodLiteral<1>;
+    seq: z.ZodNumber;
+    orgId: z.ZodString;
+    /** The source row's id (`VpnEvent.id`), or the attestation / gap id this entry registers. */
+    ref: z.ZodString;
+    /** When the source event was recorded (UTC). */
+    at: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    orgId: string;
-    at: string;
     kind: "vpn_event";
+    at: string;
+    orgId: string;
+    data: {
+        type: string;
+        tunnelId: string | null;
+        buildId: string | null;
+        agentId: string | null;
+        detail: string | null;
+    };
     v: 1;
     seq: number;
     ref: string;
+}, {
+    kind: "vpn_event";
+    at: string;
+    orgId: string;
     data: {
         type: string;
         tunnelId: string | null;
@@ -119,23 +171,111 @@ export declare const auditEntryPayloadSchema: z.ZodDiscriminatedUnion<"kind", [z
         agentId: string | null;
         detail: string | null;
     };
+    v: 1;
+    seq: number;
+    ref: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"attestation">;
+    data: z.ZodObject<{
+        buildId: z.ZodString;
+        docSha256: z.ZodString;
+        keyId: z.ZodNullable<z.ZodString>;
+        completeness: z.ZodEnum<["full", "partial", "server_observed_only"]>;
+    }, "strict", z.ZodTypeAny, {
+        buildId: string;
+        docSha256: string;
+        keyId: string | null;
+        completeness: "full" | "partial" | "server_observed_only";
+    }, {
+        buildId: string;
+        docSha256: string;
+        keyId: string | null;
+        completeness: "full" | "partial" | "server_observed_only";
+    }>;
+    v: z.ZodLiteral<1>;
+    seq: z.ZodNumber;
+    orgId: z.ZodString;
+    /** The source row's id (`VpnEvent.id`), or the attestation / gap id this entry registers. */
+    ref: z.ZodString;
+    /** When the source event was recorded (UTC). */
+    at: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "attestation";
+    at: string;
+    orgId: string;
+    data: {
+        buildId: string;
+        docSha256: string;
+        keyId: string | null;
+        completeness: "full" | "partial" | "server_observed_only";
+    };
+    v: 1;
+    seq: number;
+    ref: string;
 }, {
+    kind: "attestation";
+    at: string;
     orgId: string;
+    data: {
+        buildId: string;
+        docSha256: string;
+        keyId: string | null;
+        completeness: "full" | "partial" | "server_observed_only";
+    };
+    v: 1;
+    seq: number;
+    ref: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"gap">;
+    data: z.ZodObject<{
+        buildId: z.ZodString;
+        reason: z.ZodString;
+        detail: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        buildId: string;
+        detail: string;
+        reason: string;
+    }, {
+        buildId: string;
+        detail: string;
+        reason: string;
+    }>;
+    v: z.ZodLiteral<1>;
+    seq: z.ZodNumber;
+    orgId: z.ZodString;
+    /** The source row's id (`VpnEvent.id`), or the attestation / gap id this entry registers. */
+    ref: z.ZodString;
+    /** When the source event was recorded (UTC). */
+    at: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "gap";
     at: string;
-    kind: "vpn_event";
+    orgId: string;
+    data: {
+        buildId: string;
+        detail: string;
+        reason: string;
+    };
     v: 1;
     seq: number;
     ref: string;
+}, {
+    kind: "gap";
+    at: string;
+    orgId: string;
     data: {
-        type: string;
-        tunnelId: string | null;
-        buildId: string | null;
-        agentId: string | null;
-        detail: string | null;
+        buildId: string;
+        detail: string;
+        reason: string;
     };
+    v: 1;
+    seq: number;
+    ref: string;
 }>]>;
 export type AuditEntryPayload = z.infer<typeof auditEntryPayloadSchema>;
 export type AuditVpnEventData = z.infer<typeof auditVpnEventDataSchema>;
+/** The chain's known entry kinds, from the schema above. */
+export declare const AUDIT_ENTRY_KINDS: readonly string[];
 /** What a checkpoint signature covers: "org X's chain had head hash H at seq N when this was issued". */
 export declare const auditCheckpointStatementSchema: z.ZodObject<{
     v: z.ZodLiteral<1>;
@@ -174,17 +314,17 @@ export declare const auditCheckpointSchema: z.ZodObject<Omit<{
     signature: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     orgId: string;
+    keyId: string;
     seq: number;
     hash: string;
     issuedAt: string;
-    keyId: string;
     signature: string;
 }, {
     orgId: string;
+    keyId: string;
     seq: number;
     hash: string;
     issuedAt: string;
-    keyId: string;
     signature: string;
 }>;
 export type AuditCheckpoint = z.infer<typeof auditCheckpointSchema>;
@@ -242,12 +382,19 @@ export declare function verifyAuditChain(input: {
 /**
  * Signs bytes with a key the database does not hold. The interface exists
  * so the sealer can issue checkpoints without knowing where the key lives;
- * the production implementation (a Worker secret, PR-K) is deliberately not
- * in this change. Implementations must be Ed25519 (RFC 8032).
+ * the production implementation (a Worker secret) lives in
+ * apps/admin-api/src/lib/audit-signing.ts. Implementations must be Ed25519 (RFC 8032).
  */
 export interface AuditSigner {
     /** Self-certifying key id: see `ed25519KeyId`. */
     readonly keyId: string;
+    /**
+     * Optional guard: why this key may not vouch for something issued at `issuedAt`
+     * (ISO-8601 UTC), or null if it may. Callers that stamp an `issuedAt` check it
+     * at that instant, right before signing, and refuse to store a signature a
+     * verifier would reject.
+     */
+    problemAt?(issuedAt: string): string | null;
     sign(message: Uint8Array): Promise<Uint8Array>;
 }
 /** `sha256(raw 32-byte public key)`, first 16 hex characters. A key set cannot mislabel a key because the id is recomputed from it. */

package/dist/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,+BAA+B,CAAC;AACjE,8GAA8G;AAC9G,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAiDlE;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAMD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMrD;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E;AAID,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlF;AAOD,yKAAyK;AACzK,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAQzB,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;IAO9B,oBAAoB;;IAEpB,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKpD,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,yGAAyG;AACzG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;EAShC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB;;;;;;;;;IAEhC,8EAA8E;;;;;;;;;;;;;;;;EAE9E,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAExI;AAED,qDAAqD;AACrD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,wBAAwB,GAAG,UAAU,CAE3F;AAID,mHAAmH;AACnH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAElD;AAID,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgClC;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAKD,uIAAuI;AACvI,wBAAsB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAM/D;AAED,8FAA8F;AAC9F,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAQhG;AAED,+HAA+H;AAC/H,wBAAsB,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ1H;AAED,mGAAmG;AACnG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnH;AAED,yEAAyE;AACzE,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,UAAU,EACxB,SAAS,EAAE,wBAAwB,EACnC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAMlB"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,+BAA+B,CAAC;AACjE,8GAA8G;AAC9G,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAiDlE;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAMD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMrD;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E;AAID,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlF;AAOD,yKAAyK;AACzK,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAQzB,CAAC;AAEZ;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;EAO5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAMpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAY9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;IAXlC,6FAA6F;;IAE7F,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFhD,6FAA6F;;IAE7F,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFhD,6FAA6F;;IAE7F,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;IAahD,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAmE,CAAC;AAEnH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;EAShC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB;;;;;;;;;IAEhC,8EAA8E;;;;;;;;;;;;;;;;EAE9E,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAExI;AAED,qDAAqD;AACrD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,wBAAwB,GAAG,UAAU,CAE3F;AAID,mHAAmH;AACnH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAElD;AAID,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgClC;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,SAAS,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAKD,uIAAuI;AACvI,wBAAsB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAM/D;AAED,8FAA8F;AAC9F,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAQhG;AAED,+HAA+H;AAC/H,wBAAsB,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ1H;AAED,mGAAmG;AACnG,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnH;AAED,yEAAyE;AACzE,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,UAAU,EACxB,SAAS,EAAE,wBAAwB,EACnC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/attestation.js

@@ -157,25 +157,51 @@ export const auditVpnEventDataSchema = z
 })
     .strict();
 /**
- * What a chain entry's `payload` column holds. Extended by later PRs with
- * further `kind`s (`attestation`, `gap`, ...); a verifier must reject a
- * kind it does not know rather than skip it.
+ * A chain entry that registers a per-build attestation (PR-M): "this exact document, by this key (or by none),
+ * was issued". `docSha256` is the sha256 of the document's canonical JSON, which is what ties the entry to the
+ * signed document; the offline verifier requires the entry right after the document's own chain head to carry
+ * the document's hash and build id. `keyId` is null for an attestation issued while signing was unavailable.
+ */
+export const auditAttestationDataSchema = z
+    .object({
+    buildId: z.string().min(1).max(128),
+    docSha256: hex64,
+    keyId: z.string().min(1).max(64).nullable(),
+    completeness: z.enum(["full", "partial", "server_observed_only"]),
+})
+    .strict();
+/**
+ * A chain entry that records evidence which was expected and is missing, so the absence itself is part of the
+ * tamper-evident history (PR-M: a regulated build whose agent never reported).
+ */
+export const auditGapDataSchema = z
+    .object({
+    buildId: z.string().min(1).max(128),
+    reason: z.string().min(1).max(64),
+    detail: z.string().max(500),
+})
+    .strict();
+const auditEntryEnvelope = {
+    v: z.literal(1),
+    seq: z.number().int().min(1),
+    orgId: z.string().min(1),
+    /** The source row's id (`VpnEvent.id`), or the attestation / gap id this entry registers. */
+    ref: z.string().min(1),
+    /** When the source event was recorded (UTC). */
+    at: isoUtc,
+};
+/**
+ * What a chain entry's `payload` column holds. The known `kind`s are `vpn_event`, `attestation` and `gap`;
+ * a verifier must reject a kind it does not know rather than skip it, and `scripts/appforge-verify.mjs`
+ * (KNOWN_KINDS) is kept to this list by a test.
  */
 export const auditEntryPayloadSchema = z.discriminatedUnion("kind", [
-    z
-        .object({
-        v: z.literal(1),
-        seq: z.number().int().min(1),
-        orgId: z.string().min(1),
-        kind: z.literal("vpn_event"),
-        /** `VpnEvent.id` */
-        ref: z.string().min(1),
-        /** When the source event was recorded (UTC). */
-        at: isoUtc,
-        data: auditVpnEventDataSchema,
-    })
-        .strict(),
+    z.object({ ...auditEntryEnvelope, kind: z.literal("vpn_event"), data: auditVpnEventDataSchema }).strict(),
+    z.object({ ...auditEntryEnvelope, kind: z.literal("attestation"), data: auditAttestationDataSchema }).strict(),
+    z.object({ ...auditEntryEnvelope, kind: z.literal("gap"), data: auditGapDataSchema }).strict(),
 ]);
+/** The chain's known entry kinds, from the schema above. */
+export const AUDIT_ENTRY_KINDS = auditEntryPayloadSchema.options.map((o) => o.shape.kind.value);
 /** What a checkpoint signature covers: "org X's chain had head hash H at seq N when this was issued". */
 export const auditCheckpointStatementSchema = z
     .object({

package/dist/attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,qFAAqF;AAErF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,8GAA8G;AAC9G,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,kFAAkF;AAElF,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAChG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,CAAU,EAAE,KAAa;IAC/C,IAAI,KAAK,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,QAAQ,OAAO,CAAC,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9B,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAClC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;oBAC5E,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAY,CAAC;YAClD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnH,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,+EAA+E;YAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxG,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,2EAA2E;AAE3E,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAyB;IACvD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,SAAS,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgB;IAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC,GAAG,kBAAkB,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAE3E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,sDAAsD,CAAC,CAAC;AAClI,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;AAE9E,yKAAyK;AACzK,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC;SACE,MAAM,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,oBAAoB;QACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,gDAAgD;QAChD,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,uBAAuB;KAC9B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAIH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,MAAM;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAChC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,UAAU,wBAAwB,CAAC,KAAqE;IAC5G,OAAO,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,2BAA2B,CAAC,SAAmC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,aAAa,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,8EAA8E;AAE9E,mHAAmH;AACnH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,CAAC,GAAG,0DAA0D,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/F,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAItC;IACC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACpH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,SAAS,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QACtG,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YACtG,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACnI,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;iBAC/E,CAAC;gBACJ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjE,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,SAAS,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACnG,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QACpB,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAgBD,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,UAAU,CAAC,kCAAkC,CAAC,CAAC;AAE5E,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAwB;IACzD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACnG,OAAO,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAwB,EAAE,OAAmB,EAAE,SAAqB;IACtG,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvG,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAmB,EAAE,SAAmC;IAChG,OAAO,aAAa,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,YAAwB,EACxB,SAAmC,EACnC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,qFAAqF;AAErF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,8GAA8G;AAC9G,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,kFAAkF;AAElF,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAChG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,CAAU,EAAE,KAAa;IAC/C,IAAI,KAAK,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,QAAQ,OAAO,CAAC,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9B,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAClC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;oBAC5E,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAY,CAAC;YAClD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnH,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,+EAA+E;YAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxG,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,2EAA2E;AAE3E,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClH,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAyB;IACvD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,SAAS,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgB;IAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC,GAAG,kBAAkB,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,2EAA2E;AAE3E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,sDAAsD,CAAC,CAAC;AAClI,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;AAE9E,yKAAyK;AACzK,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;CAClE,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,kBAAkB,GAAG;IACzB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,gDAAgD;IAChD,EAAE,EAAE,MAAM;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACzG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9G,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/F,CAAC,CAAC;AAGH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAsB,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEnH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,MAAM;CACjB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAChC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,UAAU,wBAAwB,CAAC,KAAqE;IAC5G,OAAO,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,2BAA2B,CAAC,SAAmC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,aAAa,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,8EAA8E;AAE9E,mHAAmH;AACnH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,CAAC,GAAG,0DAA0D,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/F,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAItC;IACC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACpH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,SAAS,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpG,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QACtG,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YACtG,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACnI,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;iBAC/E,CAAC;gBACJ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjE,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,SAAS,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACnG,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;QACpB,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAuBD,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,UAAU,CAAC,kCAAkC,CAAC,CAAC;AAE5E,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,YAAwB;IACzD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACnG,OAAO,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+HAA+H;AAC/H,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAwB,EAAE,OAAmB,EAAE,SAAqB;IACtG,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvG,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAmB,EAAE,SAAmC;IAChG,OAAO,aAAa,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,YAAwB,EACxB,SAAmC,EACnC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/build-vpn.d.ts

@@ -1,4 +1,4 @@
-import type { BuildVpnStatus } from "./types.js";
+import type { BuildAttestationStatus, BuildVpnStatus } from "./types.js";
 /**
  * One-line, human-readable summary of `Build.vpn`, shared by the dashboard's
  * Network panel and `appforge build show` so they never disagree.
@@ -7,4 +7,14 @@ import type { BuildVpnStatus } from "./types.js";
  *   "No VPN"
  */
 export declare function describeBuildVpn(vpn: BuildVpnStatus | undefined): string;
+/**
+ * One-line, human-readable state of a build's attestation, shared by the dashboard and `appforge build show`. Says plainly when it
+ * is not (yet) evidence: pending, degraded, unsigned, or recording a violation.
+ *   "Evidence: complete, signed, all controls enforced"
+ *   "Evidence: complete, signed, 2 control violations recorded"
+ *   "Evidence: DEGRADED (the agent did not report), signed: server-observed facts only"
+ *   "Evidence: complete, NOT SIGNED (the platform had no signing key)"
+ *   "Evidence: pending (the build's agent has not reported yet)"
+ */
+export declare function describeBuildAttestation(a: BuildAttestationStatus | undefined): string | null;
 //# sourceMappingURL=build-vpn.d.ts.map

package/dist/build-vpn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-vpn.d.ts","sourceRoot":"","sources":["../src/build-vpn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,CAUxE"}
+{"version":3,"file":"build-vpn.d.ts","sourceRoot":"","sources":["../src/build-vpn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,CAUxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAe7F"}