@c4a/context 0.7.0 → 0.7.1

package/index.js

@@ -12688,11 +12688,6 @@ var indexerPartitionStrategyDeclarationSchema = exports_external.object({
 }).strict().superRefine((value, context) => {
   addDuplicateIssues(value.profiles, context, "partition strategy profiles");
 });
-var overlayAttestationResourceSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-attestation/v1"),
-  resource: portableIndexerPathSchema,
-  integrity: indexerDigestSchema
-}).strict();
 var contractOverlayResourceSchema = exports_external.object({
   id: indexerIdSchema,
   protocol: exports_external.literal("context.indexer.contract-overlay/v1"),
@@ -12701,8 +12696,7 @@ var contractOverlayResourceSchema = exports_external.object({
     version: indexerSemverSchema
   }).strict(),
   resource: portableIndexerPathSchema,
-  integrity: indexerDigestSchema,
-  attestation: overlayAttestationResourceSchema.optional()
+  integrity: indexerDigestSchema
 }).strict();
 var providesSchema = exports_external.object({
   profiles: exports_external.array(indexerIdSchema).min(1),
@@ -12943,10 +12937,7 @@ function referencedProviderPaths(manifest) {
     ...manifest.provider.config_schema === undefined ? [] : [manifest.provider.config_schema],
     ...manifest.customization?.guide === undefined ? [] : [manifest.customization.guide],
     ...manifest.quality_guidance?.repair === undefined ? [] : [manifest.quality_guidance.repair],
-    ...(manifest.provides.contract_overlays ?? []).flatMap((overlay) => [
-      overlay.resource,
-      ...overlay.attestation === undefined ? [] : [overlay.attestation.resource]
-    ])
+    ...(manifest.provides.contract_overlays ?? []).map((overlay) => overlay.resource)
   ];
 }
 async function assertBundleFile(bundleRoot, path) {
@@ -15786,7 +15777,7 @@ function assertIndexerGeneratedAuthoringAuditClear(audit) {
 }
 
 // src/indexerArtifactResult.ts
-var evidenceBindingSchema = exports_external.object({
+var indexerEvidenceBindingSchema = exports_external.object({
   evidence_ref: indexerCanonicalRefSchema,
   kind: exports_external.enum(INDEXER_EVIDENCE_KINDS),
   source_ref: indexerCanonicalRefSchema,
@@ -15925,7 +15916,7 @@ var indexerArtifactResultSchema = exports_external.object({
   structured_declarations: indexerStructuredDeclarationSetSchema.optional(),
   structured_claims: indexerStructuredClaimSetSchema.optional(),
   facts: exports_external.array(indexerArtifactFactSchema),
-  evidence_bindings: exports_external.array(evidenceBindingSchema),
+  evidence_bindings: exports_external.array(indexerEvidenceBindingSchema),
   artifacts: exports_external.array(artifactSchema),
   artifact_bundle: indexerArtifactBundleSchema.nullable(),
   material_question_proposals: exports_external.array(materialQuestionProposalSchema),
@@ -16154,6 +16145,8 @@ function validateTargetResolution(result, view, evidenceRefs) {
       if (canonicalIndexerNodeRef(disposition.subject_key) === (entry.state === "resolved" ? entry.node_ref : "")) {
         throw new TypeError("index-target-resolution-invalid: create-independent must introduce a distinct SubjectKey");
       }
+    } else if (entry.state !== "absent") {
+      throw new TypeError("index-target-resolution-invalid: resolved targets cannot be reported as unavailable");
     }
   }
 }
@@ -21328,10 +21321,7 @@ var indexerMaterialAnswerEvidenceCompatibilitySchema = exports_external.discrimi
   incompatibleEvidenceSchema
 ]);
 function indexerMaterialAnswerSourceInputSetDigest(sourceInputDigests) {
-  const digests = sourceInputDigests.map((digest) => indexerDigestSchema.parse(digest)).sort(compareIndexerCanonicalText);
-  if (new Set(digests).size !== digests.length) {
-    throw new TypeError("material-answer source input digests must be unique");
-  }
+  const digests = [...new Set(sourceInputDigests.map((digest) => indexerDigestSchema.parse(digest)))].sort(compareIndexerCanonicalText);
   return indexerProtocolDigest({ inputs: digests });
 }
 function compatibilityPayload(report) {
@@ -25368,8 +25358,7 @@ function validateIndexerProviderSelectionProposal(value) {
   }
   return proposal;
 }
-// src/indexerOverlayTrust.ts
-import { createPublicKey, verify } from "node:crypto";
+// src/indexerContractOverlay.ts
 var minimumTighteningSchema = exports_external.object({
   metric_ref: indexerIdSchema,
   direction: exports_external.literal("minimum"),
@@ -25599,306 +25588,61 @@ function validateIndexerContractOverlay(input) {
     report: { ...reportPayload4, report_digest: reportDigest(reportPayload4) }
   };
 }
-var base64Schema = exports_external.string().regex(/^[A-Za-z0-9+/]+={0,2}$/u);
-var indexerOverlayAttestationSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-attestation/v1"),
-  overlay: exports_external.object({
-    protocol: exports_external.literal("context.indexer.contract-overlay/v1"),
-    id: indexerIdSchema,
-    version: indexerSemverSchema,
-    digest: indexerDigestSchema
-  }).strict(),
-  base: exports_external.object({
-    profile: indexerIdSchema,
-    version: indexerSemverSchema,
-    contract_digest: indexerDigestSchema
-  }).strict(),
-  operator_contract: exports_external.object({
-    version: indexerSemverSchema,
-    digest: indexerDigestSchema
-  }).strict(),
-  issuer: indexerIdSchema,
-  key_id: indexerIdSchema,
-  algorithm: exports_external.literal("ed25519"),
-  signature: base64Schema,
-  attestation_digest: indexerDigestSchema
-}).strict();
-function indexerOverlayAttestationSigningPayload(attestation) {
-  return canonicalIndexerJson(attestation);
-}
-function indexerOverlayAttestationDigest(attestation) {
-  return indexerProtocolDigest(attestation);
-}
-var trustKeySchema = exports_external.object({
-  key_id: indexerIdSchema,
-  algorithm: exports_external.literal("ed25519"),
-  public_key: base64Schema,
-  not_before: exports_external.string().datetime({ offset: true }),
-  not_after: exports_external.string().datetime({ offset: true })
-}).strict();
-var indexerOverlayTrustBundleSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-trust-bundle/v1"),
-  policy_id: indexerIdSchema,
-  policy_version: indexerSemverSchema,
-  issuers: exports_external.array(exports_external.object({
-    id: indexerIdSchema,
-    keys: exports_external.array(trustKeySchema).min(1)
-  }).strict()).min(1),
-  revocations: exports_external.array(exports_external.object({
-    issuer: indexerIdSchema,
-    key_id: indexerIdSchema,
-    revoked_at: exports_external.string().datetime({ offset: true })
-  }).strict()),
-  policy_digest: indexerDigestSchema
-}).strict().superRefine((value, context) => {
-  const issuerIds = new Set;
-  const trustedKeys = new Set;
-  value.issuers.forEach((issuer, issuerIndex) => {
-    if (issuerIds.has(issuer.id)) {
-      context.addIssue({
-        code: exports_external.ZodIssueCode.custom,
-        message: `duplicate issuer ${issuer.id}`,
-        path: ["issuers", issuerIndex, "id"]
-      });
-    }
-    issuerIds.add(issuer.id);
-    const keyIds = new Set;
-    issuer.keys.forEach((key, keyIndex) => {
-      if (keyIds.has(key.key_id)) {
-        context.addIssue({
-          code: exports_external.ZodIssueCode.custom,
-          message: `duplicate key ${issuer.id}:${key.key_id}`,
-          path: ["issuers", issuerIndex, "keys", keyIndex, "key_id"]
-        });
-      }
-      keyIds.add(key.key_id);
-      trustedKeys.add(`${issuer.id}\x00${key.key_id}`);
-      if (Date.parse(key.not_before) >= Date.parse(key.not_after)) {
-        context.addIssue({
-          code: exports_external.ZodIssueCode.custom,
-          message: "key not_before must precede not_after",
-          path: ["issuers", issuerIndex, "keys", keyIndex, "not_after"]
-        });
-      }
-    });
-  });
-  const revocations = new Set;
-  value.revocations.forEach((revocation, index) => {
-    const ref = `${revocation.issuer}\x00${revocation.key_id}`;
-    if (!trustedKeys.has(ref)) {
-      context.addIssue({
-        code: exports_external.ZodIssueCode.custom,
-        message: "revocation references an unknown trusted key",
-        path: ["revocations", index]
-      });
-    }
-    if (revocations.has(ref)) {
-      context.addIssue({
-        code: exports_external.ZodIssueCode.custom,
-        message: "duplicate revocation",
-        path: ["revocations", index]
-      });
-    }
-    revocations.add(ref);
-  });
-});
-function indexerOverlayTrustBundleDigest(bundle) {
-  return indexerProtocolDigest(bundle);
-}
-var indexerOverlayTrustBundleEnvelopeSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-trust-bundle-envelope/v1"),
-  adapter: indexerIdSchema,
-  adapter_version: indexerSemverSchema,
-  management_authority_digest: indexerDigestSchema,
-  bundle: indexerOverlayTrustBundleSchema
-}).strict();
-var enterpriseTrustReceiptSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-trust-receipt/v1"),
-  trust_class: exports_external.literal("enterprise-signed"),
-  project_ref: exports_external.null(),
-  overlay_digest: indexerDigestSchema,
-  attestation_digest: indexerDigestSchema,
-  base_contract_digest: indexerDigestSchema,
-  provider_integrity: indexerDigestSchema,
-  operator_contract_digest: indexerDigestSchema,
-  conformance_report_digest: indexerDigestSchema,
-  trust_adapter: indexerIdSchema,
-  trust_adapter_version: indexerSemverSchema,
-  trust_management_authority_digest: indexerDigestSchema,
-  trust_policy_digest: indexerDigestSchema,
-  authorization_receipt_digest: exports_external.null(),
-  receipt_digest: indexerDigestSchema
-}).strict();
-var projectTrustReceiptSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-trust-receipt/v1"),
-  trust_class: exports_external.literal("project-authorized-exact-digest"),
+var indexerOverlayValidationReceiptSchema = exports_external.object({
+  protocol: exports_external.literal("context.indexer.overlay-validation-receipt/v1"),
   project_ref: exports_external.string().min(1),
   overlay_digest: indexerDigestSchema,
-  attestation_digest: indexerDigestSchema.nullable(),
   base_contract_digest: indexerDigestSchema,
   provider_integrity: indexerDigestSchema,
   operator_contract_digest: indexerDigestSchema,
   conformance_report_digest: indexerDigestSchema,
-  trust_adapter: exports_external.null(),
-  trust_adapter_version: exports_external.null(),
-  trust_management_authority_digest: exports_external.null(),
-  trust_policy_digest: exports_external.null(),
-  authorization_receipt_digest: indexerDigestSchema,
   receipt_digest: indexerDigestSchema
 }).strict();
-var indexerOverlayTrustReceiptSchema = exports_external.discriminatedUnion("trust_class", [
-  enterpriseTrustReceiptSchema,
-  projectTrustReceiptSchema
-]);
-function indexerOverlayTrustReceiptDigest(receipt) {
+function indexerOverlayValidationReceiptDigest(receipt) {
   return indexerProtocolDigest(receipt);
 }
-function validateIndexerOverlayAttestation(value, overlay, base, operators) {
-  const parsed = indexerOverlayAttestationSchema.parse(value);
-  const payload2 = withoutFields(parsed, ["attestation_digest"]);
-  if (indexerOverlayAttestationDigest(payload2) !== parsed.attestation_digest) {
-    throw new TypeError("overlay attestation digest does not match its canonical payload");
-  }
-  if (parsed.overlay.id !== overlay.id || parsed.overlay.version !== overlay.version || parsed.overlay.digest !== overlay.overlay_digest || parsed.base.profile !== overlay.extends.profile || parsed.base.version !== base.version || parsed.base.contract_digest !== base.contract_digest || parsed.operator_contract.version !== operators.version || parsed.operator_contract.digest !== operators.contract_digest) {
-    throw new TypeError("overlay attestation is bound to another contract payload");
-  }
-  return parsed;
-}
-function validateIndexerOverlayTrustBundleEnvelope(value) {
-  const envelope = indexerOverlayTrustBundleEnvelopeSchema.parse(value);
-  const payload2 = withoutFields(envelope.bundle, ["policy_digest"]);
-  if (indexerOverlayTrustBundleDigest(payload2) !== envelope.bundle.policy_digest) {
-    throw new TypeError("overlay trust bundle digest does not match its canonical payload");
-  }
-  return envelope;
-}
-function revalidateOverlayResult(input) {
+function createIndexerOverlayValidationReceipt(input) {
+  const projectRef = exports_external.string().min(1).parse(input.projectRef);
+  const providerIntegrity = indexerDigestSchema.parse(input.providerIntegrity);
   const validation = validateIndexerContractOverlay({
     overlay: input.overlayValidation.overlay,
-    baseContract: input.base,
-    operatorContract: input.operators
+    baseContract: input.baseContract,
+    operatorContract: input.operatorContract
   });
-  if (validation.report.report_digest !== input.overlayValidation.report.report_digest) {
+  if (canonicalIndexerJson(validation.report) !== canonicalIndexerJson(input.overlayValidation.report)) {
     throw new TypeError("overlay conformance report is not the canonical current report");
   }
-  return validation;
-}
-function verifyEnterpriseIndexerOverlayTrust(input) {
-  const now = input.now ?? new Date;
-  const operators = validateIndexerOperatorContract(input.operatorContract);
-  const base = validateIndexerProfileContract(input.baseContract, operators);
-  const validation = revalidateOverlayResult({
-    overlayValidation: input.overlayValidation,
-    base,
-    operators
-  });
-  const attestation = validateIndexerOverlayAttestation(input.attestation, validation.overlay, base, operators);
-  const trustEnvelope = validateIndexerOverlayTrustBundleEnvelope(input.trustBundleEnvelope);
-  const issuer = trustEnvelope.bundle.issuers.find((item) => item.id === attestation.issuer);
-  const key = issuer?.keys.find((item) => item.key_id === attestation.key_id);
-  if (key === undefined) {
-    throw new TypeError("overlay attestation issuer or key is not trusted");
-  }
-  const nowMs = now.getTime();
-  if (Date.parse(key.not_before) > nowMs || Date.parse(key.not_after) <= nowMs) {
-    throw new TypeError("overlay attestation key is outside its validity window");
-  }
-  const revoked = trustEnvelope.bundle.revocations.some((revocation) => revocation.issuer === attestation.issuer && revocation.key_id === attestation.key_id && Date.parse(revocation.revoked_at) <= nowMs);
-  if (revoked)
-    throw new TypeError("overlay attestation key has been revoked");
-  const signingPayload = withoutFields(attestation, ["signature", "attestation_digest"]);
-  const publicKey = createPublicKey({
-    key: Buffer.from(key.public_key, "base64"),
-    format: "der",
-    type: "spki"
-  });
-  const verified = verify(null, Buffer.from(indexerOverlayAttestationSigningPayload(signingPayload)), publicKey, Buffer.from(attestation.signature, "base64"));
-  if (!verified)
-    throw new TypeError("overlay attestation signature is invalid");
-  const receiptPayload = {
-    protocol: "context.indexer.overlay-trust-receipt/v1",
-    trust_class: "enterprise-signed",
-    project_ref: null,
+  const payload2 = {
+    protocol: "context.indexer.overlay-validation-receipt/v1",
+    project_ref: projectRef,
     overlay_digest: validation.overlay.overlay_digest,
-    attestation_digest: attestation.attestation_digest,
-    base_contract_digest: base.contract_digest,
-    provider_integrity: input.providerIntegrity,
-    operator_contract_digest: operators.contract_digest,
-    conformance_report_digest: validation.report.report_digest,
-    trust_adapter: trustEnvelope.adapter,
-    trust_adapter_version: trustEnvelope.adapter_version,
-    trust_management_authority_digest: trustEnvelope.management_authority_digest,
-    trust_policy_digest: trustEnvelope.bundle.policy_digest,
-    authorization_receipt_digest: null
+    base_contract_digest: validation.report.base_contract_digest,
+    provider_integrity: providerIntegrity,
+    operator_contract_digest: validation.report.operator_contract_digest,
+    conformance_report_digest: validation.report.report_digest
   };
-  return indexerOverlayTrustReceiptSchema.parse({
-    ...receiptPayload,
-    receipt_digest: indexerOverlayTrustReceiptDigest(receiptPayload)
+  return indexerOverlayValidationReceiptSchema.parse({
+    ...payload2,
+    receipt_digest: indexerOverlayValidationReceiptDigest(payload2)
   });
 }
-var indexerOverlayProjectAuthorizationSchema = exports_external.object({
-  protocol: exports_external.literal("context.indexer.overlay-project-authorization/v1"),
-  project_ref: exports_external.string().min(1),
-  overlay_digest: indexerDigestSchema,
-  attestation_digest: indexerDigestSchema.nullable(),
-  base_contract_digest: indexerDigestSchema,
-  provider_integrity: indexerDigestSchema,
-  operator_contract_digest: indexerDigestSchema,
-  conformance_report_digest: indexerDigestSchema,
-  authority_ref: exports_external.string().min(1),
-  authority_scope_digest: indexerDigestSchema,
-  authorization_receipt_digest: indexerDigestSchema
-}).strict();
-function indexerOverlayProjectAuthorizationDigest(authorization) {
-  return indexerProtocolDigest(authorization);
-}
-function authorizeProjectIndexerOverlay(input) {
-  const operators = validateIndexerOperatorContract(input.operatorContract);
-  const base = validateIndexerProfileContract(input.baseContract, operators);
-  const validation = revalidateOverlayResult({
+function validateIndexerOverlayValidationReceipt(input) {
+  const receipt = indexerOverlayValidationReceiptSchema.parse(input.value);
+  const payload2 = withoutFields(receipt, ["receipt_digest"]);
+  if (indexerOverlayValidationReceiptDigest(payload2) !== receipt.receipt_digest) {
+    throw new TypeError("overlay validation receipt digest is invalid");
+  }
+  const expected = createIndexerOverlayValidationReceipt({
     overlayValidation: input.overlayValidation,
-    base,
-    operators
+    baseContract: input.baseContract,
+    operatorContract: input.operatorContract,
+    providerIntegrity: input.providerIntegrity,
+    projectRef: input.projectRef
   });
-  const authorization = indexerOverlayProjectAuthorizationSchema.parse(input.authorization);
-  const payload2 = withoutFields(authorization, ["authorization_receipt_digest"]);
-  if (indexerOverlayProjectAuthorizationDigest(payload2) !== authorization.authorization_receipt_digest) {
-    throw new TypeError("overlay project authorization receipt digest is invalid");
+  if (canonicalIndexerJson(expected) !== canonicalIndexerJson(receipt)) {
+    throw new TypeError("overlay validation receipt is stale or bound to another validation");
   }
-  const expected = {
-    project_ref: input.projectRef,
-    overlay_digest: validation.overlay.overlay_digest,
-    attestation_digest: input.declaredAttestationDigest,
-    base_contract_digest: base.contract_digest,
-    provider_integrity: input.providerIntegrity,
-    operator_contract_digest: operators.contract_digest,
-    conformance_report_digest: validation.report.report_digest
-  };
-  for (const [field, value] of Object.entries(expected)) {
-    if (authorization[field] !== value) {
-      throw new TypeError(`overlay project authorization does not match ${field}`);
-    }
-  }
-  const receiptPayload = {
-    protocol: "context.indexer.overlay-trust-receipt/v1",
-    trust_class: "project-authorized-exact-digest",
-    project_ref: input.projectRef,
-    overlay_digest: input.overlayValidation.overlay.overlay_digest,
-    attestation_digest: input.declaredAttestationDigest,
-    base_contract_digest: base.contract_digest,
-    provider_integrity: input.providerIntegrity,
-    operator_contract_digest: operators.contract_digest,
-    conformance_report_digest: input.overlayValidation.report.report_digest,
-    trust_adapter: null,
-    trust_adapter_version: null,
-    trust_management_authority_digest: null,
-    trust_policy_digest: null,
-    authorization_receipt_digest: authorization.authorization_receipt_digest
-  };
-  return indexerOverlayTrustReceiptSchema.parse({
-    ...receiptPayload,
-    receipt_digest: indexerOverlayTrustReceiptDigest(receiptPayload)
-  });
+  return receipt;
 }
 // src/indexerOverlayQuestionAmendment.ts
 var comparisonChangeSchema = exports_external.object({
@@ -25956,7 +25700,7 @@ var indexerOverlayQuestionAmendmentSchema = exports_external.object({
   target_registry: indexerRegistrySchema,
   target_registry_digest: indexerDigestSchema,
   overlay_digest: indexerDigestSchema,
-  overlay_trust_receipt_digest: indexerDigestSchema,
+  overlay_validation_receipt_digest: indexerDigestSchema,
   conformance_report_digest: indexerDigestSchema,
   added_target_domains: exports_external.array(amendmentTargetDomainSchema).min(1),
   added_questions: exports_external.array(amendmentQuestionSchema).min(1),
@@ -25969,10 +25713,10 @@ function withoutDigest2(value, field) {
   Reflect.deleteProperty(payload2, field);
   return payload2;
 }
-function trustReceiptDigest(receipt) {
+function validationReceiptDigest(receipt) {
   const payload2 = withoutDigest2(receipt, "receipt_digest");
-  if (indexerOverlayTrustReceiptDigest(payload2) !== receipt.receipt_digest) {
-    throw new TypeError("overlay trust receipt digest is invalid");
+  if (indexerOverlayValidationReceiptDigest(payload2) !== receipt.receipt_digest) {
+    throw new TypeError("overlay validation receipt digest is invalid");
   }
   return receipt.receipt_digest;
 }
@@ -26008,12 +25752,9 @@ function assertNamespacedTargetDomain(id) {
     throw new TypeError("overlay question target-domain ids must be namespaced");
   }
 }
-function assertTrustReceipt(input) {
-  if (input.receipt.overlay_digest !== input.overlay.overlay_digest || input.receipt.base_contract_digest !== input.base.contract_digest || input.receipt.provider_integrity !== input.providerIntegrity || input.receipt.operator_contract_digest !== input.operators.contract_digest || input.receipt.conformance_report_digest !== input.report.report_digest) {
-    throw new TypeError("overlay trust receipt is stale or bound to another validation");
-  }
-  if (input.receipt.trust_class === "project-authorized-exact-digest" && input.receipt.project_ref !== input.projectRef) {
-    throw new TypeError("project overlay trust receipt belongs to another project");
+function assertValidationReceipt(input) {
+  if (input.receipt.overlay_digest !== input.overlay.overlay_digest || input.receipt.base_contract_digest !== input.base.contract_digest || input.receipt.provider_integrity !== input.providerIntegrity || input.receipt.operator_contract_digest !== input.operators.contract_digest || input.receipt.conformance_report_digest !== input.report.report_digest || input.receipt.project_ref !== input.projectRef) {
+    throw new TypeError("overlay validation receipt is stale or bound to another validation");
   }
 }
 function validateQuestionAdditions(input) {
@@ -26095,8 +25836,8 @@ function resolveIndexerOverlayQuestionBindingAuthority(input) {
   if (canonicalIndexerJson(validation.report) !== canonicalIndexerJson(input.proof.overlay_validation.report)) {
     throw new TypeError("overlay question authority requires the current conformance report");
   }
-  const receipt = indexerOverlayTrustReceiptSchema.parse(input.proof.trust_receipt);
-  assertTrustReceipt({
+  const receipt = indexerOverlayValidationReceiptSchema.parse(input.proof.validation_receipt);
+  assertValidationReceipt({
     receipt,
     projectRef: input.proof.project_ref,
     providerIntegrity: input.proof.provider_integrity,
@@ -26105,7 +25846,7 @@ function resolveIndexerOverlayQuestionBindingAuthority(input) {
     operators: input.operator_contract,
     report: validation.report
   });
-  trustReceiptDigest(receipt);
+  validationReceiptDigest(receipt);
   const authorityRef = overlayAuthorityRef(validation.overlay);
   if (binding.authority.ref !== authorityRef || binding.authority.digest !== validation.overlay.overlay_digest) {
     throw new TypeError("overlay question binding belongs to another overlay authority");
@@ -26160,8 +25901,8 @@ function buildIndexerOverlayQuestionAmendment(input) {
   if (canonicalIndexerJson(validation.report) !== canonicalIndexerJson(input.overlay_validation.report)) {
     throw new TypeError("overlay question amendment requires the current conformance report");
   }
-  const receipt = indexerOverlayTrustReceiptSchema.parse(input.trust_receipt);
-  assertTrustReceipt({
+  const receipt = indexerOverlayValidationReceiptSchema.parse(input.validation_receipt);
+  assertValidationReceipt({
     receipt,
     projectRef: input.project_ref,
     providerIntegrity: input.provider_integrity,
@@ -26206,7 +25947,7 @@ function buildIndexerOverlayQuestionAmendment(input) {
     target_registry: targetRegistry2,
     target_registry_digest: targetDigests.registryDigest,
     overlay_digest: validation.overlay.overlay_digest,
-    overlay_trust_receipt_digest: trustReceiptDigest(receipt),
+    overlay_validation_receipt_digest: validationReceiptDigest(receipt),
     conformance_report_digest: validation.report.report_digest,
     added_target_domains: additions.targetDomains,
     added_questions: additions.questions,
@@ -26329,7 +26070,7 @@ var indexerOverlayQuestionRegistryApplyProposalSchema = exports_external.object(
   amendment: indexerOverlayQuestionAmendmentSchema,
   confirmation: indexerRequirementAmendmentConfirmationSchema,
   overlay_contract_digest: indexerDigestSchema,
-  overlay_trust_receipt_digest: indexerDigestSchema,
+  overlay_validation_receipt_digest: indexerDigestSchema,
   rebind_receipt_digest: indexerDigestSchema,
   rebound_selection_digest: indexerDigestSchema,
   subject_key_schema_set_digest: indexerDigestSchema,
@@ -26428,7 +26169,7 @@ function buildIndexerOverlayQuestionRegistryApplyProposal(input) {
     amendment,
     confirmation,
     overlay_contract_digest: amendment.overlay_digest,
-    overlay_trust_receipt_digest: amendment.overlay_trust_receipt_digest,
+    overlay_validation_receipt_digest: amendment.overlay_validation_receipt_digest,
     rebind_receipt_digest: input.rebind_receipt_digest,
     rebound_selection_digest: input.rebound_selection_digest,
     subject_key_schema_set_digest: input.subject_key_schema_set_digest,
@@ -26446,7 +26187,7 @@ function validateIndexerOverlayQuestionRegistryApplyProposal(value) {
     amendment,
     confirmation: proposal.confirmation
   });
-  if (proposal.project_ref !== amendment.project_ref || proposal.overlay_contract_digest !== amendment.overlay_digest || proposal.overlay_trust_receipt_digest !== amendment.overlay_trust_receipt_digest || proposal.base_registry.requirement_set_digest !== amendment.base_requirement_set_digest || proposal.target_registry.requirement_set_digest !== amendment.target_requirement_set_digest || proposal.target_registry.registry_digest !== amendment.target_registry_digest) {
+  if (proposal.project_ref !== amendment.project_ref || proposal.overlay_contract_digest !== amendment.overlay_digest || proposal.overlay_validation_receipt_digest !== amendment.overlay_validation_receipt_digest || proposal.base_registry.requirement_set_digest !== amendment.base_requirement_set_digest || proposal.target_registry.requirement_set_digest !== amendment.target_requirement_set_digest || proposal.target_registry.registry_digest !== amendment.target_registry_digest) {
     throw new TypeError("overlay coupled proposal does not bind its amendment");
   }
   const target = parseIndexerRegistry(proposal.target_document_content, "overlay-proposal:target");
@@ -26841,9 +26582,11 @@ function resolveIndexerSubjectKeySchemas(input) {
     if (owner === undefined) {
       throw new TypeError(`extension profile ${selection.profile} has no exact owner Provider layer`);
     }
-    const declarations = input.providers.flatMap((provider) => (provider.manifest.composition?.extensions ?? []).filter((extension) => extension.profile === selection.profile).map((extension) => ({ provider, extension })));
+    const declarations = input.providers.filter((provider) => provider.indexer_id === selection.indexer_id).flatMap((provider) => (provider.manifest.composition?.extensions ?? []).filter((extension) => extension.profile === selection.profile).map((extension) => ({ provider, extension })));
     const declarationAuthorities = new Map(declarations.map((declaration2) => [
       canonicalIndexerJson({
+        indexer_id: declaration2.provider.indexer_id,
+        provider_layer_id: declaration2.provider.provider_layer_id,
         provider_id: declaration2.provider.manifest.id,
         provider_version: declaration2.provider.manifest.version,
         provider_integrity: declaration2.provider.provider_integrity,
@@ -26853,6 +26596,8 @@ function resolveIndexerSubjectKeySchemas(input) {
       declaration2
     ]));
     const ownerAuthorityKey = canonicalIndexerJson({
+      indexer_id: owner.indexer_id,
+      provider_layer_id: owner.provider_layer_id,
       provider_id: owner.manifest.id,
       provider_version: owner.manifest.version,
       provider_integrity: owner.provider_integrity,
@@ -27003,7 +26748,7 @@ function analyzeIndexerSubjectKeySchemaTransition(input) {
   if (oldSchema.authority.kind !== newSchema.authority.kind) {
     throw new TypeError("SubjectKey schema transition cannot change authority kind");
   }
-  if (oldSchema.authority.kind === "provider-extension" && (newSchema.authority.kind !== "provider-extension" || oldSchema.authority.provider_id !== newSchema.authority.provider_id)) {
+  if (oldSchema.authority.kind === "provider-extension" && (newSchema.authority.kind !== "provider-extension" || oldSchema.indexer_id !== newSchema.indexer_id || oldSchema.authority.extends !== newSchema.authority.extends || oldSchema.authority.provider_layer_id !== newSchema.authority.provider_layer_id || oldSchema.authority.provider_id !== newSchema.authority.provider_id || oldSchema.authority.provider_version === newSchema.authority.provider_version && (oldSchema.authority.provider_integrity !== newSchema.authority.provider_integrity || oldSchema.authority.manifest_digest !== newSchema.authority.manifest_digest))) {
     throw new TypeError("SubjectKey extension transition cannot change owner Provider");
   }
   const approved = input.approved_subjects.map((value) => approvedSubjectSchema.parse(value));
@@ -31962,8 +31707,14 @@ var compileResultBindingSchema = exports_external.object({
 }).strict();
 var candidateFilePayloadSchema = exports_external.object({
   artifact_ref: exports_external.string().min(1),
+  node_ref: exports_external.string().min(1),
+  internal_view_ref: exports_external.string().min(1),
+  collection: indexerKnowledgeCollectionSchema2,
+  artifact_kind: indexerIdSchema,
   output_path: portableIndexerPathSchema,
   indexer_id: indexerIdSchema,
+  source_ref: exports_external.string().min(1),
+  evidence_bindings: exports_external.array(indexerEvidenceBindingSchema),
   acceptance_digest: indexerDigestSchema,
   indexer_result_digest: indexerDigestSchema,
   artifact_result_digest: indexerDigestSchema,
@@ -31971,6 +31722,13 @@ var candidateFilePayloadSchema = exports_external.object({
   result_binding_digest: indexerDigestSchema,
   shared_artifact_fingerprint_digest: indexerDigestSchema,
   section_refs: exports_external.array(exports_external.string().min(1)).min(1),
+  sections: exports_external.array(exports_external.object({
+    section_ref: exports_external.string().min(1),
+    section_key: indexerIdSchema,
+    evidence_refs: exports_external.array(exports_external.string().min(1)),
+    markdown: exports_external.string().min(1),
+    markdown_digest: indexerDigestSchema
+  }).strict()).min(1),
   markdown: exports_external.string().min(1),
   markdown_digest: indexerDigestSchema
 }).strict();
@@ -32049,7 +31807,7 @@ function assertSectionIntegrity(input) {
     throw new TypeError(`Candidate compile Section ${input.artifactId}/${input.sectionKey} is stale for layout`);
   }
 }
-function structuredArtifactMarkdown(input) {
+function structuredArtifactSections(input) {
   return input.artifact.sections.map((section) => {
     const blocks = materializeIndexerStructuredContent({
       blocks: section.blocks,
@@ -32063,14 +31821,23 @@ function structuredArtifactMarkdown(input) {
       contentDigest: indexerProtocolDigest({ content_blocks: blocks }),
       evidenceRefs
     });
-    return blocks.map((block) => block.markdown).join(`
-
-`);
-  }).join(`
+    const markdown = blocks.map((block) => block.markdown).join(`
 
 `);
+    const layoutSection = input.proposal.artifacts.find((candidate) => candidate.artifact_id === input.artifact.artifact_id).sections.find((candidate) => candidate.section_key === section.section_key);
+    return {
+      section_ref: layoutSection.section_ref,
+      section_key: section.section_key,
+      evidence_refs: evidenceRefs,
+      markdown,
+      markdown_digest: indexerProtocolDigest({
+        protocol: "context.indexer.physical-section-markdown/v1",
+        markdown
+      })
+    };
+  });
 }
-function templateArtifactMarkdown(input) {
+function templateArtifactSections(input) {
   const renderedBySection = new Map(input.rendered.sections.map((section) => [
     section.section_key,
     section
@@ -32091,10 +31858,17 @@ function templateArtifactMarkdown(input) {
       contentDigest: section.content_digest,
       evidenceRefs: section.evidence_refs
     });
-    return section.markdown;
-  }).join(`
-
-`);
+    return {
+      section_ref: layoutSection.section_ref,
+      section_key: section.section_key,
+      evidence_refs: section.evidence_refs,
+      markdown: section.markdown,
+      markdown_digest: indexerProtocolDigest({
+        protocol: "context.indexer.physical-section-markdown/v1",
+        markdown: section.markdown
+      })
+    };
+  });
 }
 function candidateFiles(input) {
   const layoutById = new Map(input.proposal.artifacts.map((artifact) => [
@@ -32110,7 +31884,7 @@ function candidateFiles(input) {
     if (layout === undefined) {
       throw new TypeError(`Candidate compile Result Artifact ${artifact.artifact_id} has no layout`);
     }
-    const markdown = artifact.representation === "sections" ? structuredArtifactMarkdown({
+    const sections = artifact.representation === "sections" ? structuredArtifactSections({
       result: input.accepted.artifactResult,
       proposal: input.proposal,
       artifact
@@ -32119,16 +31893,30 @@ function candidateFiles(input) {
       if (rendered === undefined) {
         throw new TypeError(`Candidate compile template Artifact ${artifact.artifact_id} is not rendered`);
       }
-      return templateArtifactMarkdown({
+      return templateArtifactSections({
         proposal: input.proposal,
         artifact,
         rendered
       });
     })();
+    const markdown = sections.map((section) => section.markdown).join(`
+
+`);
+    const evidenceRefs = new Set(layout.sections.flatMap((section) => section.evidence_refs));
+    const evidenceBindings = input.accepted.artifactResult.evidence_bindings.filter((binding) => evidenceRefs.has(binding.evidence_ref)).sort((left, right) => compareIndexerCanonicalText(left.evidence_ref, right.evidence_ref));
+    if (evidenceBindings.length !== evidenceRefs.size) {
+      throw new TypeError(`Candidate compile Artifact ${artifact.artifact_id} has unresolved evidence bindings`);
+    }
     const payload3 = candidateFilePayloadSchema.parse({
       artifact_ref: layout.artifact_ref,
+      node_ref: layout.node_ref,
+      internal_view_ref: layout.internal_view_ref,
+      collection: layout.collection,
+      artifact_kind: layout.artifact_kind,
       output_path: layout.output_path,
       indexer_id: input.accepted.artifactResult.indexer_id,
+      source_ref: input.accepted.artifactResult.source_ref,
+      evidence_bindings: evidenceBindings,
       acceptance_digest: input.binding.acceptance_digest,
       indexer_result_digest: input.binding.indexer_result_digest,
       artifact_result_digest: input.binding.artifact_result_digest,
@@ -32136,6 +31924,7 @@ function candidateFiles(input) {
       result_binding_digest: input.binding.binding_digest,
       shared_artifact_fingerprint_digest: input.binding.shared_artifact_fingerprint.fingerprint_digest,
       section_refs: layout.sections.map((section) => section.section_ref).sort(compareIndexerCanonicalText),
+      sections,
       markdown,
       markdown_digest: indexerProtocolDigest({
         protocol: "context.indexer.physical-markdown/v1",
@@ -33817,11 +33606,9 @@ function deriveIndexerMaterialAnswerFlowStatus(input) {
   const resolvedBindings = [];
   for (const entry of ledger.entries) {
     const domainState = authorityByOwner.get(entry.owner_cell_ref);
-    if (domainState === undefined) {
-      throw new TypeError(`material-answer owner ${entry.owner_cell_ref} is not current`);
-    }
-    if (domainState === "out-of-scope") {
-      throw new TypeError("out-of-scope material gaps must not be retained");
+    if (domainState === undefined || domainState === "out-of-scope") {
+      blockingUnresolved.push(indexerMaterialGapQuestionKey(entry));
+      continue;
     }
     const questionKey = indexerMaterialGapQuestionKey(entry);
     const pending = entry.state === "unresolved" || entry.state === "answer-approved" || entry.state === "resolved" && entry.actualization.layout_digest !== layoutDigest;
@@ -35705,7 +35492,6 @@ var llmsPackage = (definition) => ({
   ...createPackageDefinitionBase("llms", definition)
 });
 export {
-  verifyEnterpriseIndexerOverlayTrust,
   validatedIndexerCustomizationDraftSchema,
   validateValidatedIndexerCustomizationDraft,
   validateResolvedProviderBundle,
@@ -35780,10 +35566,9 @@ export {
   validateIndexerParserImport,
   validateIndexerParserFactView,
   validateIndexerParserCoordinateMapping,
-  validateIndexerOverlayTrustBundleEnvelope,
+  validateIndexerOverlayValidationReceipt,
   validateIndexerOverlayQuestionRegistryApplyProposal,
   validateIndexerOverlayQuestionAmendment,
-  validateIndexerOverlayAttestation,
   validateIndexerOperatorContract,
   validateIndexerNavigationArtifactPlan,
   validateIndexerNavigationArtifactGraph,
@@ -36112,19 +35897,11 @@ export {
   indexerParserFactViewSchema,
   indexerParserCoordinateMappingSchema,
   indexerOwnerCohortRef,
-  indexerOverlayTrustReceiptSchema,
-  indexerOverlayTrustReceiptDigest,
-  indexerOverlayTrustBundleSchema,
-  indexerOverlayTrustBundleEnvelopeSchema,
-  indexerOverlayTrustBundleDigest,
+  indexerOverlayValidationReceiptSchema,
+  indexerOverlayValidationReceiptDigest,
   indexerOverlayQuestionRegistryApplyProposalSchema,
   indexerOverlayQuestionDocumentDigest,
   indexerOverlayQuestionAmendmentSchema,
-  indexerOverlayProjectAuthorizationSchema,
-  indexerOverlayProjectAuthorizationDigest,
-  indexerOverlayAttestationSigningPayload,
-  indexerOverlayAttestationSchema,
-  indexerOverlayAttestationDigest,
   indexerOperatorContractSchema,
   indexerOperatorContractDigest,
   indexerNegativeDependencyNodeSchema,
@@ -36232,6 +36009,7 @@ export {
   indexerExampleCandidateDecisionSchema,
   indexerEvidenceRefSchema,
   indexerEvidenceItemRef,
+  indexerEvidenceBindingSchema,
   indexerEvidenceBindingDigest,
   indexerEvidenceAdapterResultSchema,
   indexerEvidenceAdapterOutputDigest,
@@ -36330,6 +36108,7 @@ export {
   defineProject,
   decideIndexerMaterialAnswerReview,
   customPhase,
+  createIndexerOverlayValidationReceipt,
   coverageDomainCompletionSchema,
   coverageCompletionReportPayloadSchema,
   convergeIndexerPartitionPlan,
@@ -36463,7 +36242,6 @@ export {
   buildIndexerAgentStepResult,
   buildIndexerAgentStepInput,
   buildIndexerActivationRequest,
-  authorizeProjectIndexerOverlay,
   authorizeIndexerSubjectReidentification,
   authorizeIndexerProgramExecution,
   authorizeIndexerProfileOverride,