@calltelemetry/ct-lab-mcp 0.8.150 → 0.8.152

package/dist/src/inspection/lab-inspection.js

@@ -0,0 +1,964 @@
+import { z } from "zod";
+export const LAB_INSPECTION_SCHEMA = "ct-lab-inspection/v1";
+export const CUBE_WORKFLOW_SCHEMA = "ct.appliance.cube-workflow/v1";
+export const LIFECYCLE_DIAGNOSTIC_SCHEMA = "ct.appliance.lifecycle-diagnostic/v1";
+export const CUBE_NETWORK_REVALIDATION_SCHEMA = "ct.appliance.cube-network-revalidation/v1";
+export const WORKFLOW_PHASES = [
+    "clone_bind",
+    "nic_isolation",
+    "boot",
+    "ios_access",
+    "dhcp",
+    "network_ssh",
+    "running_config",
+    "startup_config",
+    "ready",
+];
+export const WORKFLOW_CHECKPOINTS = ["intent_recorded", "result_recorded", "awaiting_readback"];
+export const DIAGNOSTIC_CLASSIFICATIONS = ["transient", "terminal", "uncertain", "conflict", "integrity"];
+export const EFFECT_CERTAINTIES = ["none", "confirmed", "unknown"];
+export const RETRY_CLASSES = ["never", "bounded", "after_read_back", "manual_only"];
+export const NEXT_ACTIONS = [
+    "none",
+    "read_back",
+    "wait",
+    "repair_access",
+    "repair_binding",
+    "resume_same_claim",
+    "continue_qualification",
+    "run_paired_call",
+    "retire",
+    "manual_review",
+];
+const SafeCodeSchema = z.string().min(1).max(96).regex(/^[A-Z][A-Z0-9_]*$/);
+const SafeReasonCodeSchema = z.string().min(1).max(96).regex(/^[a-z][a-z0-9_]*$/);
+const SafeSourceSchema = z.string().min(1).max(64).regex(/^[a-z][a-z0-9_.-]*$/);
+const UuidSchema = z.string().uuid();
+const DigestRefSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const IntentDigestSchema = DigestRefSchema;
+const OperationIdSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/);
+const Rfc3339UtcSchema = z.string().datetime({ offset: false });
+function isIpv4Address(value) {
+    const octets = value.split(".");
+    return octets.length === 4 && octets.every((octet) => /^(?:0|[1-9][0-9]{0,2})$/u.test(octet) && Number(octet) <= 255);
+}
+const Ipv4AddressSchema = z.string().max(15).refine(isIpv4Address, "must be an IPv4 address");
+export const EvidenceSchema = (valueSchema) => z.discriminatedUnion("state", [
+    z.object({ state: z.literal("verified"), value: valueSchema, source: SafeSourceSchema }).strict(),
+    z.object({ state: z.literal("unknown"), reasonCode: SafeReasonCodeSchema }).strict(),
+]);
+export function verified(value, source) {
+    return { state: "verified", value, source };
+}
+export function unknown(reasonCode) {
+    return { state: "unknown", reasonCode };
+}
+const CanonicalHostTupleSchema = z.object({
+    hostAssetId: z.string().min(1).max(80).regex(/^[a-z0-9][a-z0-9-]*$/),
+    node: z.string().min(1).max(80).regex(/^[a-z0-9][a-z0-9-]*$/),
+    vmid: z.number().int().min(100).max(999_999_999),
+}).strict();
+const ObservedFactSchema = (valueSchema) => z.object({
+    value: valueSchema,
+    observedAt: Rfc3339UtcSchema,
+    validUntil: Rfc3339UtcSchema.optional(),
+}).strict();
+const AccessCapabilitySchema = z.object({
+    resolved: EvidenceSchema(z.boolean()),
+    authenticated: EvidenceSchema(z.boolean()),
+    privileged: EvidenceSchema(z.boolean()),
+}).strict();
+const AccessFailureClassSchema = z.enum([
+    "none",
+    "credential_mismatch",
+    "transport_failure",
+    "boot_not_ready",
+    "authorization_failure",
+]);
+const RoleSchema = z.enum(["admin", "full_admin"]);
+const CredentialSchema = z.object({
+    schema: z.string().min(1).max(96).regex(/^[a-z0-9][a-z0-9./-]*$/),
+    version: z.union([z.string().min(1).max(32), z.number().int().positive()]),
+    referenceRevision: z.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).nullable(),
+    referenceRevisionReasonCode: z.literal("provider_revision_unavailable").optional(),
+}).strict().superRefine((value, context) => {
+    if (value.referenceRevision === null && value.referenceRevisionReasonCode !== "provider_revision_unavailable") {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["referenceRevisionReasonCode"], message: "provider_revision_unavailable is required when revision is unknown" });
+    }
+    if (value.referenceRevision !== null && value.referenceRevisionReasonCode !== undefined) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["referenceRevisionReasonCode"], message: "revision reason is not allowed when provider revision is known" });
+    }
+});
+const PrincipalSchema = z.object({ validated: z.boolean(), role: RoleSchema }).strict();
+const SessionSchema = z.object({ authenticated: z.boolean() }).strict();
+const AuthorizationSchema = z.object({ privileged: z.boolean() }).strict();
+const KeySchema = z.object({
+    provenance: z.string().min(1).max(80).regex(/^[a-z][a-z0-9_.-]*$/),
+    revision: z.string().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).nullable(),
+    revisionReasonCode: z.literal("provider_revision_unavailable").optional(),
+    fingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+}).strict().superRefine((value, context) => {
+    if (value.revision === null && value.revisionReasonCode !== "provider_revision_unavailable") {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["revisionReasonCode"], message: "provider_revision_unavailable is required when key revision is unknown" });
+    }
+    if (value.revision !== null && value.revisionReasonCode !== undefined) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["revisionReasonCode"], message: "revision reason is not allowed when provider revision is known" });
+    }
+});
+const AccessRequirementSchema = z.object({
+    credentialSchema: z.string().min(1).max(96).regex(/^[a-z0-9][a-z0-9./-]*$/).optional(),
+    role: RoleSchema.optional(),
+    capabilities: z.array(z.enum(["resolved", "authenticated", "privileged"])).max(3),
+}).strict();
+const AccessSummarySchema = z.object({
+    credential: EvidenceSchema(CredentialSchema),
+    principal: EvidenceSchema(PrincipalSchema),
+    session: EvidenceSchema(SessionSchema),
+    authorization: EvidenceSchema(AuthorizationSchema),
+    key: EvidenceSchema(KeySchema),
+    capabilities: AccessCapabilitySchema,
+    failureClass: EvidenceSchema(AccessFailureClassSchema),
+}).strict();
+const AccessDomainObservationSchema = z.object({
+    credential: EvidenceSchema(ObservedFactSchema(CredentialSchema)),
+    principal: EvidenceSchema(ObservedFactSchema(PrincipalSchema)),
+    session: EvidenceSchema(ObservedFactSchema(SessionSchema)),
+    authorization: EvidenceSchema(ObservedFactSchema(AuthorizationSchema)),
+    key: EvidenceSchema(ObservedFactSchema(KeySchema)),
+    capabilities: z.object({
+        resolved: EvidenceSchema(ObservedFactSchema(z.boolean())),
+        authenticated: EvidenceSchema(ObservedFactSchema(z.boolean())),
+        privileged: EvidenceSchema(ObservedFactSchema(z.boolean())),
+    }).strict(),
+    failureClass: EvidenceSchema(ObservedFactSchema(AccessFailureClassSchema)),
+}).strict();
+const AccessObservationSchema = z.object({
+    cube: AccessDomainObservationSchema,
+    web: AccessDomainObservationSchema,
+}).strict();
+const ReadinessStateSchema = z.enum(["ready", "pending", "not_ready", "failed", "not_required"]);
+const ReadinessFactSchema = ObservedFactSchema(z.object({ state: ReadinessStateSchema }).strict());
+const ReadinessDimensionSchema = z.object({
+    desired: EvidenceSchema(z.enum(["ready", "not_required"])),
+    observed: EvidenceSchema(ReadinessFactSchema),
+}).strict();
+const ReadinessSchema = z.object({
+    claim: ReadinessDimensionSchema,
+    provider: ReadinessDimensionSchema,
+    guestIdentity: ReadinessDimensionSchema,
+    network: ReadinessDimensionSchema,
+    ssh: ReadinessDimensionSchema,
+    configuration: ReadinessDimensionSchema,
+    application: ReadinessDimensionSchema,
+}).strict();
+const CanonicalHostProjectionSchema = z.object({
+    desired: EvidenceSchema(CanonicalHostTupleSchema),
+    observed: EvidenceSchema(ObservedFactSchema(CanonicalHostTupleSchema)),
+}).strict();
+const GuestIdentityProjectionSchema = z.object({
+    desired: EvidenceSchema(z.string().min(1).max(160)),
+    observed: EvidenceSchema(ObservedFactSchema(z.string().min(1).max(160))),
+}).strict();
+const AddressFactSchema = z.object({
+    value: z.string().min(1).max(128),
+    source: z.string().min(1).max(80).regex(/^[a-z][a-z0-9_.-]*$/),
+    observedAt: Rfc3339UtcSchema,
+    validUntil: Rfc3339UtcSchema.optional(),
+}).strict();
+const AddressProjectionSchema = z.object({
+    desired: EvidenceSchema(z.object({ value: z.string().min(1).max(128), source: SafeSourceSchema }).strict()),
+    observed: EvidenceSchema(AddressFactSchema),
+}).strict();
+const WorkflowPhaseIntentSchema = z.object({
+    operationId: OperationIdSchema,
+    intentDigest: IntentDigestSchema,
+    recordedAt: Rfc3339UtcSchema,
+}).strict();
+const WorkflowPhaseIntentSourceSchema = WorkflowPhaseIntentSchema.passthrough();
+const WorkflowPhaseResultSchema = z.object({
+    effectCertainty: z.enum(EFFECT_CERTAINTIES),
+    observedAt: Rfc3339UtcSchema,
+    evidenceRefs: z.array(DigestRefSchema).max(32),
+    outcomeCode: SafeCodeSchema,
+}).strict();
+const WorkflowPhaseResultSourceSchema = WorkflowPhaseResultSchema.passthrough();
+const WorkflowPhaseRecordSchema = z.object({
+    intent: WorkflowPhaseIntentSchema,
+    result: WorkflowPhaseResultSchema.optional(),
+}).strict();
+const WorkflowPhaseRecordSourceSchema = z.object({
+    intent: WorkflowPhaseIntentSourceSchema,
+    result: WorkflowPhaseResultSourceSchema.optional(),
+}).passthrough();
+const WorkflowPhasesSchema = z.record(z.enum(WORKFLOW_PHASES), WorkflowPhaseRecordSchema);
+const WorkflowSummarySchema = z.object({
+    operationId: OperationIdSchema,
+    intentDigest: IntentDigestSchema,
+    phase: z.enum(WORKFLOW_PHASES),
+    checkpoint: z.enum(WORKFLOW_CHECKPOINTS),
+    workflowDeadlineAt: Rfc3339UtcSchema,
+    phaseDeadlineAt: Rfc3339UtcSchema,
+    cleanupAllowanceMs: z.number().int().nonnegative(),
+    retryClass: z.enum(RETRY_CLASSES),
+    effectCertainty: z.enum(EFFECT_CERTAINTIES),
+    nextAction: z.enum(NEXT_ACTIONS),
+    resumable: z.boolean(),
+    retryAt: Rfc3339UtcSchema.optional(),
+}).strict();
+const WorkflowProjectionSchema = z.object({
+    schema: z.literal(CUBE_WORKFLOW_SCHEMA),
+    ...WorkflowSummarySchema.shape,
+    phases: WorkflowPhasesSchema,
+    accessObserved: EvidenceSchema(AccessSummarySchema).optional(),
+    callbackTarget: EvidenceSchema(z.object({
+        schema: z.literal("ct.appliance.cube-callback-target/v1"),
+        transport: z.enum(["http", "https"]),
+        host: z.string().min(1).max(253).regex(/^[A-Za-z0-9.-]+$/),
+        pathDigest: DigestRefSchema,
+        targetDigest: DigestRefSchema,
+        runningConfigDigest: DigestRefSchema,
+        startupConfigDigest: DigestRefSchema,
+        observedAt: Rfc3339UtcSchema,
+        evidenceRefs: z.array(DigestRefSchema).max(32),
+    }).strict()).optional(),
+}).strict();
+const LifecycleDiagnosticSchema = z.object({
+    schema: z.literal(LIFECYCLE_DIAGNOSTIC_SCHEMA),
+    code: SafeCodeSchema,
+    classification: z.enum(DIAGNOSTIC_CLASSIFICATIONS),
+    phase: z.enum(WORKFLOW_PHASES),
+    resumable: z.boolean(),
+    retryAt: Rfc3339UtcSchema.optional(),
+    message: z.string().min(1).max(240).regex(/^[A-Za-z0-9 .,:;_()'-]+$/),
+    observedAt: Rfc3339UtcSchema,
+    resource: z.object({
+        name: z.string().min(1).max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/),
+        uid: UuidSchema,
+        generation: z.number().int().nonnegative(),
+        resourceVersion: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/),
+    }).strict(),
+    evidenceRefs: z.array(DigestRefSchema).max(32),
+    effectCertainty: z.enum(EFFECT_CERTAINTIES),
+    retryClass: z.enum(RETRY_CLASSES),
+    nextAction: z.enum(NEXT_ACTIONS),
+}).strict();
+const SshPreflightSchema = z.discriminatedUnion("state", [
+    z.object({
+        state: z.literal("verified"),
+        value: z.object({
+            fingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+            sameGuestUuid: z.literal(true),
+            authenticated: z.literal(true),
+        }).strict(),
+        source: z.literal("same-guest-ssh"),
+        observedAt: Rfc3339UtcSchema,
+        validUntil: Rfc3339UtcSchema,
+    }).strict(),
+    z.object({
+        state: z.literal("unknown"),
+        reasonCode: SafeReasonCodeSchema,
+        source: z.literal("same-guest-ssh"),
+        observedAt: Rfc3339UtcSchema.optional(),
+        validUntil: Rfc3339UtcSchema.optional(),
+    }).strict(),
+]);
+const RoutesPreflightSchema = z.discriminatedUnion("state", [
+    z.object({
+        state: z.literal("verified"),
+        value: z.object({
+            peerTargetsPinged: z.boolean(),
+            xccHostPing: z.boolean().optional(),
+            routeSetDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+        }).strict(),
+        source: z.literal("ios-ping-readback"),
+        observedAt: Rfc3339UtcSchema,
+        validUntil: Rfc3339UtcSchema,
+    }).strict(),
+    z.object({
+        state: z.literal("unknown"),
+        reasonCode: SafeReasonCodeSchema,
+        source: z.literal("ios-ping-readback"),
+        observedAt: Rfc3339UtcSchema.optional(),
+        validUntil: Rfc3339UtcSchema.optional(),
+    }).strict(),
+]);
+const NetworkRevalidationIdentitySchema = z.object({
+    schema: z.literal(CUBE_NETWORK_REVALIDATION_SCHEMA),
+    status: z.enum(["pending", "verified", "unknown", "rejected"]),
+    requestId: UuidSchema,
+    claimUid: UuidSchema,
+    generation: z.number().int().positive(),
+    operationId: OperationIdSchema,
+    intentDigest: IntentDigestSchema,
+}).passthrough();
+const PendingNetworkRevalidationSchema = NetworkRevalidationIdentitySchema.extend({
+    status: z.literal("pending"),
+    requestedAt: Rfc3339UtcSchema,
+    requestExpiresAt: Rfc3339UtcSchema,
+    outcomeCode: SafeCodeSchema.optional(),
+}).strict();
+const UnknownNetworkRevalidationSchema = NetworkRevalidationIdentitySchema.extend({
+    status: z.literal("unknown"),
+    requestedAt: Rfc3339UtcSchema.optional(),
+    requestExpiresAt: Rfc3339UtcSchema.optional(),
+    outcomeCode: SafeCodeSchema.optional(),
+    reasonCode: SafeReasonCodeSchema.optional(),
+    evidenceRefs: z.array(DigestRefSchema).max(32).optional(),
+}).strict();
+const RejectedNetworkRevalidationSchema = NetworkRevalidationIdentitySchema.extend({
+    status: z.literal("rejected"),
+    requestedAt: Rfc3339UtcSchema.optional(),
+    requestExpiresAt: Rfc3339UtcSchema.optional(),
+    reasonCode: SafeReasonCodeSchema,
+}).strict();
+const VerifiedNetworkRevalidationSchema = NetworkRevalidationIdentitySchema.extend({
+    status: z.literal("verified"),
+    freshnessPolicy: z.literal("cube-network-preflight/v1"),
+    host: CanonicalHostTupleSchema,
+    guestUuid: UuidSchema,
+    mac: z.string().regex(/^(?:[0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$/),
+    address: Ipv4AddressSchema,
+    source: z.string().min(1).max(80).regex(/^[a-z][a-z0-9_.-]*$/),
+    requestedAt: Rfc3339UtcSchema,
+    observedAt: Rfc3339UtcSchema,
+    requestExpiresAt: Rfc3339UtcSchema,
+    claimExpiresAt: Rfc3339UtcSchema,
+    validUntil: Rfc3339UtcSchema,
+    validatedAt: Rfc3339UtcSchema,
+    remainingValidityMs: z.number().int().min(1).max(60_000),
+    iosLeaseExpiresAt: Rfc3339UtcSchema.optional(),
+    ssh: SshPreflightSchema,
+    routes: RoutesPreflightSchema,
+    evidenceRefs: z.array(DigestRefSchema).max(32),
+}).strict();
+const NetworkRevalidationSchema = z.discriminatedUnion("status", [
+    PendingNetworkRevalidationSchema,
+    UnknownNetworkRevalidationSchema,
+    VerifiedNetworkRevalidationSchema,
+    RejectedNetworkRevalidationSchema,
+]);
+const NetworkRevalidationSourceIdentitySchema = z.object({
+    schema: z.literal(CUBE_NETWORK_REVALIDATION_SCHEMA),
+    requestId: UuidSchema,
+    claimUid: UuidSchema,
+    generation: z.number().int().positive(),
+    operationId: OperationIdSchema,
+    intentDigest: IntentDigestSchema,
+});
+const VerifiedNetworkRevalidationSourceSchema = VerifiedNetworkRevalidationSchema
+    .omit({ status: true, validatedAt: true, remainingValidityMs: true })
+    .extend({ address: z.unknown(), state: z.literal("verified") })
+    .passthrough();
+const NetworkRevalidationSourceSchema = z.discriminatedUnion("state", [
+    NetworkRevalidationSourceIdentitySchema.extend({
+        state: z.literal("pending"),
+        requestedAt: Rfc3339UtcSchema,
+        requestExpiresAt: Rfc3339UtcSchema,
+        outcomeCode: SafeCodeSchema.optional(),
+    }).passthrough(),
+    NetworkRevalidationSourceIdentitySchema.extend({
+        state: z.literal("unknown"),
+        requestedAt: Rfc3339UtcSchema.optional(),
+        requestExpiresAt: Rfc3339UtcSchema.optional(),
+        outcomeCode: SafeCodeSchema.optional(),
+        reasonCode: SafeReasonCodeSchema.optional(),
+        evidenceRefs: z.array(DigestRefSchema).max(32).optional(),
+    }).passthrough(),
+    VerifiedNetworkRevalidationSourceSchema,
+]);
+const BackendIdentitySchema = z.object({
+    kind: z.enum(["kubernetes_claims", "canonical_lab_inventory"]),
+    mode: z.enum(["in-cluster", "kubeconfig", "canonical_cli"]),
+    contextFingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    serverFingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    plane: z.enum(["local-stdio", "local-sse"]),
+    runtimeVersion: z.string().min(1).max(64),
+    mock: z.boolean(),
+}).strict();
+const ClaimCustodySchema = z.object({
+    present: z.boolean(),
+    phase: z.enum(["bound", "provider-bound", "retiring", "missing"]),
+    guest: CanonicalHostTupleSchema.optional(),
+}).strict();
+const StructuredReasonSchema = z.object({
+    code: SafeCodeSchema,
+    classification: z.enum(DIAGNOSTIC_CLASSIFICATIONS).optional(),
+    evidenceRefs: z.array(DigestRefSchema).max(32).optional(),
+}).strict();
+const RuntimeArtifactSchema = z.object({
+    packageName: z.literal("@calltelemetry/ct-lab-mcp"),
+    version: z.string().min(1).max(64),
+    integrity: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    revision: EvidenceSchema(z.string().regex(/^[a-f0-9]{40}$/)),
+}).strict();
+export const LabInspectionV1Schema = z.object({
+    schema: z.literal(LAB_INSPECTION_SCHEMA),
+    operation: z.object({
+        name: z.enum(["get_appliance_claim", "revalidate_appliance_claim_network"]),
+        intent: z.enum(["inspect_claim", "revalidate_network"]),
+    }).strict(),
+    backend: z.object({
+        identity: EvidenceSchema(BackendIdentitySchema),
+        observedAt: EvidenceSchema(Rfc3339UtcSchema),
+        retrievedAt: EvidenceSchema(Rfc3339UtcSchema),
+    }).strict(),
+    claim: z.object({
+        name: EvidenceSchema(z.string().min(1).max(253)),
+        assetId: EvidenceSchema(z.string().min(1).max(160)),
+        uid: EvidenceSchema(UuidSchema),
+        generation: EvidenceSchema(z.number().int().nonnegative()),
+        observedGeneration: EvidenceSchema(z.number().int().nonnegative()),
+        resourceVersion: EvidenceSchema(z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/)),
+        expiresAt: EvidenceSchema(Rfc3339UtcSchema.nullable()),
+        custody: EvidenceSchema(ClaimCustodySchema),
+    }).strict(),
+    host: z.object({ canonical: CanonicalHostProjectionSchema }).strict(),
+    guest: z.object({ uuid: GuestIdentityProjectionSchema, mac: GuestIdentityProjectionSchema }).strict(),
+    address: AddressProjectionSchema,
+    access: z.object({ desired: EvidenceSchema(AccessRequirementSchema), observed: AccessObservationSchema }).strict(),
+    readiness: ReadinessSchema,
+    networkRevalidation: NetworkRevalidationSchema.optional(),
+    runtimeArtifact: EvidenceSchema(RuntimeArtifactSchema),
+    workflow: EvidenceSchema(WorkflowProjectionSchema),
+    diagnostic: EvidenceSchema(LifecycleDiagnosticSchema),
+    reason: EvidenceSchema(StructuredReasonSchema),
+    effectCertainty: EvidenceSchema(z.enum(EFFECT_CERTAINTIES)),
+    retryClass: EvidenceSchema(z.enum(RETRY_CLASSES)),
+    nextAction: EvidenceSchema(z.enum(NEXT_ACTIONS)),
+}).strict().superRefine((value, context) => {
+    const conflict = (path) => context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path,
+        message: "INSPECTION_CONFLICT",
+    });
+    const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+    const hostDesired = value.host.canonical.desired;
+    const hostObserved = value.host.canonical.observed;
+    if (hostDesired.state === "verified" && hostObserved.state === "verified"
+        && !same(hostDesired.value, hostObserved.value.value)) {
+        conflict(["host", "canonical"]);
+    }
+    for (const key of ["uuid", "mac"]) {
+        const desired = value.guest[key].desired;
+        const observed = value.guest[key].observed;
+        if (desired.state === "verified" && observed.state === "verified"
+            && desired.value !== observed.value.value) {
+            conflict(["guest", key]);
+        }
+    }
+    const addressDesired = value.address.desired;
+    const addressObserved = value.address.observed;
+    if (addressDesired.state === "verified" && addressObserved.state === "verified"
+        && addressDesired.value.value !== addressObserved.value.value) {
+        conflict(["address"]);
+    }
+    if (value.workflow.state === "verified") {
+        const workflow = value.workflow.value;
+        for (const [phase, record] of Object.entries(workflow.phases)) {
+            if (record.intent.operationId !== workflow.operationId || record.intent.intentDigest !== workflow.intentDigest) {
+                conflict(["workflow", "phases", phase, "intent"]);
+            }
+        }
+    }
+    if (value.diagnostic.state === "verified" && value.claim.uid.state === "verified"
+        && value.diagnostic.value.resource.uid !== value.claim.uid.value) {
+        conflict(["diagnostic", "resource", "uid"]);
+    }
+    if (value.diagnostic.state === "verified" && value.claim.generation.state === "verified"
+        && value.diagnostic.value.resource.generation !== value.claim.generation.value) {
+        conflict(["diagnostic", "resource", "generation"]);
+    }
+    if (value.networkRevalidation?.status === "verified") {
+        const readback = value.networkRevalidation;
+        if (value.claim.uid.state === "verified" && readback.claimUid !== value.claim.uid.value)
+            conflict(["networkRevalidation", "claimUid"]);
+        if (value.claim.generation.state === "verified" && readback.generation !== value.claim.generation.value)
+            conflict(["networkRevalidation", "generation"]);
+        if (hostObserved.state === "verified" && !same(readback.host, hostObserved.value.value))
+            conflict(["networkRevalidation", "host"]);
+        if (value.guest.uuid.observed.state === "verified" && readback.guestUuid !== value.guest.uuid.observed.value.value)
+            conflict(["networkRevalidation", "guestUuid"]);
+        if (value.guest.mac.observed.state === "verified" && readback.mac.toLowerCase() !== value.guest.mac.observed.value.value.toLowerCase())
+            conflict(["networkRevalidation", "mac"]);
+        if (addressObserved.state === "verified" && readback.address !== addressObserved.value.value)
+            conflict(["networkRevalidation", "address"]);
+    }
+});
+export class InspectionConflictError extends Error {
+    code = "INSPECTION_CONFLICT";
+    constructor(message = "INSPECTION_CONFLICT") {
+        super(message);
+        this.name = "InspectionConflictError";
+    }
+}
+export class InspectionContractError extends Error {
+    code = "INSPECTION_CONTRACT_INVALID";
+    constructor(message = "inspection contract is invalid") {
+        super(message);
+        this.name = "InspectionContractError";
+    }
+}
+export function buildLabInspectionEnvelope(candidate) {
+    const result = LabInspectionV1Schema.safeParse(candidate);
+    if (result.success)
+        return result.data;
+    if (result.error.issues.some((issue) => issue.message === "INSPECTION_CONFLICT")) {
+        throw new InspectionConflictError();
+    }
+    throw new InspectionContractError();
+}
+export function projectOperatorWorkflow(raw, statusGenerationCurrent = true) {
+    const parsed = CubeWorkflowSourceSchema.safeParse(raw);
+    if (!parsed.success)
+        return unknown("workflow_status_invalid");
+    const { schema, summary, phases } = parsed.data;
+    const projectedPhases = {};
+    for (const phase of WORKFLOW_PHASES) {
+        const sourceRecord = phases[phase];
+        if (!sourceRecord)
+            continue;
+        if (sourceRecord.intent.operationId !== summary.operationId || sourceRecord.intent.intentDigest !== summary.intentDigest) {
+            throw new InspectionConflictError("INSPECTION_CONFLICT");
+        }
+        projectedPhases[phase] = {
+            intent: {
+                operationId: sourceRecord.intent.operationId,
+                intentDigest: sourceRecord.intent.intentDigest,
+                recordedAt: sourceRecord.intent.recordedAt,
+            },
+            ...(sourceRecord.result ? { result: {
+                    effectCertainty: sourceRecord.result.effectCertainty,
+                    observedAt: sourceRecord.result.observedAt,
+                    evidenceRefs: sourceRecord.result.evidenceRefs,
+                    outcomeCode: sourceRecord.result.outcomeCode,
+                } } : {}),
+        };
+    }
+    const sourceRecord = raw && typeof raw === "object" && !Array.isArray(raw)
+        ? raw
+        : undefined;
+    const summaryAccess = AccessSummarySchema.safeParse(summary.accessObserved);
+    const workflowAccessRaw = sourceRecord?.accessObserved;
+    const workflowAccess = AccessSummarySchema.safeParse(workflowAccessRaw);
+    if (summaryAccess.success && workflowAccess.success
+        && JSON.stringify(summaryAccess.data) !== JSON.stringify(workflowAccess.data)) {
+        throw new InspectionConflictError("INSPECTION_CONFLICT");
+    }
+    const accessObserved = summaryAccess.success || summary.accessObserved !== undefined
+        ? summaryAccess
+        : workflowAccess;
+    const callbackSource = sourceRecord?.callbackTarget && typeof sourceRecord.callbackTarget === "object" && !Array.isArray(sourceRecord.callbackTarget)
+        ? sourceRecord.callbackTarget
+        : undefined;
+    const callbackTarget = callbackSource
+        ? z.object({
+            schema: z.literal("ct.appliance.cube-callback-target/v1"),
+            state: z.literal("verified"),
+            transport: z.enum(["http", "https"]),
+            host: z.string().min(1).max(253).regex(/^[A-Za-z0-9.-]+$/),
+            pathDigest: DigestRefSchema,
+            targetDigest: DigestRefSchema,
+            runningConfigDigest: DigestRefSchema,
+            startupConfigDigest: DigestRefSchema,
+            observedAt: Rfc3339UtcSchema,
+            evidenceRefs: z.array(DigestRefSchema).max(32),
+        }).passthrough().safeParse(callbackSource)
+        : undefined;
+    const value = WorkflowProjectionSchema.parse({
+        schema,
+        operationId: summary.operationId,
+        intentDigest: summary.intentDigest,
+        phase: summary.phase,
+        checkpoint: summary.checkpoint,
+        workflowDeadlineAt: summary.workflowDeadlineAt,
+        phaseDeadlineAt: summary.phaseDeadlineAt,
+        cleanupAllowanceMs: summary.cleanupAllowanceMs,
+        retryClass: summary.retryClass,
+        effectCertainty: summary.effectCertainty,
+        nextAction: summary.nextAction,
+        resumable: summary.resumable,
+        ...(summary.retryAt ? { retryAt: summary.retryAt } : {}),
+        phases: projectedPhases,
+        ...(statusGenerationCurrent
+            ? accessObserved.success ? { accessObserved: verified(accessObserved.data, "operator_access_observed") } : {}
+            : { accessObserved: unknown("claim_status_generation_stale") }),
+        ...(statusGenerationCurrent
+            ? callbackTarget?.success ? { callbackTarget: verified({
+                    schema: callbackTarget.data.schema,
+                    transport: callbackTarget.data.transport,
+                    host: callbackTarget.data.host,
+                    pathDigest: callbackTarget.data.pathDigest,
+                    targetDigest: callbackTarget.data.targetDigest,
+                    runningConfigDigest: callbackTarget.data.runningConfigDigest,
+                    startupConfigDigest: callbackTarget.data.startupConfigDigest,
+                    observedAt: callbackTarget.data.observedAt,
+                    evidenceRefs: callbackTarget.data.evidenceRefs,
+                }, "operator_callback_target_status") } : {}
+            : { callbackTarget: unknown("claim_status_generation_stale") }),
+    });
+    return verified(value, "operator_workflow_status");
+}
+function timeAccessEvidence(evidence, observedAt) {
+    if (evidence.state === "unknown")
+        return evidence;
+    const timestamp = Rfc3339UtcSchema.safeParse(observedAt);
+    if (!timestamp.success)
+        return unknown("access_observation_time_missing");
+    return verified({ value: evidence.value, observedAt: timestamp.data }, evidence.source);
+}
+function unknownAccessDomain(reasonCode) {
+    return {
+        credential: unknown(reasonCode),
+        principal: unknown("not_applicable"),
+        session: unknown("not_attempted"),
+        authorization: unknown("not_attempted"),
+        key: unknown(reasonCode),
+        capabilities: {
+            resolved: unknown(reasonCode),
+            authenticated: unknown("not_attempted"),
+            privileged: unknown("not_attempted"),
+        },
+        failureClass: unknown(reasonCode),
+    };
+}
+function projectAccessDomainObserved(raw, observedAt) {
+    const parsed = AccessSummarySchema.safeParse(raw);
+    if (!parsed.success)
+        return unknownAccessDomain("access_summary_invalid");
+    const value = parsed.data;
+    return {
+        credential: timeAccessEvidence(value.credential, observedAt),
+        principal: timeAccessEvidence(value.principal, observedAt),
+        session: timeAccessEvidence(value.session, observedAt),
+        authorization: timeAccessEvidence(value.authorization, observedAt),
+        key: timeAccessEvidence(value.key, observedAt),
+        capabilities: {
+            resolved: timeAccessEvidence(value.capabilities.resolved, observedAt),
+            authenticated: timeAccessEvidence(value.capabilities.authenticated, observedAt),
+            privileged: timeAccessEvidence(value.capabilities.privileged, observedAt),
+        },
+        failureClass: timeAccessEvidence(value.failureClass, observedAt),
+    };
+}
+export function projectAccessObserved(rawCube, observedAt, rawWeb) {
+    return {
+        cube: projectAccessDomainObserved(rawCube, observedAt),
+        web: rawWeb === undefined
+            ? unknownAccessDomain("web_access_not_projected")
+            : projectAccessDomainObserved(rawWeb, observedAt),
+    };
+}
+const CubeWorkflowSourceSchema = z.object({
+    schema: z.literal(CUBE_WORKFLOW_SCHEMA),
+    summary: WorkflowSummarySchema.passthrough(),
+    phases: z.record(z.string(), WorkflowPhaseRecordSourceSchema).default({}),
+}).passthrough();
+export const LIFECYCLE_DIAGNOSTIC_MESSAGES = {
+    CUBE_WORKFLOW_IDENTITY_MISMATCH: "Claim identity changed during this lifecycle operation.",
+    CUBE_WORKFLOW_LEASE_INACTIVE: "The claim lease is inactive; retire this operation.",
+    CUBE_WORKFLOW_DEADLINE_EXCEEDED: "The lifecycle deadline expired before this phase completed.",
+    CUBE_PHASE_OUTCOME_UNKNOWN: "Provider outcome is unknown; read back before retrying.",
+    CUBE_READINESS_PENDING: "The guest is still becoming ready; wait and resume the same claim.",
+    CUBE_ACCESS_REJECTED: "Guest access was rejected; repair access before continuing.",
+    CUBE_PROVIDER_IDENTITY_MISMATCH: "Provider identity did not match the claim; manual review is required.",
+    CUBE_BOOTSTRAP_ADMISSION_STALE: "Bootstrap evidence no longer matches the current template or profile.",
+    CUBE_PHASE_FAILED: "The provisioning phase failed and requires manual review.",
+};
+const DiagnosticSourceSchema = z.object({
+    schema: z.literal(LIFECYCLE_DIAGNOSTIC_SCHEMA),
+    code: SafeCodeSchema,
+    classification: z.enum(DIAGNOSTIC_CLASSIFICATIONS),
+    phase: z.enum(WORKFLOW_PHASES),
+    resumable: z.boolean(),
+    retryAt: Rfc3339UtcSchema.optional(),
+    message: z.string().min(1).max(240).regex(/^[A-Za-z0-9 .,:;_()'-]+$/),
+    observedAt: Rfc3339UtcSchema,
+    resource: z.object({
+        name: z.string().min(1).max(253),
+        uid: UuidSchema,
+        generation: z.number().int().nonnegative(),
+        resourceVersion: z.string().min(1).max(128),
+    }).passthrough(),
+    evidenceRefs: z.array(DigestRefSchema).max(32),
+    effectCertainty: z.enum(EFFECT_CERTAINTIES),
+    retryClass: z.enum(RETRY_CLASSES),
+    nextAction: z.enum(NEXT_ACTIONS),
+}).passthrough().superRefine((value, context) => {
+    const expectedMessage = LIFECYCLE_DIAGNOSTIC_MESSAGES[value.code];
+    if (!expectedMessage || value.message !== expectedMessage) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["message"], message: "diagnostic message is not in the fixed redacted allowlist" });
+    }
+});
+export function projectLifecycleDiagnostic(raw, expected) {
+    const parsed = DiagnosticSourceSchema.safeParse(raw);
+    if (!parsed.success)
+        return unknown("diagnostic_status_invalid");
+    const value = LifecycleDiagnosticSchema.parse({
+        schema: parsed.data.schema,
+        code: parsed.data.code,
+        classification: parsed.data.classification,
+        phase: parsed.data.phase,
+        resumable: parsed.data.resumable,
+        ...(parsed.data.retryAt ? { retryAt: parsed.data.retryAt } : {}),
+        message: parsed.data.message,
+        observedAt: parsed.data.observedAt,
+        resource: {
+            name: parsed.data.resource.name,
+            uid: parsed.data.resource.uid,
+            generation: parsed.data.resource.generation,
+            resourceVersion: parsed.data.resource.resourceVersion,
+        },
+        evidenceRefs: parsed.data.evidenceRefs,
+        effectCertainty: parsed.data.effectCertainty,
+        retryClass: parsed.data.retryClass,
+        nextAction: parsed.data.nextAction,
+    });
+    if (expected && (value.resource.uid !== expected.uid || value.resource.generation !== expected.generation)) {
+        throw new InspectionConflictError("INSPECTION_CONFLICT");
+    }
+    return verified(value, "operator_lifecycle_diagnostic");
+}
+export const NETWORK_PREFLIGHT_MAX_AGE_MS = 60_000;
+export const NETWORK_PREFLIGHT_MAX_FUTURE_SKEW_MS = 30_000;
+export const NETWORK_REVALIDATION_REQUEST_TTL_MS = 120_000;
+export const NETWORK_REVALIDATION_REQUEST_MAX_FUTURE_SKEW_MS = 30_000;
+function requestWindowReason(requestedAt, requestExpiresAt, claimExpiresAt, trustedNowMs) {
+    const requestedAtMs = Date.parse(requestedAt);
+    const requestExpiresAtMs = Date.parse(requestExpiresAt);
+    const claimExpiresAtMs = Date.parse(claimExpiresAt);
+    if (![requestedAtMs, requestExpiresAtMs, claimExpiresAtMs, trustedNowMs].every(Number.isFinite)) {
+        return "network_request_invalid";
+    }
+    if (requestExpiresAtMs <= trustedNowMs)
+        return "network_request_expired";
+    if (requestedAtMs > trustedNowMs + NETWORK_REVALIDATION_REQUEST_MAX_FUTURE_SKEW_MS
+        || requestExpiresAtMs <= requestedAtMs
+        || requestExpiresAtMs > requestedAtMs + NETWORK_REVALIDATION_REQUEST_TTL_MS
+        || requestExpiresAtMs > claimExpiresAtMs) {
+        return "network_request_invalid";
+    }
+    return undefined;
+}
+export function projectNetworkRevalidation(raw, expected, trustedNow = new Date().toISOString()) {
+    const parsed = NetworkRevalidationSourceSchema.safeParse(raw);
+    if (!parsed.success)
+        throw new InspectionContractError("network revalidation status is invalid");
+    const value = parsed.data;
+    if (value.requestId !== expected.requestId
+        || value.claimUid !== expected.claimUid
+        || value.generation !== expected.generation
+        || value.operationId !== expected.operationId
+        || value.intentDigest !== expected.intentDigest
+        || (expected.claimExpiresAt !== undefined && typeof value.claimExpiresAt === "string" && value.claimExpiresAt !== expected.claimExpiresAt)
+        || (expected.host !== undefined && value.host !== undefined && JSON.stringify(value.host) !== JSON.stringify(expected.host))
+        || (expected.guestUuid !== undefined && typeof value.guestUuid === "string" && value.guestUuid !== expected.guestUuid)
+        || (expected.mac !== undefined && typeof value.mac === "string" && value.mac.toLowerCase() !== expected.mac.toLowerCase())) {
+        throw new InspectionConflictError("INSPECTION_CONFLICT");
+    }
+    if (value.state === "pending") {
+        const now = Date.parse(trustedNow);
+        if (!Rfc3339UtcSchema.safeParse(trustedNow).success || !Number.isFinite(now)) {
+            throw new InspectionContractError("trusted MCP clock is invalid");
+        }
+        const requestReason = requestWindowReason(value.requestedAt, value.requestExpiresAt, expected.claimExpiresAt ?? value.requestExpiresAt, now);
+        if (requestReason) {
+            return NetworkRevalidationSchema.parse({
+                schema: value.schema,
+                status: "unknown",
+                requestId: value.requestId,
+                claimUid: value.claimUid,
+                generation: value.generation,
+                operationId: value.operationId,
+                intentDigest: value.intentDigest,
+                requestedAt: value.requestedAt,
+                requestExpiresAt: value.requestExpiresAt,
+                reasonCode: requestReason,
+                ...(value.outcomeCode ? { outcomeCode: value.outcomeCode } : {}),
+            });
+        }
+        return NetworkRevalidationSchema.parse({
+            schema: value.schema,
+            status: value.state,
+            requestId: value.requestId,
+            claimUid: value.claimUid,
+            generation: value.generation,
+            operationId: value.operationId,
+            intentDigest: value.intentDigest,
+            requestedAt: value.requestedAt,
+            requestExpiresAt: value.requestExpiresAt,
+            ...(value.outcomeCode ? { outcomeCode: value.outcomeCode } : {}),
+        });
+    }
+    if (value.state === "unknown") {
+        const requestReason = typeof value.requestedAt === "string" && typeof value.requestExpiresAt === "string"
+            ? requestWindowReason(value.requestedAt, value.requestExpiresAt, expected.claimExpiresAt ?? value.requestExpiresAt, Date.parse(trustedNow))
+            : undefined;
+        return NetworkRevalidationSchema.parse({
+            schema: value.schema,
+            status: value.state,
+            requestId: value.requestId,
+            claimUid: value.claimUid,
+            generation: value.generation,
+            operationId: value.operationId,
+            intentDigest: value.intentDigest,
+            ...(typeof value.requestedAt === "string" ? { requestedAt: value.requestedAt } : {}),
+            ...(typeof value.requestExpiresAt === "string" ? { requestExpiresAt: value.requestExpiresAt } : {}),
+            ...(value.outcomeCode ? { outcomeCode: value.outcomeCode } : {}),
+            ...(requestReason ? { reasonCode: requestReason } : value.reasonCode ? { reasonCode: value.reasonCode } : {}),
+            ...(value.evidenceRefs ? { evidenceRefs: value.evidenceRefs } : {}),
+        });
+    }
+    const full = VerifiedNetworkRevalidationSourceSchema.safeParse(raw);
+    if (!full.success)
+        throw new InspectionContractError("verified network revalidation status is invalid");
+    const verifiedValue = full.data;
+    const now = Date.parse(trustedNow);
+    const observed = Date.parse(verifiedValue.observedAt);
+    const requestExpiry = Date.parse(verifiedValue.requestExpiresAt);
+    const claimExpiry = Date.parse(verifiedValue.claimExpiresAt);
+    const validUntil = Date.parse(verifiedValue.validUntil);
+    if (!Rfc3339UtcSchema.safeParse(trustedNow).success || !Number.isFinite(now)) {
+        throw new InspectionContractError("trusted MCP clock is invalid");
+    }
+    const requestReason = requestWindowReason(verifiedValue.requestedAt, verifiedValue.requestExpiresAt, verifiedValue.claimExpiresAt, now);
+    if (requestReason) {
+        return NetworkRevalidationSchema.parse({
+            schema: verifiedValue.schema,
+            status: "unknown",
+            requestId: verifiedValue.requestId,
+            claimUid: verifiedValue.claimUid,
+            generation: verifiedValue.generation,
+            operationId: verifiedValue.operationId,
+            intentDigest: verifiedValue.intentDigest,
+            requestedAt: verifiedValue.requestedAt,
+            requestExpiresAt: verifiedValue.requestExpiresAt,
+            reasonCode: requestReason,
+            evidenceRefs: verifiedValue.evidenceRefs,
+        });
+    }
+    if (typeof verifiedValue.address !== "string" || !isIpv4Address(verifiedValue.address)) {
+        return NetworkRevalidationSchema.parse({
+            schema: verifiedValue.schema,
+            status: "unknown",
+            requestId: verifiedValue.requestId,
+            claimUid: verifiedValue.claimUid,
+            generation: verifiedValue.generation,
+            operationId: verifiedValue.operationId,
+            intentDigest: verifiedValue.intentDigest,
+            requestedAt: verifiedValue.requestedAt,
+            requestExpiresAt: verifiedValue.requestExpiresAt,
+            reasonCode: "network_address_invalid",
+            evidenceRefs: verifiedValue.evidenceRefs,
+        });
+    }
+    const sourceFactsAt = [verifiedValue.ssh, verifiedValue.routes].flatMap((fact) => fact.state === "verified" ? [Date.parse(fact.observedAt)] : []);
+    const sourceTimesValid = [observed, ...sourceFactsAt].every((sourceAt) => Number.isFinite(sourceAt) && sourceAt <= now + NETWORK_PREFLIGHT_MAX_FUTURE_SKEW_MS
+        && sourceAt >= Date.parse(verifiedValue.requestedAt)
+        && sourceAt <= requestExpiry && sourceAt <= claimExpiry);
+    const timestampsOrdered = requestExpiry >= observed && claimExpiry >= observed
+        && sourceFactsAt.every((sourceAt) => sourceAt === observed);
+    const policyUntil = Math.min(observed + NETWORK_PREFLIGHT_MAX_AGE_MS, requestExpiry, claimExpiry);
+    if (!sourceTimesValid || !timestampsOrdered || !Number.isFinite(policyUntil)
+        || validUntil !== policyUntil || policyUntil <= observed) {
+        return NetworkRevalidationSchema.parse({
+            schema: verifiedValue.schema,
+            status: "unknown",
+            requestId: verifiedValue.requestId,
+            claimUid: verifiedValue.claimUid,
+            generation: verifiedValue.generation,
+            operationId: verifiedValue.operationId,
+            intentDigest: verifiedValue.intentDigest,
+            requestedAt: verifiedValue.requestedAt,
+            requestExpiresAt: verifiedValue.requestExpiresAt,
+            reasonCode: "network_freshness_invalid",
+            evidenceRefs: verifiedValue.evidenceRefs,
+        });
+    }
+    for (const readback of [verifiedValue.ssh, verifiedValue.routes]) {
+        if (readback.state === "verified" && readback.validUntil !== verifiedValue.validUntil) {
+            return NetworkRevalidationSchema.parse({
+                schema: verifiedValue.schema,
+                status: "unknown",
+                requestId: verifiedValue.requestId,
+                claimUid: verifiedValue.claimUid,
+                generation: verifiedValue.generation,
+                operationId: verifiedValue.operationId,
+                intentDigest: verifiedValue.intentDigest,
+                requestedAt: verifiedValue.requestedAt,
+                requestExpiresAt: verifiedValue.requestExpiresAt,
+                reasonCode: "network_freshness_invalid",
+                evidenceRefs: verifiedValue.evidenceRefs,
+            });
+        }
+    }
+    if (validUntil <= now) {
+        return NetworkRevalidationSchema.parse({
+            schema: verifiedValue.schema,
+            status: "unknown",
+            requestId: verifiedValue.requestId,
+            claimUid: verifiedValue.claimUid,
+            generation: verifiedValue.generation,
+            operationId: verifiedValue.operationId,
+            intentDigest: verifiedValue.intentDigest,
+            requestedAt: verifiedValue.requestedAt,
+            requestExpiresAt: verifiedValue.requestExpiresAt,
+            reasonCode: "network_validity_expired",
+            evidenceRefs: verifiedValue.evidenceRefs,
+        });
+    }
+    const producerFields = Object.fromEntries(Object.entries(verifiedValue).filter(([key]) => key !== "state"));
+    const safeValue = VerifiedNetworkRevalidationSchema.parse({
+        ...producerFields,
+        status: "verified",
+        validatedAt: new Date(now).toISOString(),
+        remainingValidityMs: Math.max(1, Math.min(NETWORK_PREFLIGHT_MAX_AGE_MS, validUntil - now)),
+    });
+    return safeValue;
+}
+export function projectCurrentNetworkReadiness(revalidation, retrievedAt) {
+    if (!revalidation)
+        return unknown("read_only_revalidation_required");
+    if (revalidation.status !== "verified") {
+        return unknown(revalidation.status === "unknown"
+            ? revalidation.reasonCode ?? revalidation.outcomeCode?.toLowerCase() ?? "network_revalidation_unavailable"
+            : revalidation.status === "pending" ? "network_revalidation_pending" : revalidation.reasonCode);
+    }
+    if (retrievedAt && Date.parse(retrievedAt) > Date.parse(revalidation.validUntil)) {
+        return unknown("network_validity_expired");
+    }
+    if (revalidation.ssh.state !== "verified")
+        return unknown(revalidation.ssh.reasonCode);
+    if (revalidation.routes.state !== "verified")
+        return unknown(revalidation.routes.reasonCode);
+    const state = revalidation.routes.value.peerTargetsPinged ? "ready" : "not_ready";
+    return verified({
+        value: { state },
+        observedAt: revalidation.observedAt,
+        validUntil: revalidation.validUntil,
+    }, "operator_cube_revalidation");
+}
+export function projectHistoricalNetworkReadiness(historical, retrievedAt) {
+    const source = SafeSourceSchema.safeParse(historical.source);
+    const address = z.string().min(1).max(128).safeParse(historical.address);
+    const observedAt = Rfc3339UtcSchema.safeParse(historical.observedAt);
+    const requestExpiresAt = Rfc3339UtcSchema.safeParse(historical.requestExpiresAt);
+    const claimExpiresAt = Rfc3339UtcSchema.safeParse(historical.claimExpiresAt);
+    const validUntil = Rfc3339UtcSchema.safeParse(historical.validUntil);
+    const retrieved = Rfc3339UtcSchema.safeParse(retrievedAt);
+    if (!source.success || !address.success || !observedAt.success || !retrieved.success) {
+        return unknown("network_observation_invalid");
+    }
+    if (historical.freshnessPolicy !== "cube-network-preflight/v1"
+        || !requestExpiresAt.success || !claimExpiresAt.success || !validUntil.success) {
+        return unknown("read_only_revalidation_required");
+    }
+    const policyUntil = Math.min(Date.parse(observedAt.data) + 60_000, Date.parse(requestExpiresAt.data), Date.parse(claimExpiresAt.data));
+    if (Date.parse(validUntil.data) !== policyUntil || policyUntil <= Date.parse(observedAt.data)) {
+        return unknown("network_validity_contract_invalid");
+    }
+    if (Date.parse(retrieved.data) > Date.parse(validUntil.data)) {
+        return unknown("network_validity_expired");
+    }
+    return verified({ value: { state: "ready" }, observedAt: observedAt.data, validUntil: validUntil.data }, source.data);
+}
+//# sourceMappingURL=lab-inspection.js.map