@coderifts/agent-guard 14.1.0 → 15.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/atomic-profile.d.ts +16 -7
- package/dist/cjs/atomic-profile.d.ts.map +1 -1
- package/dist/cjs/atomic-profile.js +18 -7
- package/dist/cjs/atomic-profile.js.map +1 -1
- package/dist/cjs/deny-remedy.d.ts +74 -0
- package/dist/cjs/deny-remedy.d.ts.map +1 -0
- package/dist/cjs/deny-remedy.js +127 -0
- package/dist/cjs/deny-remedy.js.map +1 -0
- package/dist/cjs/deploy-gate.d.ts +14 -1
- package/dist/cjs/deploy-gate.d.ts.map +1 -1
- package/dist/cjs/deploy-gate.js.map +1 -1
- package/dist/cjs/deploy-receipt-token.d.ts +2 -2
- package/dist/cjs/deploy-receipt-token.d.ts.map +1 -1
- package/dist/cjs/deploy-receipt-token.js +64 -1
- package/dist/cjs/deploy-receipt-token.js.map +1 -1
- package/dist/cjs/execution-grant.d.ts +100 -0
- package/dist/cjs/execution-grant.d.ts.map +1 -1
- package/dist/cjs/execution-grant.js +101 -0
- package/dist/cjs/execution-grant.js.map +1 -1
- package/dist/cjs/guard.d.ts.map +1 -1
- package/dist/cjs/guard.js +56 -8
- package/dist/cjs/guard.js.map +1 -1
- package/dist/cjs/policy.d.ts.map +1 -1
- package/dist/cjs/policy.js +1 -1
- package/dist/cjs/policy.js.map +1 -1
- package/dist/cjs/posture-receipt.d.ts +39 -0
- package/dist/cjs/posture-receipt.d.ts.map +1 -1
- package/dist/cjs/posture-receipt.js +39 -0
- package/dist/cjs/posture-receipt.js.map +1 -1
- package/dist/cjs/types.d.ts +23 -0
- package/dist/cjs/types.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.d.ts +15 -0
- package/dist/cjs/with-coderifts.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.js +18 -3
- package/dist/cjs/with-coderifts.js.map +1 -1
- package/dist/esm/atomic-profile.d.ts +16 -7
- package/dist/esm/atomic-profile.d.ts.map +1 -1
- package/dist/esm/atomic-profile.js +18 -7
- package/dist/esm/atomic-profile.js.map +1 -1
- package/dist/esm/deny-remedy.d.ts +74 -0
- package/dist/esm/deny-remedy.d.ts.map +1 -0
- package/dist/esm/deny-remedy.js +122 -0
- package/dist/esm/deny-remedy.js.map +1 -0
- package/dist/esm/deploy-gate.d.ts +14 -1
- package/dist/esm/deploy-gate.d.ts.map +1 -1
- package/dist/esm/deploy-gate.js.map +1 -1
- package/dist/esm/deploy-receipt-token.d.ts +2 -2
- package/dist/esm/deploy-receipt-token.d.ts.map +1 -1
- package/dist/esm/deploy-receipt-token.js +64 -1
- package/dist/esm/deploy-receipt-token.js.map +1 -1
- package/dist/esm/execution-grant.d.ts +100 -0
- package/dist/esm/execution-grant.d.ts.map +1 -1
- package/dist/esm/execution-grant.js +98 -0
- package/dist/esm/execution-grant.js.map +1 -1
- package/dist/esm/guard.d.ts.map +1 -1
- package/dist/esm/guard.js +57 -9
- package/dist/esm/guard.js.map +1 -1
- package/dist/esm/policy.d.ts.map +1 -1
- package/dist/esm/policy.js +1 -1
- package/dist/esm/policy.js.map +1 -1
- package/dist/esm/posture-receipt.d.ts +39 -0
- package/dist/esm/posture-receipt.d.ts.map +1 -1
- package/dist/esm/posture-receipt.js +39 -0
- package/dist/esm/posture-receipt.js.map +1 -1
- package/dist/esm/types.d.ts +23 -0
- package/dist/esm/types.d.ts.map +1 -1
- package/dist/esm/with-coderifts.d.ts +15 -0
- package/dist/esm/with-coderifts.d.ts.map +1 -1
- package/dist/esm/with-coderifts.js +18 -3
- package/dist/esm/with-coderifts.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* deny-remedy.v1 — the machine-readable next step attached to a refusal.
|
|
3
|
+
*
|
|
4
|
+
* CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
|
|
5
|
+
* sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
|
|
6
|
+
*
|
|
7
|
+
* This builder is the TypeScript transliteration of the copy carried by the
|
|
8
|
+
* JavaScript deny surfaces — same three classes, same refusal to invent a
|
|
9
|
+
* fourth, same schema. It is a copy rather than a shared package on purpose:
|
|
10
|
+
* these repos are installed independently and a shared
|
|
11
|
+
* dependency would make one of them unable to refuse a request because another
|
|
12
|
+
* failed to resolve.
|
|
13
|
+
*
|
|
14
|
+
* WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
|
|
15
|
+
* never inside verification. Nothing here reads a key, checks a signature, or
|
|
16
|
+
* can change allow into deny. A surface that emits a remedy has already refused.
|
|
17
|
+
*
|
|
18
|
+
* WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
|
|
19
|
+
* whose reason does not map to one of them gets NO remedy — an unmapped reason
|
|
20
|
+
* is a refusal we cannot yet describe as a next step, and inventing a fourth
|
|
21
|
+
* class, or defaulting to the nearest one, would send a caller to a step that
|
|
22
|
+
* does not address why they were refused.
|
|
23
|
+
*/
|
|
24
|
+
/** The closed set from the schema. */
|
|
25
|
+
export declare const DENY_ERROR: Readonly<{
|
|
26
|
+
GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED";
|
|
27
|
+
GRANT_INVALID: "CODERIFTS_GRANT_INVALID";
|
|
28
|
+
GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH";
|
|
29
|
+
}>;
|
|
30
|
+
/** Carried verbatim from the schema so it cannot be softened in rendering. */
|
|
31
|
+
export declare const DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
|
|
32
|
+
export declare const ARGS_SHAPE: Readonly<{
|
|
33
|
+
artifacts: "Array<{ id, type, before, after }> — the change set being authorized";
|
|
34
|
+
context: "{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize";
|
|
35
|
+
}>;
|
|
36
|
+
/** The three classes, as a type. */
|
|
37
|
+
export type DenyError = (typeof DENY_ERROR)[keyof typeof DENY_ERROR];
|
|
38
|
+
/** The emitted object — exactly the shape the schema describes. */
|
|
39
|
+
export interface DenyRemedy {
|
|
40
|
+
error: DenyError;
|
|
41
|
+
target: string | null;
|
|
42
|
+
fingerprint: string | null;
|
|
43
|
+
action_required: {
|
|
44
|
+
tool: 'preflight_change_set';
|
|
45
|
+
mode: 'authorize';
|
|
46
|
+
args_shape: Record<string, string>;
|
|
47
|
+
};
|
|
48
|
+
does_not_promise: string;
|
|
49
|
+
observed?: Record<string, unknown>;
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Build the remedy object, or return null when this refusal has no remedy.
|
|
53
|
+
*
|
|
54
|
+
* @param {string} o.error one of DENY_ERROR; anything else returns null
|
|
55
|
+
* @param {string} [o.target] the surface's own addressing for what was refused
|
|
56
|
+
* @param {string} [o.fingerprint] the change-set fingerprint the deny was evaluated
|
|
57
|
+
* against, when the surface has one
|
|
58
|
+
* @param {object} [o.observed] free-form, for an operator reading a log
|
|
59
|
+
* @returns {object|null}
|
|
60
|
+
*/
|
|
61
|
+
export declare function buildDenyRemedy({ error, target, fingerprint, observed }: {
|
|
62
|
+
error: DenyError | null;
|
|
63
|
+
target?: string | null;
|
|
64
|
+
fingerprint?: string | null;
|
|
65
|
+
observed?: Record<string, unknown> | null;
|
|
66
|
+
}): DenyRemedy | null;
|
|
67
|
+
/**
|
|
68
|
+
* Map a surface's own refusal reason to an error class.
|
|
69
|
+
*
|
|
70
|
+
* The mapping is explicit and closed. An unlisted reason returns null, which
|
|
71
|
+
* means no remedy — see the note at the top of this file.
|
|
72
|
+
*/
|
|
73
|
+
export declare function denyErrorForReason(reason: unknown): DenyError | null;
|
|
74
|
+
//# sourceMappingURL=deny-remedy.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deny-remedy.d.ts","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,8DAA8D,CAAC;AAE5F,eAAO,MAAM,UAAU;;;EAGrB,CAAC;AAIH,oCAAoC;AACpC,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACzG,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAa,EAAE,WAAkB,EAAE,QAAe,EAAE,EAAE;IAC7D,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,GACA,UAAU,GAAG,IAAI,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CA+CpE"}
|
|
@@ -0,0 +1,122 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* deny-remedy.v1 — the machine-readable next step attached to a refusal.
|
|
3
|
+
*
|
|
4
|
+
* CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
|
|
5
|
+
* sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
|
|
6
|
+
*
|
|
7
|
+
* This builder is the TypeScript transliteration of the copy carried by the
|
|
8
|
+
* JavaScript deny surfaces — same three classes, same refusal to invent a
|
|
9
|
+
* fourth, same schema. It is a copy rather than a shared package on purpose:
|
|
10
|
+
* these repos are installed independently and a shared
|
|
11
|
+
* dependency would make one of them unable to refuse a request because another
|
|
12
|
+
* failed to resolve.
|
|
13
|
+
*
|
|
14
|
+
* WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
|
|
15
|
+
* never inside verification. Nothing here reads a key, checks a signature, or
|
|
16
|
+
* can change allow into deny. A surface that emits a remedy has already refused.
|
|
17
|
+
*
|
|
18
|
+
* WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
|
|
19
|
+
* whose reason does not map to one of them gets NO remedy — an unmapped reason
|
|
20
|
+
* is a refusal we cannot yet describe as a next step, and inventing a fourth
|
|
21
|
+
* class, or defaulting to the nearest one, would send a caller to a step that
|
|
22
|
+
* does not address why they were refused.
|
|
23
|
+
*/
|
|
24
|
+
/** The closed set from the schema. */
|
|
25
|
+
export const DENY_ERROR = Object.freeze({
|
|
26
|
+
GRANT_REQUIRED: 'CODERIFTS_GRANT_REQUIRED',
|
|
27
|
+
GRANT_INVALID: 'CODERIFTS_GRANT_INVALID',
|
|
28
|
+
GRANT_MISMATCH: 'CODERIFTS_GRANT_MISMATCH',
|
|
29
|
+
});
|
|
30
|
+
/** Carried verbatim from the schema so it cannot be softened in rendering. */
|
|
31
|
+
export const DOES_NOT_PROMISE = 'a grant does not guarantee execution (CAS may still fail)';
|
|
32
|
+
export const ARGS_SHAPE = Object.freeze({
|
|
33
|
+
artifacts: 'Array<{ id, type, before, after }> — the change set being authorized',
|
|
34
|
+
context: '{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize',
|
|
35
|
+
});
|
|
36
|
+
const FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
|
|
37
|
+
/**
|
|
38
|
+
* Build the remedy object, or return null when this refusal has no remedy.
|
|
39
|
+
*
|
|
40
|
+
* @param {string} o.error one of DENY_ERROR; anything else returns null
|
|
41
|
+
* @param {string} [o.target] the surface's own addressing for what was refused
|
|
42
|
+
* @param {string} [o.fingerprint] the change-set fingerprint the deny was evaluated
|
|
43
|
+
* against, when the surface has one
|
|
44
|
+
* @param {object} [o.observed] free-form, for an operator reading a log
|
|
45
|
+
* @returns {object|null}
|
|
46
|
+
*/
|
|
47
|
+
export function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
|
|
48
|
+
if (!error || !Object.values(DENY_ERROR).includes(error))
|
|
49
|
+
return null;
|
|
50
|
+
const remedy = {
|
|
51
|
+
error,
|
|
52
|
+
// Null, never a wildcard: a surface that cannot name what it refused must
|
|
53
|
+
// not emit a value a reader could take for "everything".
|
|
54
|
+
target: typeof target === 'string' && target.length > 0 ? target : null,
|
|
55
|
+
// Only a well-formed fingerprint. A malformed one is dropped rather than
|
|
56
|
+
// passed through, because a caller comparing it would get a false mismatch.
|
|
57
|
+
fingerprint: typeof fingerprint === 'string' && FINGERPRINT_RE.test(fingerprint)
|
|
58
|
+
? fingerprint
|
|
59
|
+
: null,
|
|
60
|
+
action_required: {
|
|
61
|
+
tool: 'preflight_change_set',
|
|
62
|
+
mode: 'authorize',
|
|
63
|
+
args_shape: { ...ARGS_SHAPE },
|
|
64
|
+
},
|
|
65
|
+
does_not_promise: DOES_NOT_PROMISE,
|
|
66
|
+
};
|
|
67
|
+
if (observed && typeof observed === 'object')
|
|
68
|
+
remedy.observed = observed;
|
|
69
|
+
return remedy;
|
|
70
|
+
}
|
|
71
|
+
/**
|
|
72
|
+
* Map a surface's own refusal reason to an error class.
|
|
73
|
+
*
|
|
74
|
+
* The mapping is explicit and closed. An unlisted reason returns null, which
|
|
75
|
+
* means no remedy — see the note at the top of this file.
|
|
76
|
+
*/
|
|
77
|
+
export function denyErrorForReason(reason) {
|
|
78
|
+
switch (String(reason || '').toLowerCase()) {
|
|
79
|
+
// Nothing was presented.
|
|
80
|
+
case 'receipt_missing':
|
|
81
|
+
case 'missing_receipt':
|
|
82
|
+
case 'missing_grant_header':
|
|
83
|
+
case 'decision_missing':
|
|
84
|
+
case 'missing_decision_result':
|
|
85
|
+
case 'no_preflight_response':
|
|
86
|
+
case 'grant_not_supplied':
|
|
87
|
+
return DENY_ERROR.GRANT_REQUIRED;
|
|
88
|
+
// Something was presented and did not hold up.
|
|
89
|
+
case 'receipt_invalid':
|
|
90
|
+
case 'receipt_unverified':
|
|
91
|
+
case 'invalid_signature':
|
|
92
|
+
case 'unknown_key':
|
|
93
|
+
case 'unknown_kid':
|
|
94
|
+
case 'dsse_malformed':
|
|
95
|
+
case 'dsse_unsupported':
|
|
96
|
+
case 'dsse_predicate_mismatch':
|
|
97
|
+
case 'malformed':
|
|
98
|
+
case 'grant_malformed':
|
|
99
|
+
case 'grant_unverified':
|
|
100
|
+
case 'grant_expired':
|
|
101
|
+
return DENY_ERROR.GRANT_INVALID;
|
|
102
|
+
// It held up, but it is not about this request.
|
|
103
|
+
case 'scope_mismatch':
|
|
104
|
+
case 'target_mismatch':
|
|
105
|
+
case 'operation_mismatch':
|
|
106
|
+
case 'grant_scope_mismatch':
|
|
107
|
+
case 'mode_mismatch':
|
|
108
|
+
case 'repo_mismatch':
|
|
109
|
+
case 'base_mismatch':
|
|
110
|
+
case 'head_mismatch':
|
|
111
|
+
case 'grant_does_not_cover_path':
|
|
112
|
+
case 'grant_bound_elsewhere':
|
|
113
|
+
case 'receipt_envelope_mismatch':
|
|
114
|
+
case 'artifact_mismatch':
|
|
115
|
+
case 'grant_unbound':
|
|
116
|
+
case 'grant_wrong_audience':
|
|
117
|
+
return DENY_ERROR.GRANT_MISMATCH;
|
|
118
|
+
default:
|
|
119
|
+
return null;
|
|
120
|
+
}
|
|
121
|
+
}
|
|
122
|
+
//# sourceMappingURL=deny-remedy.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deny-remedy.js","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,0BAA0B;IAC1C,aAAa,EAAE,yBAAyB;IACxC,cAAc,EAAE,0BAA0B;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2DAA2D,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,sEAAsE;IACjF,OAAO,EAAE,wGAAwG;CAClH,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAe/C;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAK1D;IAED,IAAI,CAAC,KAAK,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpF,MAAM,MAAM,GAAe;QACzB,KAAK;QACL,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;QACR,eAAe,EAAE;YACf,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE;SAC9B;QACD,gBAAgB,EAAE,gBAAgB;KACnC,CAAC;IACF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,QAAQ,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3C,yBAAyB;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,oBAAoB;YACvB,OAAO,UAAU,CAAC,cAAc,CAAC;QAEnC,+CAA+C;QAC/C,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,UAAU,CAAC,aAAa,CAAC;QAElC,gDAAgD;QAChD,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,2BAA2B,CAAC;QACjC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,2BAA2B,CAAC;QACjC,KAAK,mBAAmB,CAAC;QACzB,KAAK,eAAe,CAAC;QACrB,KAAK,sBAAsB;YACzB,OAAO,UAAU,CAAC,cAAc,CAAC;QAEnC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
|
|
@@ -59,7 +59,20 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
|
|
|
59
59
|
* guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
|
|
60
60
|
* it" ≠ "verification says no".
|
|
61
61
|
*/
|
|
62
|
-
| 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key'
|
|
62
|
+
| 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key'
|
|
63
|
+
/**
|
|
64
|
+
* The registry has withdrawn this key: status `revoked`, or a `revoked_at`
|
|
65
|
+
* timestamp on the entry. Distinct from retired_key, which is a planned
|
|
66
|
+
* rotation whose pre-rotation receipts stay meaningful. NOT repairable by
|
|
67
|
+
* re-requesting a receipt — the same key would sign it.
|
|
68
|
+
*/
|
|
69
|
+
| 'revoked_key'
|
|
70
|
+
/**
|
|
71
|
+
* The registry carries a key status this verifier does not understand. Fails
|
|
72
|
+
* closed rather than reading it as healthy: an unrecognised status is more
|
|
73
|
+
* likely a withdrawal we cannot parse than a permission we should grant.
|
|
74
|
+
*/
|
|
75
|
+
| 'unknown_key_status';
|
|
63
76
|
/** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
|
|
64
77
|
export type DeployTarget = {
|
|
65
78
|
environment: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa;AACf;;;;;GAKG;GACD,aAAa;AACf;;;;GAIG;GACD,oBAAoB,CAAC;AAEzB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EACL,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAKnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EACL,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAKnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAiC,CAAC;AAkG1E,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,wBAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,wBAAwB,CAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}
|
|
@@ -36,7 +36,7 @@ export type DeployTokenReceipt = {
|
|
|
36
36
|
/** Air-gap single PEM (kid-agnostic). */
|
|
37
37
|
pinnedKeyPem?: string;
|
|
38
38
|
};
|
|
39
|
-
export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
|
|
39
|
+
export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION' | 'KEY_REVOKED' | 'REVOKED_KEY' | 'REVOKED_KEY_UNDECIDABLE' | 'KEY_RETIRED_AFTER_SIGNING' | 'UNKNOWN_KEY_STATUS';
|
|
40
40
|
export type DeployTokenVerifyResult = {
|
|
41
41
|
valid: boolean;
|
|
42
42
|
status: DeployTokenVerifyStatus;
|
|
@@ -46,7 +46,7 @@ export type DeployTokenVerifyResult = {
|
|
|
46
46
|
denyReason: string | null;
|
|
47
47
|
payload?: Record<string, unknown>;
|
|
48
48
|
view: TokenDerivedReceiptView | null;
|
|
49
|
-
key_status: 'active' | 'retired' | null;
|
|
49
|
+
key_status: 'active' | 'retired' | 'revoked' | 'unknown' | null;
|
|
50
50
|
};
|
|
51
51
|
/**
|
|
52
52
|
* Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,GAGrB,aAAa,GACb,aAAa,GACb,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CACjE,CAAC;AA2LF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA0IzB"}
|
|
@@ -32,6 +32,48 @@ function reconstructInput(payload) {
|
|
|
32
32
|
}
|
|
33
33
|
return v1;
|
|
34
34
|
}
|
|
35
|
+
/**
|
|
36
|
+
* The key-withdrawal half of the published verifier's status taxonomy
|
|
37
|
+
* (`receipt-verifier/verify.js` deriveStatus, RECEIPT_FORMAT.md §7.1),
|
|
38
|
+
* transliterated. Returns the refusal status, or null to continue.
|
|
39
|
+
*
|
|
40
|
+
* Order matters and matches the reference: an unknown status fails closed before
|
|
41
|
+
* anything else is read; `revoked_at` kills the whole key history because the
|
|
42
|
+
* attacker chooses `ts`; `retired_at` only rejects receipts signed at or after
|
|
43
|
+
* it. A revoked key is never valid — UNDECIDABLE is not a softer accept, it
|
|
44
|
+
* reports that a legitimate pre-compromise receipt cannot be told apart from a
|
|
45
|
+
* backdated forgery.
|
|
46
|
+
*
|
|
47
|
+
* Kept as a small local function rather than a shared import: this package ships
|
|
48
|
+
* pure and dependency-light, and the reference core is CommonJS with a CLI and
|
|
49
|
+
* `fs` at module scope. `test/vendor-core.test.js` pins agreement with a
|
|
50
|
+
* byte-identical copy of that core, so the two cannot drift silently.
|
|
51
|
+
*/
|
|
52
|
+
function deriveKeyWithdrawalStatus(ts, keyMeta) {
|
|
53
|
+
const KNOWN_STATUSES = ['active', 'retired', 'revoked', null];
|
|
54
|
+
if (!KNOWN_STATUSES.includes(keyMeta.status))
|
|
55
|
+
return 'UNKNOWN_KEY_STATUS';
|
|
56
|
+
if (typeof keyMeta.revoked_at === 'string' && keyMeta.revoked_at.length > 0)
|
|
57
|
+
return 'KEY_REVOKED';
|
|
58
|
+
if (typeof keyMeta.retired_at === 'string' && keyMeta.retired_at.length > 0 && ts) {
|
|
59
|
+
const issued = Date.parse(ts);
|
|
60
|
+
const retired = Date.parse(keyMeta.retired_at);
|
|
61
|
+
if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
|
|
62
|
+
return 'KEY_RETIRED_AFTER_SIGNING';
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
if (keyMeta.status === 'revoked') {
|
|
66
|
+
const at = keyMeta.compromised_at;
|
|
67
|
+
if (typeof at !== 'string' || at.length === 0)
|
|
68
|
+
return 'REVOKED_KEY_UNDECIDABLE';
|
|
69
|
+
const boundary = Date.parse(at);
|
|
70
|
+
const issued = typeof ts === 'string' ? Date.parse(ts) : NaN;
|
|
71
|
+
if (!Number.isFinite(boundary) || !Number.isFinite(issued))
|
|
72
|
+
return 'REVOKED_KEY_UNDECIDABLE';
|
|
73
|
+
return issued >= boundary ? 'REVOKED_KEY' : 'REVOKED_KEY_UNDECIDABLE';
|
|
74
|
+
}
|
|
75
|
+
return null;
|
|
76
|
+
}
|
|
35
77
|
function isIssueTimeWithinKeyWindow(ts, keyMeta) {
|
|
36
78
|
if (!keyMeta || keyMeta.status === 'active')
|
|
37
79
|
return true;
|
|
@@ -56,6 +98,12 @@ function isIssueTimeWithinKeyWindow(ts, keyMeta) {
|
|
|
56
98
|
return false;
|
|
57
99
|
return true;
|
|
58
100
|
}
|
|
101
|
+
function optionalString(source, field) {
|
|
102
|
+
if (!source || typeof source !== 'object')
|
|
103
|
+
return null;
|
|
104
|
+
const v = source[field];
|
|
105
|
+
return typeof v === 'string' && v.length > 0 ? v : null;
|
|
106
|
+
}
|
|
59
107
|
function resolveKey(kid, registry, pinnedKeyPem) {
|
|
60
108
|
if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
|
|
61
109
|
try {
|
|
@@ -64,6 +112,8 @@ function resolveKey(kid, registry, pinnedKeyPem) {
|
|
|
64
112
|
status: 'active',
|
|
65
113
|
valid_from: null,
|
|
66
114
|
retired_at: null,
|
|
115
|
+
revoked_at: null,
|
|
116
|
+
compromised_at: null,
|
|
67
117
|
};
|
|
68
118
|
}
|
|
69
119
|
catch {
|
|
@@ -79,9 +129,11 @@ function resolveKey(kid, registry, pinnedKeyPem) {
|
|
|
79
129
|
try {
|
|
80
130
|
return {
|
|
81
131
|
publicKey: createPublicKey(entry.public_key_pem),
|
|
82
|
-
status: entry.status === '
|
|
132
|
+
status: typeof entry.status === 'string' ? entry.status : null,
|
|
83
133
|
valid_from: entry.valid_from || null,
|
|
84
134
|
retired_at: entry.retired_at || null,
|
|
135
|
+
revoked_at: optionalString(entry, 'revoked_at'),
|
|
136
|
+
compromised_at: optionalString(entry, 'compromised_at'),
|
|
85
137
|
};
|
|
86
138
|
}
|
|
87
139
|
catch {
|
|
@@ -164,6 +216,17 @@ export function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
|
|
|
164
216
|
return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
|
|
165
217
|
}
|
|
166
218
|
}
|
|
219
|
+
// A key the registry has withdrawn is judged BEFORE any authorization path.
|
|
220
|
+
// The signature verified — that is precisely the problem a withdrawal exists
|
|
221
|
+
// to answer, and no timestamp on a receipt the attacker minted may rehabilitate it.
|
|
222
|
+
const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === 'string' ? payload.ts : undefined, resolved);
|
|
223
|
+
if (withdrawn) {
|
|
224
|
+
return fail(withdrawn, withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown_key_status' : 'revoked_key', {
|
|
225
|
+
payload,
|
|
226
|
+
authz_reason: withdrawn.toLowerCase(),
|
|
227
|
+
key_status: withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown' : 'revoked',
|
|
228
|
+
});
|
|
229
|
+
}
|
|
167
230
|
if (resolved.status === 'retired') {
|
|
168
231
|
if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
|
|
169
232
|
return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAevD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAkCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAiF;IAEjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAevD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAyCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,yBAAyB,CAChC,EAAsB,EACtB,OAAyF;IAEzF,MAAM,cAAc,GAAiC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAE1E,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IAElG,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7E,OAAO,2BAA2B,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAC7F,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAwF;IAExF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD,SAAS,cAAc,CAAC,MAAe,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC9D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;YAC/C,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,oFAAoF;IACpF,MAAM,SAAS,GAAG,yBAAyB,CACzC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACvD,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,EAAE;YAChG,OAAO;YACP,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}
|
|
@@ -13,10 +13,110 @@ export type ExecutionGrantConfig = {
|
|
|
13
13
|
}) => string | Promise<string>;
|
|
14
14
|
/** Default 'v1' this wave. ATOMIC construction requires 'v2'. */
|
|
15
15
|
grantVersion?: 'v1' | 'v2';
|
|
16
|
+
/**
|
|
17
|
+
* The V2 binding a grant request should carry (AUDIT P1 / RES-1).
|
|
18
|
+
*
|
|
19
|
+
* MEASURED before adding: the guard's authorize request sent only
|
|
20
|
+
* `include_execution_grant` and `state_nonce`, and the SDK's
|
|
21
|
+
* PreflightChangeSetRequest declares NEITHER these fields NOR `state_nonce` —
|
|
22
|
+
* the guard builds its own request literal and posts it as `unknown`, so the
|
|
23
|
+
* wire shape is guard-local. Adding them here is therefore a guard-side
|
|
24
|
+
* config surface, not a claim that the SDK type endorses them.
|
|
25
|
+
*
|
|
26
|
+
* Every one is OPTIONAL and every one is sent only when set. A deployment
|
|
27
|
+
* that does not configure a field gets it NAMED in the observation's
|
|
28
|
+
* `v2_fields_absent`, never a placeholder on the wire.
|
|
29
|
+
*
|
|
30
|
+
* ── DEPRECATED ALIASES (1198) ────────────────────────────────────────────
|
|
31
|
+
* The canonical home is the TOP LEVEL of the withCodeRifts input, where
|
|
32
|
+
* executorId/adapterId/targetUri already lived before this config existed
|
|
33
|
+
* (with-coderifts.ts:394-396) and where the ATOMIC construction check reads
|
|
34
|
+
* them. Setting them here still works and still reaches the wire — but a
|
|
35
|
+
* value here that DISAGREES with the top level is an initialization error,
|
|
36
|
+
* because the two used to feed different halves of the system with nothing
|
|
37
|
+
* reconciling them. See resolveV2Fields.
|
|
38
|
+
*
|
|
39
|
+
* Unreleased when this was written — added after the 14.1.0 release and never
|
|
40
|
+
* published — so no adopter depends on the nested spelling.
|
|
41
|
+
*/
|
|
42
|
+
executorId?: string;
|
|
43
|
+
adapterId?: string;
|
|
44
|
+
targetUri?: string;
|
|
45
|
+
tenantId?: string;
|
|
46
|
+
policyHash?: string;
|
|
47
|
+
audienceHash?: string;
|
|
16
48
|
};
|
|
49
|
+
/**
|
|
50
|
+
* THE CANONICAL V2 FIELD SET (roadmap 1198).
|
|
51
|
+
*
|
|
52
|
+
* MEASURED SPLIT-BRAIN, which is what this exists to end:
|
|
53
|
+
* · executorId / adapterId / targetUri lived in BOTH the top-level input
|
|
54
|
+
* (with-coderifts.ts:394-396 → the ATOMIC construction check and the
|
|
55
|
+
* posture tuple) and the nested executionGrant config (→ the authorize
|
|
56
|
+
* request). Nothing compared them, so a configuration could bind the
|
|
57
|
+
* profile to one executor and put another — or none — on the wire.
|
|
58
|
+
* · policyHash had a READER and no writer: atomic-profile.ts:247 passes
|
|
59
|
+
* `input.policyHash` to the posture verifier and with-coderifts.ts:911-915
|
|
60
|
+
* never forwarded it, so that binding was permanently undefined.
|
|
61
|
+
* · tenantId / audienceHash existed on the wire side only.
|
|
62
|
+
*
|
|
63
|
+
* This reads both spellings, REFUSES a disagreement, and returns one set that
|
|
64
|
+
* the wire and the profile both use. A field neither side supplies stays
|
|
65
|
+
* genuinely absent — the case 6bca531's named-absent was written for, and now
|
|
66
|
+
* the only case it covers.
|
|
67
|
+
*/
|
|
68
|
+
export declare const V2_FIELD_KEYS: readonly ["executorId", "adapterId", "targetUri", "tenantId", "policyHash", "audienceHash"];
|
|
69
|
+
export type V2FieldKey = typeof V2_FIELD_KEYS[number];
|
|
70
|
+
export type V2Fields = Partial<Record<V2FieldKey, string>>;
|
|
71
|
+
/**
|
|
72
|
+
* Resolve the canonical set from an input carrying either spelling.
|
|
73
|
+
*
|
|
74
|
+
* THROWS on disagreement. Preferring one silently is what produced the split:
|
|
75
|
+
* a caller who set both would have one quietly ignored, with no way to see
|
|
76
|
+
* which one survived.
|
|
77
|
+
*/
|
|
78
|
+
export declare function resolveV2Fields(input?: {
|
|
79
|
+
executorId?: unknown;
|
|
80
|
+
adapterId?: unknown;
|
|
81
|
+
targetUri?: unknown;
|
|
82
|
+
tenantId?: unknown;
|
|
83
|
+
policyHash?: unknown;
|
|
84
|
+
audienceHash?: unknown;
|
|
85
|
+
executionGrant?: ExecutionGrantConfig | null;
|
|
86
|
+
} | null): V2Fields;
|
|
87
|
+
/** The V2 request fields, in the wire spelling. One list, used to send and to report. */
|
|
88
|
+
export declare const V2_WIRE_FIELDS: readonly [readonly ["executor_id", "executorId"], readonly ["adapter_id", "adapterId"], readonly ["target_uri", "targetUri"], readonly ["tenant_id", "tenantId"], readonly ["policy_hash", "policyHash"], readonly ["audience_hash", "audienceHash"]];
|
|
89
|
+
export type V2WireResult = {
|
|
90
|
+
/** Wire-name -> value, for the fields this deployment actually configured. */
|
|
91
|
+
fields: Record<string, string>;
|
|
92
|
+
/** Wire-names this deployment did NOT configure. Named, never placeheld. */
|
|
93
|
+
absent: string[];
|
|
94
|
+
};
|
|
95
|
+
/**
|
|
96
|
+
* Build the V2 field set for an authorize request.
|
|
97
|
+
*
|
|
98
|
+
* V1 sends nothing here: the fields describe a v2 binding, and attaching them
|
|
99
|
+
* to a v1 request would assert a shape the grant does not have.
|
|
100
|
+
*
|
|
101
|
+
* A value that is not a non-empty string is ABSENT, not empty-string-sent. An
|
|
102
|
+
* empty executor_id on the wire is indistinguishable from a real one that
|
|
103
|
+
* happens to be blank, and the server would bind it.
|
|
104
|
+
*/
|
|
105
|
+
export declare function v2WireFields(config: {
|
|
106
|
+
executionGrant?: ExecutionGrantConfig;
|
|
107
|
+
} | null | undefined): V2WireResult;
|
|
17
108
|
export type ExecutionGrantObservation = {
|
|
18
109
|
requested: boolean;
|
|
19
110
|
arrived: boolean;
|
|
111
|
+
/** Which grant shape was requested. */
|
|
112
|
+
grant_version?: 'v1' | 'v2';
|
|
113
|
+
/**
|
|
114
|
+
* The V2 binding this request actually carried, and what it could not.
|
|
115
|
+
* `v2_fields_absent` is the honest half: a field the deployment never
|
|
116
|
+
* configured is reported here rather than sent as an empty placeholder.
|
|
117
|
+
*/
|
|
118
|
+
v2_fields_sent?: string[];
|
|
119
|
+
v2_fields_absent?: string[];
|
|
20
120
|
};
|
|
21
121
|
export type ExecutionGrantCallContext = {
|
|
22
122
|
execution_grant: string | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,6FAEf,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE;IACtC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C,GAAG,IAAI,GAAG,QAAQ,CAiClB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,uPAOhB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG;IACzB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACnE,YAAY,CAiBd;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}
|