@coderifts/agent-guard 14.1.0 → 15.1.0

package/dist/cjs/deny-remedy.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ARGS_SHAPE = exports.DOES_NOT_PROMISE = exports.DENY_ERROR = void 0;
+exports.buildDenyRemedy = buildDenyRemedy;
+exports.denyErrorForReason = denyErrorForReason;
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+exports.DENY_ERROR = Object.freeze({
+    GRANT_REQUIRED: 'CODERIFTS_GRANT_REQUIRED',
+    GRANT_INVALID: 'CODERIFTS_GRANT_INVALID',
+    GRANT_MISMATCH: 'CODERIFTS_GRANT_MISMATCH',
+});
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+exports.DOES_NOT_PROMISE = 'a grant does not guarantee execution (CAS may still fail)';
+exports.ARGS_SHAPE = Object.freeze({
+    artifacts: 'Array<{ id, type, before, after }> — the change set being authorized',
+    context: '{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize',
+});
+const FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
+    if (!error || !Object.values(exports.DENY_ERROR).includes(error))
+        return null;
+    const remedy = {
+        error,
+        // Null, never a wildcard: a surface that cannot name what it refused must
+        // not emit a value a reader could take for "everything".
+        target: typeof target === 'string' && target.length > 0 ? target : null,
+        // Only a well-formed fingerprint. A malformed one is dropped rather than
+        // passed through, because a caller comparing it would get a false mismatch.
+        fingerprint: typeof fingerprint === 'string' && FINGERPRINT_RE.test(fingerprint)
+            ? fingerprint
+            : null,
+        action_required: {
+            tool: 'preflight_change_set',
+            mode: 'authorize',
+            args_shape: { ...exports.ARGS_SHAPE },
+        },
+        does_not_promise: exports.DOES_NOT_PROMISE,
+    };
+    if (observed && typeof observed === 'object')
+        remedy.observed = observed;
+    return remedy;
+}
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+function denyErrorForReason(reason) {
+    switch (String(reason || '').toLowerCase()) {
+        // Nothing was presented.
+        case 'receipt_missing':
+        case 'missing_receipt':
+        case 'missing_grant_header':
+        case 'decision_missing':
+        case 'missing_decision_result':
+        case 'no_preflight_response':
+        case 'grant_not_supplied':
+            return exports.DENY_ERROR.GRANT_REQUIRED;
+        // Something was presented and did not hold up.
+        case 'receipt_invalid':
+        case 'receipt_unverified':
+        case 'invalid_signature':
+        case 'unknown_key':
+        case 'unknown_kid':
+        case 'dsse_malformed':
+        case 'dsse_unsupported':
+        case 'dsse_predicate_mismatch':
+        case 'malformed':
+        case 'grant_malformed':
+        case 'grant_unverified':
+        case 'grant_expired':
+            return exports.DENY_ERROR.GRANT_INVALID;
+        // It held up, but it is not about this request.
+        case 'scope_mismatch':
+        case 'target_mismatch':
+        case 'operation_mismatch':
+        case 'grant_scope_mismatch':
+        case 'mode_mismatch':
+        case 'repo_mismatch':
+        case 'base_mismatch':
+        case 'head_mismatch':
+        case 'grant_does_not_cover_path':
+        case 'grant_bound_elsewhere':
+        case 'receipt_envelope_mismatch':
+        case 'artifact_mismatch':
+        case 'grant_unbound':
+        case 'grant_wrong_audience':
+            return exports.DENY_ERROR.GRANT_MISMATCH;
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=deny-remedy.js.map

package/dist/cjs/deny-remedy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.js","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":";;;AA+DA,0CA6BC;AAQD,gDA+CC;AAnJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACzB,QAAA,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,0BAA0B;IAC1C,aAAa,EAAE,yBAAyB;IACxC,cAAc,EAAE,0BAA0B;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AACjE,QAAA,gBAAgB,GAAG,2DAA2D,CAAC;AAE/E,QAAA,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,sEAAsE;IACjF,OAAO,EAAE,wGAAwG;CAClH,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAe/C;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAK1D;IAED,IAAI,CAAC,KAAK,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,kBAAU,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpF,MAAM,MAAM,GAAe;QACzB,KAAK;QACL,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;QACR,eAAe,EAAE;YACf,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,GAAG,kBAAU,EAAE;SAC9B;QACD,gBAAgB,EAAE,wBAAgB;KACnC,CAAC;IACF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAe;IAChD,QAAQ,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3C,yBAAyB;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,oBAAoB;YACvB,OAAO,kBAAU,CAAC,cAAc,CAAC;QAEnC,+CAA+C;QAC/C,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,kBAAU,CAAC,aAAa,CAAC;QAElC,gDAAgD;QAChD,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,2BAA2B,CAAC;QACjC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,2BAA2B,CAAC;QACjC,KAAK,mBAAmB,CAAC;QACzB,KAAK,eAAe,CAAC;QACrB,KAAK,sBAAsB;YACzB,OAAO,kBAAU,CAAC,cAAc,CAAC;QAEnC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/cjs/deploy-gate.d.ts

@@ -37,6 +37,8 @@ import type { GateStatusState, EnforcementState } from './merge-gate.js';
 import { type DeployTokenReceipt } from './deploy-receipt-token.js';
 export type { GateStatusState, EnforcementState } from './merge-gate.js';
 export type { DeployTokenReceipt } from './deploy-receipt-token.js';
+import { type NextAgentStep } from './next-agent-step.js';
+export type { NextAgentStep } from './next-agent-step.js';
 /**
  * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
  * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
@@ -59,7 +61,20 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
  * guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
  * it" ≠ "verification says no".
  */
- | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
+ | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key'
+/**
+ * The registry has withdrawn this key: status `revoked`, or a `revoked_at`
+ * timestamp on the entry. Distinct from retired_key, which is a planned
+ * rotation whose pre-rotation receipts stay meaningful. NOT repairable by
+ * re-requesting a receipt — the same key would sign it.
+ */
+ | 'revoked_key'
+/**
+ * The registry carries a key status this verifier does not understand. Fails
+ * closed rather than reading it as healthy: an unrecognised status is more
+ * likely a withdrawal we cannot parse than a permission we should grant.
+ */
+ | 'unknown_key_status';
 /** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
 export type DeployTarget = {
     environment: string;
@@ -172,6 +187,22 @@ export type DeployGateDecision = {
      * Observation: which input mode ran and the verify_status. Not a preimage field.
      */
     verification: DeployVerificationObservation;
+    /**
+     * I-1288f — the DECISION's own remediation suggestion, lifted verbatim from the
+     * `decision_result` envelope this gate verified.
+     *
+     * PRESENT ONLY IN TOKEN MODE. `verified_view` and `unverified` receipts are
+     * host-supplied views: nothing in this process checked a signature over their
+     * contents, so a step read from one would be guidance with no issuer behind it.
+     * TOKEN mode is the only path where the guard itself bound the body hash.
+     *
+     * Absent when the envelope carried none, on every allow-class deploy (the issuer
+     * sends null), and on every non-token mode. Additive: not a verdict input, not a
+     * preimage field, and no branch below reads it — see the deep-equal test.
+     *
+     * NOT PERMISSION: branch on `reason` / `deploy_allowed`, never on this.
+     */
+    next_step?: NextAgentStep;
 };
 /**
  * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.

package/dist/cjs/deploy-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa;AACf;;;;;GAKG;GACD,aAAa;AACf;;;;GAIG;GACD,oBAAoB,CAAC;AAEzB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;IAC5C;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAmKrE"}

package/dist/cjs/deploy-gate.js

@@ -40,6 +40,7 @@ exports.asVerifiedDeployReceiptView = asVerifiedDeployReceiptView;
 exports.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
 exports.deployGate = deployGate;
 const deploy_receipt_token_js_1 = require("./deploy-receipt-token.js");
+const next_agent_step_js_1 = require("./next-agent-step.js");
 /**
  * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
  * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
@@ -121,12 +122,23 @@ function deployGate(input) {
         bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
         operation: r && r.operation != null ? String(r.operation) : null,
     });
-    const deny = (state, reason) => ({
-        deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
-        residuals: [],
-        detail: detailOf(receipt),
-        verification,
-    });
+    /**
+     * The step is read from `receipt` ONLY when this run verified a token itself. A
+     * verified-view or unverified receipt is a host claim about someone else's check,
+     * and `fail()` in the token verifier returns `view: null`, so a token that did not
+     * authenticate has no view to read from either. Both guards, stated once here.
+     */
+    const nextStepOf = (r) => (verification.mode === 'token' ? (0, next_agent_step_js_1.readNextAgentStep)(r) : null);
+    const deny = (state, reason) => {
+        const step = nextStepOf(receipt);
+        return {
+            deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
+            residuals: [],
+            detail: detailOf(receipt),
+            verification,
+            ...(step ? { next_step: step } : {}),
+        };
+    };
     // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
     if (!target.environment || String(target.environment).trim() === ''
         || !target.artifact_id || String(target.artifact_id).trim() === '') {

package/dist/cjs/deploy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAsGH,kEAUC;AAED,kEAIC;AA6GD,gCAqJC;AArXD,uEAGmC;AAKnC;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAqHH,kEAUC;AAED,kEAIC;AA6HD,gCAmKC;AAlaD,uEAGmC;AAInC,6DAA6E;AAG7E;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAkG1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0FD,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH;;;;;OAKG;IACH,MAAM,UAAU,GAAG,CAAC,CAAuC,EAAwB,EAAE,CAAC,CACpF,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAA,sCAAiB,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5D,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO;YACL,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;YAClF,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;YACzB,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/cjs/deploy-receipt-token.d.ts

@@ -12,6 +12,7 @@
  *
  * No fetch. Same inputs → same output.
  */
+import { type NextAgentStep } from './next-agent-step.js';
 import type { ExecutorKeyRegistry } from '@coderifts/sdk';
 /** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
 export type TokenDerivedReceiptView = {
@@ -24,6 +25,12 @@ export type TokenDerivedReceiptView = {
     verdict_fingerprint?: string;
     body_hash?: string;
     target_id?: string;
+    /**
+     * I-1288f — the decision's own remediation suggestion, lifted from the envelope.
+     * Only ever populated by viewFromEnvelope, which runs after the body hash bound.
+     * `fail()` returns `view: null`, so no unverified token can produce one.
+     */
+    next_agent_step?: NextAgentStep | null;
 };
 export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
 export type DeployTokenReceipt = {
@@ -36,7 +43,7 @@ export type DeployTokenReceipt = {
     /** Air-gap single PEM (kid-agnostic). */
     pinnedKeyPem?: string;
 };
-export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
+export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION' | 'KEY_REVOKED' | 'REVOKED_KEY' | 'REVOKED_KEY_UNDECIDABLE' | 'KEY_RETIRED_AFTER_SIGNING' | 'UNKNOWN_KEY_STATUS';
 export type DeployTokenVerifyResult = {
     valid: boolean;
     status: DeployTokenVerifyStatus;
@@ -46,7 +53,7 @@ export type DeployTokenVerifyResult = {
     denyReason: string | null;
     payload?: Record<string, unknown>;
     view: TokenDerivedReceiptView | null;
-    key_status: 'active' | 'retired' | null;
+    key_status: 'active' | 'retired' | 'revoked' | 'unknown' | null;
 };
 /**
  * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).

package/dist/cjs/deploy-receipt-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}
+{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,GAGrB,aAAa,GACb,aAAa,GACb,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CACjE,CAAC;AAgMF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA0IzB"}

package/dist/cjs/deploy-receipt-token.js

@@ -16,6 +16,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHAIN_SIGNING_PREFIX = void 0;
 exports.verifyDeployReceiptToken = verifyDeployReceiptToken;
+const next_agent_step_js_1 = require("./next-agent-step.js");
 const node_crypto_1 = require("node:crypto");
 const sdk_1 = require("@coderifts/sdk");
 const receipt_binding_js_1 = require("./receipt-binding.js");
@@ -36,6 +37,48 @@ function reconstructInput(payload) {
     }
     return v1;
 }
+/**
+ * The key-withdrawal half of the published verifier's status taxonomy
+ * (`receipt-verifier/verify.js` deriveStatus, RECEIPT_FORMAT.md §7.1),
+ * transliterated. Returns the refusal status, or null to continue.
+ *
+ * Order matters and matches the reference: an unknown status fails closed before
+ * anything else is read; `revoked_at` kills the whole key history because the
+ * attacker chooses `ts`; `retired_at` only rejects receipts signed at or after
+ * it. A revoked key is never valid — UNDECIDABLE is not a softer accept, it
+ * reports that a legitimate pre-compromise receipt cannot be told apart from a
+ * backdated forgery.
+ *
+ * Kept as a small local function rather than a shared import: this package ships
+ * pure and dependency-light, and the reference core is CommonJS with a CLI and
+ * `fs` at module scope. `test/vendor-core.test.js` pins agreement with a
+ * byte-identical copy of that core, so the two cannot drift silently.
+ */
+function deriveKeyWithdrawalStatus(ts, keyMeta) {
+    const KNOWN_STATUSES = ['active', 'retired', 'revoked', null];
+    if (!KNOWN_STATUSES.includes(keyMeta.status))
+        return 'UNKNOWN_KEY_STATUS';
+    if (typeof keyMeta.revoked_at === 'string' && keyMeta.revoked_at.length > 0)
+        return 'KEY_REVOKED';
+    if (typeof keyMeta.retired_at === 'string' && keyMeta.retired_at.length > 0 && ts) {
+        const issued = Date.parse(ts);
+        const retired = Date.parse(keyMeta.retired_at);
+        if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
+            return 'KEY_RETIRED_AFTER_SIGNING';
+        }
+    }
+    if (keyMeta.status === 'revoked') {
+        const at = keyMeta.compromised_at;
+        if (typeof at !== 'string' || at.length === 0)
+            return 'REVOKED_KEY_UNDECIDABLE';
+        const boundary = Date.parse(at);
+        const issued = typeof ts === 'string' ? Date.parse(ts) : NaN;
+        if (!Number.isFinite(boundary) || !Number.isFinite(issued))
+            return 'REVOKED_KEY_UNDECIDABLE';
+        return issued >= boundary ? 'REVOKED_KEY' : 'REVOKED_KEY_UNDECIDABLE';
+    }
+    return null;
+}
 function isIssueTimeWithinKeyWindow(ts, keyMeta) {
     if (!keyMeta || keyMeta.status === 'active')
         return true;
@@ -60,6 +103,12 @@ function isIssueTimeWithinKeyWindow(ts, keyMeta) {
         return false;
     return true;
 }
+function optionalString(source, field) {
+    if (!source || typeof source !== 'object')
+        return null;
+    const v = source[field];
+    return typeof v === 'string' && v.length > 0 ? v : null;
+}
 function resolveKey(kid, registry, pinnedKeyPem) {
     if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
         try {
@@ -68,6 +117,8 @@ function resolveKey(kid, registry, pinnedKeyPem) {
                 status: 'active',
                 valid_from: null,
                 retired_at: null,
+                revoked_at: null,
+                compromised_at: null,
             };
         }
         catch {
@@ -83,9 +134,11 @@ function resolveKey(kid, registry, pinnedKeyPem) {
     try {
         return {
             publicKey: (0, node_crypto_1.createPublicKey)(entry.public_key_pem),
-            status: entry.status === 'retired' ? 'retired' : 'active',
+            status: typeof entry.status === 'string' ? entry.status : null,
             valid_from: entry.valid_from || null,
             retired_at: entry.retired_at || null,
+            revoked_at: optionalString(entry, 'revoked_at'),
+            compromised_at: optionalString(entry, 'compromised_at'),
         };
     }
     catch {
@@ -118,6 +171,11 @@ function viewFromEnvelope(envelope, payload, currently_authorized) {
             : (typeof payload.fp === 'string' ? payload.fp : undefined),
         body_hash: typeof payload.bh === 'string' ? payload.bh : undefined,
         target_id: envelope.target_id == null ? undefined : String(envelope.target_id),
+        // Read from the envelope the caller supplied. On the currently_authorized path the
+        // body hash has already bound it; on the expired / retired-key paths the signature
+        // was authentic too. Every path that did NOT authenticate returns through fail(),
+        // which sets view: null — so this field cannot carry an unsigned step.
+        next_agent_step: (0, next_agent_step_js_1.readNextAgentStep)(envelope),
     };
 }
 /**
@@ -168,6 +226,17 @@ function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
         }
     }
+    // A key the registry has withdrawn is judged BEFORE any authorization path.
+    // The signature verified — that is precisely the problem a withdrawal exists
+    // to answer, and no timestamp on a receipt the attacker minted may rehabilitate it.
+    const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === 'string' ? payload.ts : undefined, resolved);
+    if (withdrawn) {
+        return fail(withdrawn, withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown_key_status' : 'revoked_key', {
+            payload,
+            authz_reason: withdrawn.toLowerCase(),
+            key_status: withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown' : 'revoked',
+        });
+    }
     if (resolved.status === 'retired') {
         if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });

package/dist/cjs/deploy-receipt-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAsKH,4DA+HC;AAnSD,6CAAsE;AACtE,wCAAkD;AAElD,6DAAuD;AAe1C,QAAA,oBAAoB,GAAG,YAAY,CAAC;AAkCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,4BAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAiF;IAEjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,IAAA,6BAAe,EAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,IAAA,6BAAe,EAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,oBAAY,EAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,IAAA,sBAAgB,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,IAAA,oCAAe,EAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAqQH,4DA8IC;AAjZD,6DAA6E;AAC7E,6CAAsE;AACtE,wCAAkD;AAElD,6DAAuD;AAqB1C,QAAA,oBAAoB,GAAG,YAAY,CAAC;AAyCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,4BAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,yBAAyB,CAChC,EAAsB,EACtB,OAAyF;IAEzF,MAAM,cAAc,GAAiC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAE1E,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IAElG,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7E,OAAO,2BAA2B,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAC7F,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAwF;IAExF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD,SAAS,cAAc,CAAC,MAAe,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,IAAA,6BAAe,EAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,IAAA,6BAAe,EAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC9D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;YAC/C,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9E,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,uEAAuE;QACvE,eAAe,EAAE,IAAA,sCAAiB,EAAC,QAAQ,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,oBAAY,EAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,oFAAoF;IACpF,MAAM,SAAS,GAAG,yBAAyB,CACzC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACvD,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,EAAE;YAChG,OAAO;YACP,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,IAAA,sBAAgB,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,IAAA,oCAAe,EAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}

package/dist/cjs/execution-grant.d.ts

@@ -13,10 +13,110 @@ export type ExecutionGrantConfig = {
     }) => string | Promise<string>;
     /** Default 'v1' this wave. ATOMIC construction requires 'v2'. */
     grantVersion?: 'v1' | 'v2';
+    /**
+     * The V2 binding a grant request should carry (AUDIT P1 / RES-1).
+     *
+     * MEASURED before adding: the guard's authorize request sent only
+     * `include_execution_grant` and `state_nonce`, and the SDK's
+     * PreflightChangeSetRequest declares NEITHER these fields NOR `state_nonce` —
+     * the guard builds its own request literal and posts it as `unknown`, so the
+     * wire shape is guard-local. Adding them here is therefore a guard-side
+     * config surface, not a claim that the SDK type endorses them.
+     *
+     * Every one is OPTIONAL and every one is sent only when set. A deployment
+     * that does not configure a field gets it NAMED in the observation's
+     * `v2_fields_absent`, never a placeholder on the wire.
+     *
+     * ── DEPRECATED ALIASES (1198) ────────────────────────────────────────────
+     * The canonical home is the TOP LEVEL of the withCodeRifts input, where
+     * executorId/adapterId/targetUri already lived before this config existed
+     * (with-coderifts.ts:394-396) and where the ATOMIC construction check reads
+     * them. Setting them here still works and still reaches the wire — but a
+     * value here that DISAGREES with the top level is an initialization error,
+     * because the two used to feed different halves of the system with nothing
+     * reconciling them. See resolveV2Fields.
+     *
+     * Unreleased when this was written — added after the 14.1.0 release and never
+     * published — so no adopter depends on the nested spelling.
+     */
+    executorId?: string;
+    adapterId?: string;
+    targetUri?: string;
+    tenantId?: string;
+    policyHash?: string;
+    audienceHash?: string;
 };
+/**
+ * THE CANONICAL V2 FIELD SET (roadmap 1198).
+ *
+ * MEASURED SPLIT-BRAIN, which is what this exists to end:
+ *   · executorId / adapterId / targetUri lived in BOTH the top-level input
+ *     (with-coderifts.ts:394-396 → the ATOMIC construction check and the
+ *     posture tuple) and the nested executionGrant config (→ the authorize
+ *     request). Nothing compared them, so a configuration could bind the
+ *     profile to one executor and put another — or none — on the wire.
+ *   · policyHash had a READER and no writer: atomic-profile.ts:247 passes
+ *     `input.policyHash` to the posture verifier and with-coderifts.ts:911-915
+ *     never forwarded it, so that binding was permanently undefined.
+ *   · tenantId / audienceHash existed on the wire side only.
+ *
+ * This reads both spellings, REFUSES a disagreement, and returns one set that
+ * the wire and the profile both use. A field neither side supplies stays
+ * genuinely absent — the case 6bca531's named-absent was written for, and now
+ * the only case it covers.
+ */
+export declare const V2_FIELD_KEYS: readonly ["executorId", "adapterId", "targetUri", "tenantId", "policyHash", "audienceHash"];
+export type V2FieldKey = typeof V2_FIELD_KEYS[number];
+export type V2Fields = Partial<Record<V2FieldKey, string>>;
+/**
+ * Resolve the canonical set from an input carrying either spelling.
+ *
+ * THROWS on disagreement. Preferring one silently is what produced the split:
+ * a caller who set both would have one quietly ignored, with no way to see
+ * which one survived.
+ */
+export declare function resolveV2Fields(input?: {
+    executorId?: unknown;
+    adapterId?: unknown;
+    targetUri?: unknown;
+    tenantId?: unknown;
+    policyHash?: unknown;
+    audienceHash?: unknown;
+    executionGrant?: ExecutionGrantConfig | null;
+} | null): V2Fields;
+/** The V2 request fields, in the wire spelling. One list, used to send and to report. */
+export declare const V2_WIRE_FIELDS: readonly [readonly ["executor_id", "executorId"], readonly ["adapter_id", "adapterId"], readonly ["target_uri", "targetUri"], readonly ["tenant_id", "tenantId"], readonly ["policy_hash", "policyHash"], readonly ["audience_hash", "audienceHash"]];
+export type V2WireResult = {
+    /** Wire-name -> value, for the fields this deployment actually configured. */
+    fields: Record<string, string>;
+    /** Wire-names this deployment did NOT configure. Named, never placeheld. */
+    absent: string[];
+};
+/**
+ * Build the V2 field set for an authorize request.
+ *
+ * V1 sends nothing here: the fields describe a v2 binding, and attaching them
+ * to a v1 request would assert a shape the grant does not have.
+ *
+ * A value that is not a non-empty string is ABSENT, not empty-string-sent. An
+ * empty executor_id on the wire is indistinguishable from a real one that
+ * happens to be blank, and the server would bind it.
+ */
+export declare function v2WireFields(config: {
+    executionGrant?: ExecutionGrantConfig;
+} | null | undefined): V2WireResult;
 export type ExecutionGrantObservation = {
     requested: boolean;
     arrived: boolean;
+    /** Which grant shape was requested. */
+    grant_version?: 'v1' | 'v2';
+    /**
+     * The V2 binding this request actually carried, and what it could not.
+     * `v2_fields_absent` is the honest half: a field the deployment never
+     * configured is reported here rather than sent as an empty placeholder.
+     */
+    v2_fields_sent?: string[];
+    v2_fields_absent?: string[];
 };
 export type ExecutionGrantCallContext = {
     execution_grant: string | null;

package/dist/cjs/execution-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}
+{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,6FAEf,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE;IACtC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C,GAAG,IAAI,GAAG,QAAQ,CAiClB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,uPAOhB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG;IACzB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACnE,YAAY,CAiBd;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}