@coderifts/agent-guard 14.0.0 → 15.0.0

package/dist/cjs/atomic-profile.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ATOMIC_INVARIANTS = exports.ATOMIC_PROFILE_UNSATISFIED = exports.GUARD_ATOMIC_WIRE_VALUE = exports.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
+exports.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports.ATOMIC_V2_MAX_AGE_MS_CAP = exports.ATOMIC_INVARIANTS = exports.ATOMIC_PROFILE_UNSATISFIED = exports.GUARD_ATOMIC_WIRE_VALUE = exports.PROFILE_ENFORCING_ATOMIC_V2 = exports.PROFILE_ENFORCING_ATOMIC_V1 = void 0;
 exports.createMutatorRegister = createMutatorRegister;
 exports.isEnforcingAtomic = isEnforcingAtomic;
+exports.isEnforcingAtomicV2 = isEnforcingAtomicV2;
 exports.atomicConstructionProblems = atomicConstructionProblems;
 exports.throwAtomicUnsatisfied = throwAtomicUnsatisfied;
 exports.atomicOutcome = atomicOutcome;
@@ -14,7 +15,47 @@ exports.atomicOutcome = atomicOutcome;
  * wired. Executor behaviour (nonce consume-once, CAS, read-back, attestation)
  * is still observed per call; construction only demands the wiring.
  */
+const posture_receipt_js_1 = require("./posture-receipt.js");
 exports.PROFILE_ENFORCING_ATOMIC_V1 = 'ENFORCING_ATOMIC_V1';
+/**
+ * ENFORCING_ATOMIC_V2 (roadmap 1167) — V1 plus a VERIFIED credential boundary.
+ *
+ * WHY A NEW NAME RATHER THAN A STRICTER _V1. with-coderifts.ts:228 states the
+ * rule this package learned from its own 10.0.0 and 12.0.0 releases: "The next
+ * tightening MUST be `_V2`; adding a condition to `_V1` reintroduces the defect
+ * this type exists to remove." A caller who wrote `_V1` keeps exactly the
+ * contract they asked for; the stricter check costs them nothing.
+ *
+ * WHAT V2's credential_boundary PROVES:
+ *   A signed `cr.posture.receipt.v1` verified against a caller-supplied key
+ *   (registry or pinned PEM) asserts `verdict: 'PASS'` — the credential
+ *   boundary was read back out of the live catalog at `measured_at`, that
+ *   reading is inside the caller's freshness window, and the receipt is bound
+ *   to this `deployment_id`.
+ *
+ * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
+ *   · NOT a tuple the CALLER did not name. executor_id, adapter_id, target_uri
+ *     and policy_hash ARE now bound (AUDIT P1 / RES-3) — but each only when the
+ *     construction configures it. The earlier text here said the producer does
+ *     not sign those fields; re-measured 2026-08-29 against capability-demo
+ *     demo/src/posture.js, the issuer spreads them into the SIGNED canonical
+ *     body whenever they carry real content, so binding them is backed by the
+ *     producer rather than asserted over it. What has NOT changed is the rule
+ *     underneath: a field nobody configured is reported in the verifier's
+ *     `not_bound` list, never defaulted into looking checked.
+ *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
+ *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
+ *     A guard-side default would present our policy as the receipt's statement.
+ *   · NOT executor behaviour. Same honest limit as every other invariant here:
+ *     construction demands wiring, and a read-back at `measured_at` is a fact
+ *     about that moment, not about the write that happens afterwards.
+ */
+exports.PROFILE_ENFORCING_ATOMIC_V2 = 'ENFORCING_ATOMIC_V2';
+/**
+ * The unsuffixed wire value stays pinned to V1 FOREVER (with-coderifts.ts:231-233).
+ * Re-pointing it at V2 would silently move every existing caller — the migration
+ * the versioned names exist to refuse.
+ */
 exports.GUARD_ATOMIC_WIRE_VALUE = 'ENFORCING_ATOMIC';
 exports.ATOMIC_PROFILE_UNSATISFIED = 'ATOMIC_PROFILE_UNSATISFIED';
 /** Frozen invariant names — adding one is ATOMIC_V2, not an edit here. */
@@ -51,8 +92,22 @@ function createMutatorRegister() {
     return api;
 }
 function isEnforcingAtomic(profile) {
-    return profile === 'ENFORCING_ATOMIC' || profile === exports.PROFILE_ENFORCING_ATOMIC_V1;
+    return profile === 'ENFORCING_ATOMIC'
+        || profile === exports.PROFILE_ENFORCING_ATOMIC_V1
+        || profile === exports.PROFILE_ENFORCING_ATOMIC_V2;
+}
+/** V2 only. The unsuffixed alias is V1 and must never answer true here. */
+function isEnforcingAtomicV2(profile) {
+    return profile === exports.PROFILE_ENFORCING_ATOMIC_V2;
 }
+/**
+ * V2 caller-supplied freshness window must be finite, positive, and ≤ 24h.
+ * A larger value is not a freshness check (the receipt has no expires_at).
+ */
+exports.ATOMIC_V2_MAX_AGE_MS_CAP = 86_400_000;
+exports.CREDENTIAL_BOUNDARY_BARE_REJECTED = 'credential_boundary: a verified cr.posture.receipt.v1 is required; a bare assertion is no '
+    + 'longer accepted. ENFORCING_ATOMIC_V1 still accepts the bare form and is frozen — move to '
+    + '_V2 to get this check.';
 function atomicConstructionProblems(input) {
     const problems = [];
     const grant = input.executionGrant;
@@ -90,6 +145,71 @@ function atomicConstructionProblems(input) {
     if (input.credentialBoundary !== true && typeof input.credentialBoundary !== 'object') {
         problems.push('credential_boundary: credentialBoundary assertion required');
     }
+    // ── V2 ONLY (1167). The two lines above are the FROZEN V1 check and are not
+    // edited: on V1 a bare `true` still satisfies credential_boundary, exactly as
+    // it did before this file gained a V2. Everything below runs only when the
+    // caller asked for _V2, which is what makes the tightening opt-in.
+    if (isEnforcingAtomicV2(input.profile)) {
+        const cb = input.credentialBoundary;
+        if (cb === true || !cb || typeof cb !== 'object' || typeof cb.postureReceipt !== 'string') {
+            problems.push(exports.CREDENTIAL_BOUNDARY_BARE_REJECTED);
+        }
+        else if (!cb.registry && !cb.pinnedKeyPem) {
+            problems.push('credential_boundary: credentialBoundary.registry or .pinnedKeyPem required — the posture '
+                + 'receipt is verified against a caller-supplied key; this package never fetches one.');
+        }
+        else {
+            const deploymentId = typeof cb.deploymentId === 'string' ? cb.deploymentId : '';
+            if (deploymentId.length === 0) {
+                problems.push('credential_boundary: credentialBoundary.deploymentId required under ENFORCING_ATOMIC_V2 — '
+                    + 'the posture receipt must be bound to this deployment.');
+            }
+            const maxAgeMs = cb.maxAgeMs;
+            const maxAgeOk = typeof maxAgeMs === 'number'
+                && Number.isFinite(maxAgeMs)
+                && maxAgeMs > 0
+                && maxAgeMs <= exports.ATOMIC_V2_MAX_AGE_MS_CAP;
+            if (typeof maxAgeMs !== 'number' || !Number.isFinite(maxAgeMs) || maxAgeMs <= 0) {
+                problems.push('credential_boundary: credentialBoundary.maxAgeMs required under ENFORCING_ATOMIC_V2 — '
+                    + 'a finite positive freshness window; the receipt signs measured_at and no expires_at.');
+            }
+            else if (maxAgeMs > exports.ATOMIC_V2_MAX_AGE_MS_CAP) {
+                problems.push(`credential_boundary: credentialBoundary.maxAgeMs exceeds the ${exports.ATOMIC_V2_MAX_AGE_MS_CAP}ms `
+                    + 'cap (24h). A larger window is not a freshness check.');
+            }
+            // V2 calls the verifier only with both mandatory args present — a call with neither
+            // is itself a construction problem (the verifier stays permissive when invoked directly).
+            if (deploymentId.length > 0 && maxAgeOk) {
+                // The credential-boundary tuple, from the construction input rather than
+                // from anywhere this function could invent it. Each is passed ONLY when
+                // configured: an absent one reaches the verifier as undefined and comes
+                // back named in `not_bound` — the honest record of a boundary this
+                // deployment never stated.
+                const r = (0, posture_receipt_js_1.verifyPostureReceipt)(cb.postureReceipt, {
+                    registry: cb.registry,
+                    pinnedKeyPem: cb.pinnedKeyPem,
+                    expectedDeploymentId: deploymentId,
+                    expectedExecutorId: input.executorId,
+                    expectedAdapterId: input.adapterId,
+                    expectedTargetUri: input.targetUri,
+                    expectedPolicyHash: input.policyHash,
+                    maxAgeMs,
+                    now: cb.now,
+                });
+                if (!r.valid) {
+                    problems.push(`credential_boundary: posture receipt not verified — ${r.status} (${r.reason}). `
+                        + (r.status === 'POSTURE_STALE'
+                            ? 'This is the caller-supplied freshness window (maxAgeMs), not a receipt-carried '
+                                + 'expiry: cr.posture.receipt.v1 signs measured_at and no expires_at.'
+                            : r.status === 'POSTURE_FAIL'
+                                ? 'The signature verified; the posture did not. A signed FAIL is a drift artifact — '
+                                    + 'the boundary regressed, the receipt is intact.'
+                                : 'Supply a posture receipt signed by a key in the registry, bound to this '
+                                    + 'deployment_id, with verdict PASS.'));
+                }
+            }
+        }
+    }
     return problems;
 }
 function throwAtomicUnsatisfied(problems) {

package/dist/cjs/atomic-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":";;;AAqCA,sDAkBC;AAED,8CAEC;AAcD,gEAsCC;AAED,wDAOC;AAKD,sCA4BC;AAzJD;;;;;;;GAOG;AACU,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAC7D,QAAA,uBAAuB,GAAG,kBAA2B,CAAC;AAGtD,QAAA,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC7D,QAAA,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,SAAgB,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB,IAAI,OAAO,KAAK,mCAA2B,CAAC;AACnF,CAAC;AAcD,SAAgB,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,kCAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,kCAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":";;;AAiFA,sDAkBC;AAED,8CAIC;AAGD,kDAEC;AA8CD,gEAgHC;AAED,wDAOC;AAKD,sCA4BC;AAtTD;;;;;;;GAOG;AACH,6DAA4D;AAG/C,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACU,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,kBAA2B,CAAC;AAGtD,QAAA,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC7D,QAAA,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,SAAgB,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB;WAChC,OAAO,KAAK,mCAA2B;WACvC,OAAO,KAAK,mCAA2B,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,KAAK,mCAA2B,CAAC;AACjD,CAAC;AAuBD;;;GAGG;AACU,QAAA,wBAAwB,GAAG,UAAU,CAAC;AActC,QAAA,iCAAiC,GAC5C,4FAA4F;MAC1F,2FAA2F;MAC3F,wBAAwB,CAAC;AAE7B,SAAgB,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAA4E,CAAC;QAC9F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,yCAAiC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,2FAA2F;kBACzF,oFAAoF,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;sBAC1F,uDAAuD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ;mBACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBACzB,QAAQ,GAAG,CAAC;mBACZ,QAAQ,IAAI,gCAAwB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CACX,wFAAwF;sBACtF,sFAAsF,CACzF,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,GAAG,gCAAwB,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,gEAAgE,gCAAwB,KAAK;sBAC3F,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,oFAAoF;YACpF,0FAA0F;YAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,yEAAyE;gBACzE,wEAAwE;gBACxE,wEAAwE;gBACxE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,CAAC,GAAG,IAAA,yCAAoB,EAAC,EAAE,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,QAAQ;oBACR,GAAG,EAAE,EAAE,CAAC,GAAG;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CACX,uDAAuD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;0BAC/E,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;4BAC7B,CAAC,CAAC,iFAAiF;kCAC/E,oEAAoE;4BACxE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc;gCAC3B,CAAC,CAAC,mFAAmF;sCACjF,gDAAgD;gCACpD,CAAC,CAAC,0EAA0E;sCACxE,mCAAmC,CAAC,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,kCAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,kCAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cjs/deny-remedy.d.ts

@@ -0,0 +1,74 @@
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+export declare const DENY_ERROR: Readonly<{
+    GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED";
+    GRANT_INVALID: "CODERIFTS_GRANT_INVALID";
+    GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH";
+}>;
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+export declare const DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
+export declare const ARGS_SHAPE: Readonly<{
+    artifacts: "Array<{ id, type, before, after }> — the change set being authorized";
+    context: "{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize";
+}>;
+/** The three classes, as a type. */
+export type DenyError = (typeof DENY_ERROR)[keyof typeof DENY_ERROR];
+/** The emitted object — exactly the shape the schema describes. */
+export interface DenyRemedy {
+    error: DenyError;
+    target: string | null;
+    fingerprint: string | null;
+    action_required: {
+        tool: 'preflight_change_set';
+        mode: 'authorize';
+        args_shape: Record<string, string>;
+    };
+    does_not_promise: string;
+    observed?: Record<string, unknown>;
+}
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+export declare function buildDenyRemedy({ error, target, fingerprint, observed }: {
+    error: DenyError | null;
+    target?: string | null;
+    fingerprint?: string | null;
+    observed?: Record<string, unknown> | null;
+}): DenyRemedy | null;
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+export declare function denyErrorForReason(reason: unknown): DenyError | null;
+//# sourceMappingURL=deny-remedy.d.ts.map

package/dist/cjs/deny-remedy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.d.ts","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,8DAA8D,CAAC;AAE5F,eAAO,MAAM,UAAU;;;EAGrB,CAAC;AAIH,oCAAoC;AACpC,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACzG,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAa,EAAE,WAAkB,EAAE,QAAe,EAAE,EAAE;IAC7D,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,GACA,UAAU,GAAG,IAAI,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CA+CpE"}

package/dist/cjs/deny-remedy.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARGS_SHAPE = exports.DOES_NOT_PROMISE = exports.DENY_ERROR = void 0;
+exports.buildDenyRemedy = buildDenyRemedy;
+exports.denyErrorForReason = denyErrorForReason;
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+exports.DENY_ERROR = Object.freeze({
+    GRANT_REQUIRED: 'CODERIFTS_GRANT_REQUIRED',
+    GRANT_INVALID: 'CODERIFTS_GRANT_INVALID',
+    GRANT_MISMATCH: 'CODERIFTS_GRANT_MISMATCH',
+});
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+exports.DOES_NOT_PROMISE = 'a grant does not guarantee execution (CAS may still fail)';
+exports.ARGS_SHAPE = Object.freeze({
+    artifacts: 'Array<{ id, type, before, after }> — the change set being authorized',
+    context: '{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize',
+});
+const FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
+    if (!error || !Object.values(exports.DENY_ERROR).includes(error))
+        return null;
+    const remedy = {
+        error,
+        // Null, never a wildcard: a surface that cannot name what it refused must
+        // not emit a value a reader could take for "everything".
+        target: typeof target === 'string' && target.length > 0 ? target : null,
+        // Only a well-formed fingerprint. A malformed one is dropped rather than
+        // passed through, because a caller comparing it would get a false mismatch.
+        fingerprint: typeof fingerprint === 'string' && FINGERPRINT_RE.test(fingerprint)
+            ? fingerprint
+            : null,
+        action_required: {
+            tool: 'preflight_change_set',
+            mode: 'authorize',
+            args_shape: { ...exports.ARGS_SHAPE },
+        },
+        does_not_promise: exports.DOES_NOT_PROMISE,
+    };
+    if (observed && typeof observed === 'object')
+        remedy.observed = observed;
+    return remedy;
+}
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+function denyErrorForReason(reason) {
+    switch (String(reason || '').toLowerCase()) {
+        // Nothing was presented.
+        case 'receipt_missing':
+        case 'missing_receipt':
+        case 'missing_grant_header':
+        case 'decision_missing':
+        case 'missing_decision_result':
+        case 'no_preflight_response':
+        case 'grant_not_supplied':
+            return exports.DENY_ERROR.GRANT_REQUIRED;
+        // Something was presented and did not hold up.
+        case 'receipt_invalid':
+        case 'receipt_unverified':
+        case 'invalid_signature':
+        case 'unknown_key':
+        case 'unknown_kid':
+        case 'dsse_malformed':
+        case 'dsse_unsupported':
+        case 'dsse_predicate_mismatch':
+        case 'malformed':
+        case 'grant_malformed':
+        case 'grant_unverified':
+        case 'grant_expired':
+            return exports.DENY_ERROR.GRANT_INVALID;
+        // It held up, but it is not about this request.
+        case 'scope_mismatch':
+        case 'target_mismatch':
+        case 'operation_mismatch':
+        case 'grant_scope_mismatch':
+        case 'mode_mismatch':
+        case 'repo_mismatch':
+        case 'base_mismatch':
+        case 'head_mismatch':
+        case 'grant_does_not_cover_path':
+        case 'grant_bound_elsewhere':
+        case 'receipt_envelope_mismatch':
+        case 'artifact_mismatch':
+        case 'grant_unbound':
+        case 'grant_wrong_audience':
+            return exports.DENY_ERROR.GRANT_MISMATCH;
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=deny-remedy.js.map

package/dist/cjs/deny-remedy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.js","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":";;;AA+DA,0CA6BC;AAQD,gDA+CC;AAnJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACzB,QAAA,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,0BAA0B;IAC1C,aAAa,EAAE,yBAAyB;IACxC,cAAc,EAAE,0BAA0B;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AACjE,QAAA,gBAAgB,GAAG,2DAA2D,CAAC;AAE/E,QAAA,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,sEAAsE;IACjF,OAAO,EAAE,wGAAwG;CAClH,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAe/C;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAK1D;IAED,IAAI,CAAC,KAAK,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,kBAAU,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpF,MAAM,MAAM,GAAe;QACzB,KAAK;QACL,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;QACR,eAAe,EAAE;YACf,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,GAAG,kBAAU,EAAE;SAC9B;QACD,gBAAgB,EAAE,wBAAgB;KACnC,CAAC;IACF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAe;IAChD,QAAQ,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3C,yBAAyB;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,oBAAoB;YACvB,OAAO,kBAAU,CAAC,cAAc,CAAC;QAEnC,+CAA+C;QAC/C,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,kBAAU,CAAC,aAAa,CAAC;QAElC,gDAAgD;QAChD,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,2BAA2B,CAAC;QACjC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,2BAA2B,CAAC;QACjC,KAAK,mBAAmB,CAAC;QACzB,KAAK,eAAe,CAAC;QACrB,KAAK,sBAAsB;YACzB,OAAO,kBAAU,CAAC,cAAc,CAAC;QAEnC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/cjs/deploy-gate.d.ts

@@ -59,7 +59,20 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
  * guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
  * it" ≠ "verification says no".
  */
- | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
+ | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key'
+/**
+ * The registry has withdrawn this key: status `revoked`, or a `revoked_at`
+ * timestamp on the entry. Distinct from retired_key, which is a planned
+ * rotation whose pre-rotation receipts stay meaningful. NOT repairable by
+ * re-requesting a receipt — the same key would sign it.
+ */
+ | 'revoked_key'
+/**
+ * The registry carries a key status this verifier does not understand. Fails
+ * closed rather than reading it as healthy: an unrecognised status is more
+ * likely a withdrawal we cannot parse than a permission we should grant.
+ */
+ | 'unknown_key_status';
 /** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
 export type DeployTarget = {
     environment: string;

package/dist/cjs/deploy-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa;AACf;;;;;GAKG;GACD,aAAa;AACf;;;;GAIG;GACD,oBAAoB,CAAC;AAEzB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}

package/dist/cjs/deploy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAsGH,kEAUC;AAED,kEAIC;AA6GD,gCAqJC;AArXD,uEAGmC;AAKnC;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAmHH,kEAUC;AAED,kEAIC;AA6GD,gCAqJC;AAlYD,uEAGmC;AAKnC;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAkG1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/cjs/deploy-receipt-token.d.ts

@@ -36,7 +36,7 @@ export type DeployTokenReceipt = {
     /** Air-gap single PEM (kid-agnostic). */
     pinnedKeyPem?: string;
 };
-export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
+export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION' | 'KEY_REVOKED' | 'REVOKED_KEY' | 'REVOKED_KEY_UNDECIDABLE' | 'KEY_RETIRED_AFTER_SIGNING' | 'UNKNOWN_KEY_STATUS';
 export type DeployTokenVerifyResult = {
     valid: boolean;
     status: DeployTokenVerifyStatus;
@@ -46,7 +46,7 @@ export type DeployTokenVerifyResult = {
     denyReason: string | null;
     payload?: Record<string, unknown>;
     view: TokenDerivedReceiptView | null;
-    key_status: 'active' | 'retired' | null;
+    key_status: 'active' | 'retired' | 'revoked' | 'unknown' | null;
 };
 /**
  * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).

package/dist/cjs/deploy-receipt-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}
+{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,GAGrB,aAAa,GACb,aAAa,GACb,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CACjE,CAAC;AA2LF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA0IzB"}

package/dist/cjs/deploy-receipt-token.js

@@ -36,6 +36,48 @@ function reconstructInput(payload) {
     }
     return v1;
 }
+/**
+ * The key-withdrawal half of the published verifier's status taxonomy
+ * (`receipt-verifier/verify.js` deriveStatus, RECEIPT_FORMAT.md §7.1),
+ * transliterated. Returns the refusal status, or null to continue.
+ *
+ * Order matters and matches the reference: an unknown status fails closed before
+ * anything else is read; `revoked_at` kills the whole key history because the
+ * attacker chooses `ts`; `retired_at` only rejects receipts signed at or after
+ * it. A revoked key is never valid — UNDECIDABLE is not a softer accept, it
+ * reports that a legitimate pre-compromise receipt cannot be told apart from a
+ * backdated forgery.
+ *
+ * Kept as a small local function rather than a shared import: this package ships
+ * pure and dependency-light, and the reference core is CommonJS with a CLI and
+ * `fs` at module scope. `test/vendor-core.test.js` pins agreement with a
+ * byte-identical copy of that core, so the two cannot drift silently.
+ */
+function deriveKeyWithdrawalStatus(ts, keyMeta) {
+    const KNOWN_STATUSES = ['active', 'retired', 'revoked', null];
+    if (!KNOWN_STATUSES.includes(keyMeta.status))
+        return 'UNKNOWN_KEY_STATUS';
+    if (typeof keyMeta.revoked_at === 'string' && keyMeta.revoked_at.length > 0)
+        return 'KEY_REVOKED';
+    if (typeof keyMeta.retired_at === 'string' && keyMeta.retired_at.length > 0 && ts) {
+        const issued = Date.parse(ts);
+        const retired = Date.parse(keyMeta.retired_at);
+        if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
+            return 'KEY_RETIRED_AFTER_SIGNING';
+        }
+    }
+    if (keyMeta.status === 'revoked') {
+        const at = keyMeta.compromised_at;
+        if (typeof at !== 'string' || at.length === 0)
+            return 'REVOKED_KEY_UNDECIDABLE';
+        const boundary = Date.parse(at);
+        const issued = typeof ts === 'string' ? Date.parse(ts) : NaN;
+        if (!Number.isFinite(boundary) || !Number.isFinite(issued))
+            return 'REVOKED_KEY_UNDECIDABLE';
+        return issued >= boundary ? 'REVOKED_KEY' : 'REVOKED_KEY_UNDECIDABLE';
+    }
+    return null;
+}
 function isIssueTimeWithinKeyWindow(ts, keyMeta) {
     if (!keyMeta || keyMeta.status === 'active')
         return true;
@@ -60,6 +102,12 @@ function isIssueTimeWithinKeyWindow(ts, keyMeta) {
         return false;
     return true;
 }
+function optionalString(source, field) {
+    if (!source || typeof source !== 'object')
+        return null;
+    const v = source[field];
+    return typeof v === 'string' && v.length > 0 ? v : null;
+}
 function resolveKey(kid, registry, pinnedKeyPem) {
     if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
         try {
@@ -68,6 +116,8 @@ function resolveKey(kid, registry, pinnedKeyPem) {
                 status: 'active',
                 valid_from: null,
                 retired_at: null,
+                revoked_at: null,
+                compromised_at: null,
             };
         }
         catch {
@@ -83,9 +133,11 @@ function resolveKey(kid, registry, pinnedKeyPem) {
     try {
         return {
             publicKey: (0, node_crypto_1.createPublicKey)(entry.public_key_pem),
-            status: entry.status === 'retired' ? 'retired' : 'active',
+            status: typeof entry.status === 'string' ? entry.status : null,
             valid_from: entry.valid_from || null,
             retired_at: entry.retired_at || null,
+            revoked_at: optionalString(entry, 'revoked_at'),
+            compromised_at: optionalString(entry, 'compromised_at'),
         };
     }
     catch {
@@ -168,6 +220,17 @@ function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
         }
     }
+    // A key the registry has withdrawn is judged BEFORE any authorization path.
+    // The signature verified — that is precisely the problem a withdrawal exists
+    // to answer, and no timestamp on a receipt the attacker minted may rehabilitate it.
+    const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === 'string' ? payload.ts : undefined, resolved);
+    if (withdrawn) {
+        return fail(withdrawn, withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown_key_status' : 'revoked_key', {
+            payload,
+            authz_reason: withdrawn.toLowerCase(),
+            key_status: withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown' : 'revoked',
+        });
+    }
     if (resolved.status === 'retired') {
         if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });