@coderifts/agent-guard 12.0.0 → 14.0.0

package/dist/cjs/cas-adapters/fs.js

@@ -45,8 +45,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.tokensEqual = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
+exports.tokensEqual = exports.UnsafeCasPathError = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
 exports.fsTokenContentHash = fsTokenContentHash;
+exports.assertSafeCasPath = assertSafeCasPath;
+exports.fsObjectIdentity = fsObjectIdentity;
+exports.identitiesEqual = identitiesEqual;
 exports.createFsVersionToken = createFsVersionToken;
 exports.readVersionedFile = readVersionedFile;
 exports.writeFileIfUnchanged = writeFileIfUnchanged;
@@ -79,15 +82,118 @@ function fsTokenContentHash(token) {
     const hash = rest.slice(colon + 1);
     return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
 }
+/**
+ * Refuse a path this adapter must not treat as a CAS target.
+ *
+ * MEASURED ABSENT before this existed (2026-08-27): `..` was silently resolved and the write landed
+ * outside the intended directory, and a symlinked target was followed by stat/readFile while the
+ * rename replaced the LINK — so the check and the write referred to DIFFERENT objects. That object
+ * mismatch is the other half of the TOCTOU: a path interpreted twice can have a symlink swapped in
+ * between the two interpretations.
+ *
+ * Three refusals, each for a different escape:
+ *   - a literal `..` segment in the caller's own path (traversal, judged BEFORE resolution),
+ *   - a symlinked final component (lstat — the object we would check is not the one we would write).
+ *
+ * The parent directory is CANONICALISED rather than rejected. Requiring realpath(dir) === dir was
+ * written first and measured wrong within the hour: on macOS /var is itself a symlink, so every
+ * path under a normal temp directory was refused. A symlinked ancestor is not the danger — an
+ * ancestor that CHANGES between the check and the write is, and that is closed by the inode/device
+ * identity re-check in writeFileIfUnchanged, not by refusing ordinary filesystems. Resolving the
+ * parent once and building the target from it means both the check and the write name one object.
+ */
+class UnsafeCasPathError extends Error {
+    reason;
+    casPath;
+    constructor(reason, casPath) {
+        super(`unsafe CAS path (${reason}): ${casPath}`);
+        this.name = 'UnsafeCasPathError';
+        this.reason = reason;
+        this.casPath = casPath;
+    }
+}
+exports.UnsafeCasPathError = UnsafeCasPathError;
+async function assertSafeCasPath(filePath) {
+    // 1. Traversal is judged on what the CALLER wrote, not on the resolved form — resolution is
+    //    exactly what makes `sub/../escaped` look innocent.
+    const segments = filePath.split(/[\\/]+/);
+    if (segments.includes('..'))
+        throw new UnsafeCasPathError('path_traversal', filePath);
+    const resolved = path.resolve(filePath);
+    // 2. Canonicalise the PARENT once, then rebuild the target from it, so every later use names the
+    //    same directory object. realpath on the parent only — never on the target itself, because
+    //    that would follow exactly the final-component symlink step 3 exists to refuse.
+    const dir = path.dirname(resolved);
+    let canonicalDir = dir;
+    try {
+        canonicalDir = await node_fs_1.promises.realpath(dir);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code !== 'ENOENT')
+            throw err;
+        // Parent does not exist yet — a create under mkdir -p. Keep the resolved form.
+    }
+    const target = path.join(canonicalDir, path.basename(resolved));
+    // 3. The final component must not be a symlink. lstat does NOT follow; stat would, which is the
+    //    whole bug: stat/readFile measured the TARGET while rename replaced the LINK, so the check
+    //    and the write referred to different objects. ENOENT is fine — create-if-absent is legitimate.
+    try {
+        const lst = await node_fs_1.promises.lstat(target);
+        if (lst.isSymbolicLink())
+            throw new UnsafeCasPathError('symlink_target', filePath);
+    }
+    catch (err) {
+        if (err instanceof UnsafeCasPathError)
+            throw err;
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code !== 'ENOENT')
+            throw err;
+    }
+    return target;
+}
+/**
+ * Identity of the object CURRENTLY at a path, read through a FILE DESCRIPTOR.
+ *
+ * Opening once and fstat-ing the handle is what makes this an identity rather than another path
+ * interpretation: the fd names the object, so a symlink swapped in afterwards cannot redirect it.
+ * null when the path does not exist.
+ */
+async function fsObjectIdentity(filePath) {
+    let fh;
+    try {
+        fh = await node_fs_1.promises.open(filePath, 'r');
+        const st = await fh.stat();
+        return { dev: st.dev, ino: st.ino };
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    finally {
+        if (fh)
+            await fh.close().catch(() => { });
+    }
+}
+function identitiesEqual(a, b) {
+    if (!a || !b)
+        return false;
+    return a.dev === b.dev && a.ino === b.ino;
+}
 /**
  * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
  * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
  * so hosts can CAS create vs create-raced.
  */
 async function createFsVersionToken(filePath) {
-    let st;
+    // ONE open, then stat AND read from the same handle. Previously this was stat(path) followed by
+    // readFile(path) — two interpretations of the same string, so a swap between them produced a
+    // token describing neither object exactly. The fd names the object for both reads.
+    let fh;
     try {
-        st = await node_fs_1.promises.stat(filePath);
+        fh = await node_fs_1.promises.open(filePath, 'r');
     }
     catch (err) {
         const code = err && typeof err === 'object' && 'code' in err
@@ -97,14 +203,20 @@ async function createFsVersionToken(filePath) {
             return exports.FS_ABSENT_TOKEN;
         throw err;
     }
-    if (!st.isFile()) {
-        // Directories / specials are not content CAS targets for this adapter.
-        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    try {
+        const st = await fh.stat();
+        if (!st.isFile()) {
+            // Directories / specials are not content CAS targets for this adapter.
+            throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+        }
+        const buf = await fh.readFile();
+        const hash = sha256hex(buf);
+        const mtimeMs = Math.trunc(st.mtimeMs);
+        return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+    }
+    finally {
+        await fh.close().catch(() => { });
     }
-    const buf = await node_fs_1.promises.readFile(filePath);
-    const hash = sha256hex(buf);
-    const mtimeMs = Math.trunc(st.mtimeMs);
-    return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
 }
 /**
  * Read file content + version token for VersionedContent (host reporting / preflight prior).
@@ -135,9 +247,29 @@ async function readVersionedFile(filePath) {
  * Wired through executeIfUnchanged — not a parallel path.
  */
 async function writeFileIfUnchanged(args) {
-    const target = path.resolve(args.path);
+    // Refuse traversal / symlink / mounted-over-parent BEFORE any token is measured. A CAS over an
+    // object the caller did not name is not a weaker guarantee, it is a wrong one.
+    const target = await assertSafeCasPath(args.path);
     const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
     const writtenHash = sha256hex(body);
+    // Identity of the object the CHECK is about, captured through an fd (null when creating).
+    const checkedIdentity = await fsObjectIdentity(target);
+    // T1 identity claim: if the caller measured one at authorization time, the object must still be
+    // that object BEFORE we do anything. Captured-here identity cannot see a swap that predates this
+    // call, which is exactly the case the token also cannot see.
+    const hasT1Identity = Object.prototype.hasOwnProperty.call(args, 'expected_identity');
+    if (hasT1Identity) {
+        const t1 = args.expected_identity ?? null;
+        const held = t1 === null ? checkedIdentity === null : identitiesEqual(t1, checkedIdentity);
+        if (!held) {
+            return {
+                status: 'refused',
+                reason: 'stale_version_token',
+                expected_token: args.expected_token,
+                current_token: await createFsVersionToken(target).catch(() => null),
+            };
+        }
+    }
     return (0, conditional_write_js_1.executeIfUnchanged)({
         expected_token: args.expected_token,
         current_token: () => createFsVersionToken(target),
@@ -160,7 +292,22 @@ async function writeFileIfUnchanged(args) {
             const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString('hex')}.tmp`);
             try {
                 await node_fs_1.promises.writeFile(tmp, body);
-                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                // Close pre-rename window on BOTH facts. Content equality alone cannot see an object swap:
+                // a symlink or a replaced inode with identical bytes passes a token check and is still a
+                // different object. Identity is checked first because it is the stronger statement.
+                const stillIdentity = await fsObjectIdentity(target);
+                const identityHeld = checkedIdentity === null
+                    ? stillIdentity === null // create-if-absent: nothing may have appeared
+                    : identitiesEqual(checkedIdentity, stillIdentity);
+                if (!identityHeld) {
+                    try {
+                        await node_fs_1.promises.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new conditional_write_js_1.StaleVersionTokenAbort(await createFsVersionToken(target).catch(() => null));
+                }
                 const still = await createFsVersionToken(target);
                 if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
                     try {
@@ -186,7 +333,14 @@ async function writeFileIfUnchanged(args) {
                 }
                 throw err;
             }
-            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+            // Evidence: which OBJECT was checked, not merely which path string.
+            return {
+                path: target,
+                bytes: body.length,
+                written_content_hash: writtenHash,
+                checked_identity: checkedIdentity,
+                committed_identity: await fsObjectIdentity(target),
+            };
         },
     });
 }

package/dist/cjs/cas-adapters/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAOD,oDAmBC;AAMD,8CAOC;AA0BD,oDAwDC;AASD,oEA0BC;AA/LD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AAwLxB,4FA5LP,kCAAW,OA4LO;AArLpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAiCD,8CAmCC;AAYD,4CAaC;AAED,0CAMC;AAOD,oDA2BC;AAMD,8CAOC;AAiCD,oDAwGC;AASD,oEA0BC;AAnWD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AA4VxB,4FAhWP,kCAAW,OAgWO;AAzVpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAsC;IAC5C,OAAO,CAAS;IACzB,YAAY,MAA2C,EAAE,OAAe;QACtE,KAAK,CAAC,oBAAoB,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AATD,gDASC;AAEM,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,4FAA4F;IAC5F,wDAAwD;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,iGAAiG;IACjG,8FAA8F;IAC9F,oFAAoF;IACpF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,YAAY,GAAG,GAAG,CAAC;IACvB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QACjC,+EAA+E;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhE,gGAAgG;IAChG,+FAA+F;IAC/F,mGAAmG;IACnG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,EAA8B,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE;YAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,CAAsC,EACtC,CAAsC;IAEtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,gGAAgG;IAChG,6FAA6F;IAC7F,mFAAmF;IACnF,IAAI,EAA8B,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,uEAAuE;YACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAQ9B,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,0FAA0F;IAC1F,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvD,gGAAgG;IAChG,iGAAiG;IACjG,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,2FAA2F;gBAC3F,yFAAyF;gBACzF,oFAAoF;gBACpF,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,YAAY,GAAG,eAAe,KAAK,IAAI;oBAC3C,CAAC,CAAC,aAAa,KAAK,IAAI,CAAY,8CAA8C;oBAClF,CAAC,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;gBACpD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oEAAoE;YACpE,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,oBAAoB,EAAE,WAAW;gBACjC,gBAAgB,EAAE,eAAe;gBACjC,kBAAkB,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/cas-attestation.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ExecutorKeyRegistry } from '@coderifts/sdk';
 import type { GuardExecutionProof, ExecutionResultHash } from './execution-proof.js';
-import type { ExecuteIfUnchangedOutcome, VersionToken } from './conditional-write.js';
+import type { ExecuteIfUnchangedOutcome, IndeterminateReason, VersionToken } from './conditional-write.js';
 /** Machine-readable schema id — mirrors EXECUTION_PROOF_SPEC style. */
 export declare const CAS_ATTESTATION_SPEC: "cas-attestation.v1";
 /**
@@ -51,6 +51,16 @@ export type CasAttestationCas = {
     reason: 'stale_during_commit';
     expected_token: VersionToken;
     post_commit_token: VersionToken | null;
+} | {
+    status: 'indeterminate';
+    /**
+     * 'unknown' is a THIRD value, never a default to false. Collapsing it to false would say the
+     * write did not run, which is a claim we do not have; collapsing it to true would say it did.
+     */
+    write_ran: 'unknown';
+    reason: IndeterminateReason;
+    expected_token: VersionToken;
+    observed_token: VersionToken | null;
 };
 /**
  * Frozen cas-attestation.v1 record.
@@ -73,12 +83,22 @@ export type CasAttestation = {
          * (clean commit only — committed_stale_detected is NOT this flag).
          */
         authorized_and_committed: boolean;
+        /**
+         * ATOMIC / v2 only: host-reported commit. Never co-named with authorized_and_committed.
+         * Absent on non-ATOMIC records (byte-identical 9.0.0 derived).
+         */
+        authorized_and_host_reported_committed?: boolean;
         /** Write mutation ran: committed or committed_stale_detected. */
         write_ran: boolean;
         /** outcome.status === 'committed_stale_detected'. */
         stale_during_commit: boolean;
         /** outcome.status === 'refused'. */
         refused: boolean;
+        /**
+         * outcome.status === 'indeterminate'. Downstream MUST block on this: it is not a pass, and it
+         * is not a failure either. Reconciliation is required before anything may proceed.
+         */
+        indeterminate: boolean;
     };
     /**
      * Observation-side CAS evidence class (S2-F2a R3). Never a verdict/preimage field.
@@ -112,10 +132,10 @@ export type EvaluateCasEvidenceOpts = {
         receipt_digest?: string;
     } | null;
     /** Strict-only tightening of derived.authorized_and_committed. Absent = 9.0.0 formula. */
-    profile?: 'ENFORCING_STRICT';
+    profile?: 'ENFORCING_STRICT' | 'ENFORCING_ATOMIC';
 };
 /** Existing CasAttestation.derived name and its honest sibling — not a parallel taxonomy. */
-export type CommitLabel = 'authorized_and_committed' | 'authorized_not_committed';
+export type CommitLabel = 'authorized_and_committed' | 'authorized_not_committed' | 'authorized_and_host_reported_committed';
 export declare const COMMIT_EVIDENCE_MISSING: "commit_evidence_missing";
 export type StrictCommitObservation = {
     commit_label: CommitLabel;

package/dist/cjs/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAClF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AAaF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAgB/F;AAiCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAkDhB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AAaF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CA8DhB"}

package/dist/cjs/cas-attestation.js

@@ -195,6 +195,13 @@ function isExecuteIfUnchangedOutcome(x) {
         const s = x;
         return s.reason === 'stale_during_commit' && typeof s.expected_token === 'string';
     }
+    if (o.status === 'indeterminate') {
+        const i = x;
+        return (i.reason === 'response_lost'
+            || i.reason === 'ambiguous_provider_reply'
+            || i.reason === 'observation_failed')
+            && typeof i.expected_token === 'string';
+    }
     return false;
 }
 function freezeExecutionResultHash(h) {
@@ -217,6 +224,15 @@ function projectCas(outcome) {
             current_token: outcome.current_token == null ? null : outcome.current_token,
         });
     }
+    if (outcome.status === 'indeterminate') {
+        return Object.freeze({
+            status: 'indeterminate',
+            write_ran: 'unknown',
+            reason: outcome.reason,
+            expected_token: outcome.expected_token,
+            observed_token: outcome.observed_token == null ? null : outcome.observed_token,
+        });
+    }
     // committed_stale_detected
     return Object.freeze({
         status: 'committed_stale_detected',
@@ -246,8 +262,10 @@ function buildCasAttestation(proof, outcome, opts = {}) {
     const write_ran = cas.write_ran === true;
     const stale_during_commit = cas.status === 'committed_stale_detected';
     const refused = cas.status === 'refused';
+    const indeterminate = cas.status === 'indeterminate';
     const cas_evidence = evaluateCasEvidence(outcome, opts);
     let authorized_and_committed = receipt_verified && cas.status === 'committed';
+    let authorized_and_host_reported_committed = false;
     // ENFORCING_STRICT: the existing derived name now requires executor_attested + kernel
     // cross-check. Non-strict keeps the 9.0.0 formula (receipt verified + clean commit).
     if (opts.profile === 'ENFORCING_STRICT') {
@@ -255,6 +273,12 @@ function buildCasAttestation(proof, outcome, opts = {}) {
         authorized_and_committed = authorized_and_committed
             && obs.commit_label === 'authorized_and_committed';
     }
+    if (opts.profile === 'ENFORCING_ATOMIC') {
+        const executorOk = cas_evidence.class === 'executor_attested';
+        const hostClaimed = cas_evidence.class === 'host_claimed';
+        authorized_and_host_reported_committed = receipt_verified && cas.status === 'committed' && hostClaimed;
+        authorized_and_committed = receipt_verified && cas.status === 'committed' && executorOk;
+    }
     const attestation = {
         attestation_spec: exports.CAS_ATTESTATION_SPEC,
         references: Object.freeze({
@@ -270,6 +294,10 @@ function buildCasAttestation(proof, outcome, opts = {}) {
             write_ran,
             stale_during_commit,
             refused,
+            indeterminate,
+            ...(opts.profile === 'ENFORCING_ATOMIC'
+                ? { authorized_and_host_reported_committed }
+                : {}),
         }),
         cas_evidence,
         limits: LIMITS,

package/dist/cjs/cas-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0JH,0DAeC;AAmBD,0EAYC;AAqBD,kDAyDC;AAGD,sDAQC;AAGD,kEAgBC;AAuCD,kDAsDC;AA/YD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA6FU,QAAA,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,+BAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,sFAAsF;IACtF,qFAAqF;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,GAAG,wBAAwB;eAC9C,GAAG,CAAC,YAAY,KAAK,0BAA0B,CAAC;IACvD,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;SACR,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA+KH,0DAeC;AAmBD,0EAYC;AAqBD,kDAyDC;AAGD,sDAQC;AAGD,kEAuBC;AAgDD,kDAkEC;AAhcD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AAkHU,QAAA,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,+BAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,GAAG,wBAAwB;eAC9C,GAAG,CAAC,YAAY,KAAK,0BAA0B,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,KAAK,mBAAmB,CAAC;QAC9D,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;QACvG,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cjs/conditional-write.d.ts

@@ -32,6 +32,36 @@ export type VersionedContent = {
  * (absent ≠ 0 ≠ null ≠ unknown).
  */
 export type ConditionalWriteReport = true | false | 'not_reported';
+/**
+ * HOW STRONG the atomicity guarantee was — claim language on the mutation side, worded the way the
+ * four claim levels are: each class says what it ASSERTS and what it DOES NOT.
+ *
+ * SAME_TRANSACTION
+ *   ASSERTS: the check and the mutation committed inside ONE transaction of the same system, so no
+ *   interleaving is possible — the provider, not us, enforces it.
+ *   DOES NOT ASSERT: that the transaction was correct, that it was the right row, or anything about
+ *   any resource outside that transaction.
+ *
+ * CONDITIONAL_EXTERNAL
+ *   ASSERTS: a SINGLE conditional claim was made against a provider that supports CAS or
+ *   idempotency (if-match, expected-version, expected-old-sha), and the result was read back.
+ *   DOES NOT ASSERT: atomicity across the check and the mutation. Two systems were involved and the
+ *   provider's own compare-and-set is what closed the window — a Redis SETNX followed by a separate
+ *   HTTP call is NOT this class and is NOT a transaction, because the claim and the mutation are two
+ *   claims against two systems.
+ *
+ * NON_ATOMIC
+ *   ASSERTS: the mutation was applied.
+ *   DOES NOT ASSERT: that anything guarded it. The provider lacked the capability, or no
+ *   authorization-time token was available, so the write was unconditional. This is the honest
+ *   class for "we wrote it and cannot say more", and it must never be reported as either of the
+ *   two above.
+ */
+export type ConditionalWriteGuarantee = 'SAME_TRANSACTION' | 'CONDITIONAL_EXTERNAL' | 'NON_ATOMIC';
+/**
+ * Why an outcome is INDETERMINATE. The claim is strictly "we do not know", never "it failed".
+ */
+export type IndeterminateReason = 'response_lost' | 'ambiguous_provider_reply' | 'observation_failed';
 /**
  * Per-call forensic basis for conditional write (on every GuardOutcome).
  * Survives replay unchanged when recorded.
@@ -52,6 +82,12 @@ export type ConditionalWriteBasis = {
      * Independent of artifacts[]: carrying both sides of a change does not make the commit atomic.
      */
     mutating: boolean;
+    /**
+     * HOW STRONG the guarantee was, when the host reported one. Absent when conditional_write is
+     * not_reported — "we were not told" is not a guarantee class. `conditional_write: true` with
+     * guarantee NON_ATOMIC is a coherent and important combination: the host conditioned nothing.
+     */
+    guarantee?: ConditionalWriteGuarantee;
 };
 /**
  * Values the RUNNER collected / host reported before the pure guard path.
@@ -62,6 +98,8 @@ export type ConditionalWriteCallContext = {
     conditioned_on_token?: VersionToken | null;
     /** Optional versioned content for token carry (equality only). */
     versioned_content?: VersionedContent | null;
+    /** Host-reported strength of the guarantee. Carried, never inferred. */
+    guarantee?: ConditionalWriteGuarantee;
 };
 /** Equality compare only — never semantic interpretation of the token. */
 export declare function tokensEqual(a: VersionToken | null | undefined, b: VersionToken | null | undefined): boolean;
@@ -124,6 +162,23 @@ export type ExecuteIfUnchangedOutcome<T> = {
     reason: 'stale_version_token';
     expected_token: VersionToken;
     current_token: VersionToken | null;
+} | {
+    /**
+     * FIRST-CLASS UNKNOWN. The mutation may or may not have been applied — we sent it and could
+     * not observe the result. Distinct from 'refused' (we know it did not land) and from
+     * 'committed' (we know it did).
+     *
+     * The rule is strict and is the whole point of the class:
+     *   - NEVER blindly retry. A retry of a write that already landed is a second mutation.
+     *   - Reconciliation is REQUIRED: read the resource and establish which state holds.
+     *   - Downstream MUST block until it is resolved. An indeterminate write is not a pass.
+     */
+    status: 'indeterminate';
+    reason: IndeterminateReason;
+    expected_token: VersionToken;
+    /** What we managed to observe, if anything. null when observation itself failed. */
+    observed_token?: VersionToken | null;
+    detail?: string;
 } | {
     status: 'committed_stale_detected';
     reason: 'stale_during_commit';

package/dist/cjs/conditional-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,+FAA+F;IAC/F,WAAW,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAmCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAMhB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,aAAa,EAAE,YAAY,CAAC;IAAC,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,GACrG;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACtC,CAAC;AAEN;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;gBAChC,aAAa,EAAE,YAAY,GAAG,IAAI;CAK/C;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,wEAAwE;IACxE,cAAc,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxE,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,CAAC,KACN,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CA6DvC"}
+{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,yBAAyB,GACjC,kBAAkB,GAClB,sBAAsB,GACtB,YAAY,CAAC;AAEjB;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,0BAA0B,GAC1B,oBAAoB,CAAC;AAEzB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,+FAA+F;IAC/F,WAAW,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,wEAAwE;IACxE,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CA0CA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAMhB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,aAAa,EAAE,YAAY,CAAC;IAAC,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,GACrG;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE;;;;;;;;;OASG;IACH,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,oFAAoF;IACpF,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACtC,CAAC;AAEN;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;gBAChC,aAAa,EAAE,YAAY,GAAG,IAAI;CAK/C;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,wEAAwE;IACxE,cAAc,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxE,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,CAAC,KACN,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CA6DvC"}

package/dist/cjs/conditional-write.js

@@ -70,6 +70,12 @@ function buildConditionalWriteBasis(input) {
         write_style,
         mutating,
     };
+    // Guarantee carry: reported only, never inferred from the report being true.
+    if (ctx.guarantee === 'SAME_TRANSACTION'
+        || ctx.guarantee === 'CONDITIONAL_EXTERNAL'
+        || ctx.guarantee === 'NON_ATOMIC') {
+        basis.guarantee = ctx.guarantee;
+    }
     // Token carry: prefer explicit conditioned_on_token, else versioned_content.version_token.
     if (conditional_write === true) {
         if (typeof ctx.conditioned_on_token === 'string') {

package/dist/cjs/conditional-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;;;AAuDb,kCAOC;AA0BD,gEA6CC;AASD,4DAYC;AAgFD,gDA+DC;AAnPD,0EAA0E;AAC1E,SAAgB,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,0BAA0B,CAAC,KAM1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,wFAAwF;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;QACX,QAAQ;KACT,CAAC;IAEF,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AAC5E,QAAA,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAMxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IACpG,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,oCAA4B,CAAC;AACtC,CAAC;AA+BD;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IACtC,aAAa,CAAsB;IAC5C,YAAY,aAAkC;QAC5C,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAPD,wDAOC;AA+BD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC5D,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC;IAED,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,QAAQ;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,uGAAuG;IACvG,uGAAuG;IACvG,IAAI,cAAc,GAAwB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QACxD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,MAAM;gBACN,cAAc,EAAE,QAAQ;gBACxB,iBAAiB,EAAE,cAAc;gBACjC,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;;;AAqGb,kCAOC;AA0BD,gEAoDC;AASD,4DAYC;AAkGD,gDA+DC;AA5QD,0EAA0E;AAC1E,SAAgB,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,0BAA0B,CAAC,KAM1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,wFAAwF;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;QACX,QAAQ;KACT,CAAC;IAEF,6EAA6E;IAC7E,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB;WACnC,GAAG,CAAC,SAAS,KAAK,sBAAsB;WACxC,GAAG,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACpC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AAC5E,QAAA,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAMxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IACpG,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,oCAA4B,CAAC;AACtC,CAAC;AAiDD;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IACtC,aAAa,CAAsB;IAC5C,YAAY,aAAkC;QAC5C,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAPD,wDAOC;AA+BD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC5D,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC;IAED,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,QAAQ;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,uGAAuG;IACvG,uGAAuG;IACvG,IAAI,cAAc,GAAwB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QACxD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,MAAM;gBACN,cAAc,EAAE,QAAQ;gBACxB,iBAAiB,EAAE,cAAc;gBACjC,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AAClF,CAAC"}

package/dist/cjs/deploy-gate.d.ts

@@ -13,9 +13,21 @@
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
- * binding (an old artifact's ALLOW never deploys a newer one). Scope honesty mirrors the merge gate:
- * `inescapable_deploy` is true ONLY in the fully-enforcing, non-bypassable case; otherwise the check
- * may be `success` for visibility but the claim is false with the residual named.
+ * binding (an old artifact's ALLOW never deploys a newer one). Scope honesty follows the merge gate's
+ * SHAPE (a conjunction, fail-closed on any gap) but NOT its conjuncts — see below.
+ *
+ * `inescapable_deploy` is true ONLY when every conjunct holds: ENFORCING ∧ ¬bypass_possible ∧
+ * fingerprint rebound. Missing any conjunct → FALSE (fail-closed); the check may still be `success`
+ * for visibility, with the residual named.
+ *
+ * WHAT THAT DOES NOT SAY, stated because the field name is stronger than the fact. The first two
+ * conjuncts are the HOST's observation of its own CD config (`DeployRequiredContext.enforcement`),
+ * consumed by this pure gate, not verified by it — so `inescapable_deploy: true` reports that the
+ * host said its pipeline enforces and cannot be bypassed, plus a fingerprint we did rebind. Note
+ * also that this gate carries NO issuer-binding conjunct at all, unlike `inescapable_merge`: where a
+ * provider check supplies the enforcing signal, binding it to an App id proves the check came from
+ * that provider's Actions app, NOT that CodeRifts produced it — anyone who can edit the workflow
+ * definition can post under the same issuer. Closing that needs workflow-SHA pinning.
  *
  * Public source (ships in the npm package): references only receipt/target/enforcement fields and
  * generic deploy-gate concepts — no scoring logic, weights, thresholds, pattern names, endpoints, or