@coderifts/agent-guard 14.1.0 → 15.1.0

package/dist/esm/atomic-profile.d.ts

@@ -17,13 +17,15 @@ export declare const PROFILE_ENFORCING_ATOMIC_V1: "ENFORCING_ATOMIC_V1";
  *   to this `deployment_id`.
  *
  * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
- *   · NOT executor_id, adapter_id, target_uri or policy_hash binding. The
- *     producer does not sign those fields — measured 2026-08-29 against
- *     capability-demo demo/src/posture.js:427-435, whose signed body is exactly
- *     { v, executor_kid, deployment_id, measured_at, verdict, facts, drift }.
- *     Verifying a field the producer never signed would be the same overclaim
- *     the audit found, inverted. Deferred to roadmap 1174; until the producer
- *     signs them, V2 must not imply the receipt binds them.
+ *   · NOT a tuple the CALLER did not name. executor_id, adapter_id, target_uri
+ *     and policy_hash ARE now bound (AUDIT P1 / RES-3) — but each only when the
+ *     construction configures it. The earlier text here said the producer does
+ *     not sign those fields; re-measured 2026-08-29 against capability-demo
+ *     demo/src/posture.js, the issuer spreads them into the SIGNED canonical
+ *     body whenever they carry real content, so binding them is backed by the
+ *     producer rather than asserted over it. What has NOT changed is the rule
+ *     underneath: a field nobody configured is reported in the verifier's
+ *     `not_bound` list, never defaulted into looking checked.
  *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
  *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
  *     A guard-side default would present our policy as the receipt's statement.
@@ -61,6 +63,13 @@ export type AtomicConstructionInput = {
     executorId?: string;
     adapterId?: string;
     targetUri?: string;
+    /**
+     * MEASURED: executorId/adapterId/targetUri already existed here; policyHash
+     * did not exist anywhere in this package — its only mention was the comment
+     * above saying it was not bound. Added so the tuple can be STATED, not so it
+     * can be assumed: leaving it unset binds nothing, and says so.
+     */
+    policyHash?: string;
     executorAttestation?: {
         registry?: unknown;
     } | null;

package/dist/esm/atomic-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-profile.d.ts","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEvG,eAAO,MAAM,0BAA0B,EAAG,4BAAqC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,4NAYnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAkBvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAIpF;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAGlB,CAAC;AAE7B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAuGnF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAOhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,GAAG,aAAa,CAahB"}
+{"version":3,"file":"atomic-profile.d.ts","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEvG,eAAO,MAAM,0BAA0B,EAAG,4BAAqC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,4NAYnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAkBvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAIpF;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAGlB,CAAC;AAE7B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAgHnF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAOhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,GAAG,aAAa,CAahB"}

package/dist/esm/atomic-profile.js

@@ -25,13 +25,15 @@ export const PROFILE_ENFORCING_ATOMIC_V1 = 'ENFORCING_ATOMIC_V1';
  *   to this `deployment_id`.
  *
  * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
- *   · NOT executor_id, adapter_id, target_uri or policy_hash binding. The
- *     producer does not sign those fields — measured 2026-08-29 against
- *     capability-demo demo/src/posture.js:427-435, whose signed body is exactly
- *     { v, executor_kid, deployment_id, measured_at, verdict, facts, drift }.
- *     Verifying a field the producer never signed would be the same overclaim
- *     the audit found, inverted. Deferred to roadmap 1174; until the producer
- *     signs them, V2 must not imply the receipt binds them.
+ *   · NOT a tuple the CALLER did not name. executor_id, adapter_id, target_uri
+ *     and policy_hash ARE now bound (AUDIT P1 / RES-3) — but each only when the
+ *     construction configures it. The earlier text here said the producer does
+ *     not sign those fields; re-measured 2026-08-29 against capability-demo
+ *     demo/src/posture.js, the issuer spreads them into the SIGNED canonical
+ *     body whenever they carry real content, so binding them is backed by the
+ *     producer rather than asserted over it. What has NOT changed is the rule
+ *     underneath: a field nobody configured is reported in the verifier's
+ *     `not_bound` list, never defaulted into looking checked.
  *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
  *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
  *     A guard-side default would present our policy as the receipt's statement.
@@ -169,10 +171,19 @@ export function atomicConstructionProblems(input) {
             // V2 calls the verifier only with both mandatory args present — a call with neither
             // is itself a construction problem (the verifier stays permissive when invoked directly).
             if (deploymentId.length > 0 && maxAgeOk) {
+                // The credential-boundary tuple, from the construction input rather than
+                // from anywhere this function could invent it. Each is passed ONLY when
+                // configured: an absent one reaches the verifier as undefined and comes
+                // back named in `not_bound` — the honest record of a boundary this
+                // deployment never stated.
                 const r = verifyPostureReceipt(cb.postureReceipt, {
                     registry: cb.registry,
                     pinnedKeyPem: cb.pinnedKeyPem,
                     expectedDeploymentId: deploymentId,
+                    expectedExecutorId: input.executorId,
+                    expectedAdapterId: input.adapterId,
+                    expectedTargetUri: input.targetUri,
+                    expectedPolicyHash: input.policyHash,
                     maxAgeMs,
                     now: cb.now,
                 });

package/dist/esm/atomic-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAA2B,CAAC;AAGnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB;WAChC,OAAO,KAAK,2BAA2B;WACvC,OAAO,KAAK,2BAA2B,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,KAAK,2BAA2B,CAAC;AACjD,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAcnD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4FAA4F;MAC1F,2FAA2F;MAC3F,wBAAwB,CAAC;AAE7B,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAA4E,CAAC;QAC9F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,2FAA2F;kBACzF,oFAAoF,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;sBAC1F,uDAAuD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ;mBACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBACzB,QAAQ,GAAG,CAAC;mBACZ,QAAQ,IAAI,wBAAwB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CACX,wFAAwF;sBACtF,sFAAsF,CACzF,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,GAAG,wBAAwB,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,gEAAgE,wBAAwB,KAAK;sBAC3F,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,oFAAoF;YACpF,0FAA0F;YAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,oBAAoB,EAAE,YAAY;oBAClC,QAAQ;oBACR,GAAG,EAAE,EAAE,CAAC,GAAG;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CACX,uDAAuD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;0BAC/E,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;4BAC7B,CAAC,CAAC,iFAAiF;kCAC/E,oEAAoE;4BACxE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc;gCAC3B,CAAC,CAAC,mFAAmF;sCACjF,gDAAgD;gCACpD,CAAC,CAAC,0EAA0E;sCACxE,mCAAmC,CAAC,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,0BAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAA2B,CAAC;AAGnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB;WAChC,OAAO,KAAK,2BAA2B;WACvC,OAAO,KAAK,2BAA2B,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,KAAK,2BAA2B,CAAC;AACjD,CAAC;AAuBD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAcnD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4FAA4F;MAC1F,2FAA2F;MAC3F,wBAAwB,CAAC;AAE7B,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAA4E,CAAC;QAC9F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,2FAA2F;kBACzF,oFAAoF,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;sBAC1F,uDAAuD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ;mBACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBACzB,QAAQ,GAAG,CAAC;mBACZ,QAAQ,IAAI,wBAAwB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CACX,wFAAwF;sBACtF,sFAAsF,CACzF,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,GAAG,wBAAwB,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,gEAAgE,wBAAwB,KAAK;sBAC3F,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,oFAAoF;YACpF,0FAA0F;YAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,yEAAyE;gBACzE,wEAAwE;gBACxE,wEAAwE;gBACxE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,QAAQ;oBACR,GAAG,EAAE,EAAE,CAAC,GAAG;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CACX,uDAAuD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;0BAC/E,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;4BAC7B,CAAC,CAAC,iFAAiF;kCAC/E,oEAAoE;4BACxE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc;gCAC3B,CAAC,CAAC,mFAAmF;sCACjF,gDAAgD;gCACpD,CAAC,CAAC,0EAA0E;sCACxE,mCAAmC,CAAC,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,0BAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/esm/deny-remedy.d.ts

@@ -0,0 +1,74 @@
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+export declare const DENY_ERROR: Readonly<{
+    GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED";
+    GRANT_INVALID: "CODERIFTS_GRANT_INVALID";
+    GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH";
+}>;
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+export declare const DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
+export declare const ARGS_SHAPE: Readonly<{
+    artifacts: "Array<{ id, type, before, after }> — the change set being authorized";
+    context: "{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize";
+}>;
+/** The three classes, as a type. */
+export type DenyError = (typeof DENY_ERROR)[keyof typeof DENY_ERROR];
+/** The emitted object — exactly the shape the schema describes. */
+export interface DenyRemedy {
+    error: DenyError;
+    target: string | null;
+    fingerprint: string | null;
+    action_required: {
+        tool: 'preflight_change_set';
+        mode: 'authorize';
+        args_shape: Record<string, string>;
+    };
+    does_not_promise: string;
+    observed?: Record<string, unknown>;
+}
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+export declare function buildDenyRemedy({ error, target, fingerprint, observed }: {
+    error: DenyError | null;
+    target?: string | null;
+    fingerprint?: string | null;
+    observed?: Record<string, unknown> | null;
+}): DenyRemedy | null;
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+export declare function denyErrorForReason(reason: unknown): DenyError | null;
+//# sourceMappingURL=deny-remedy.d.ts.map

package/dist/esm/deny-remedy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.d.ts","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,8DAA8D,CAAC;AAE5F,eAAO,MAAM,UAAU;;;EAGrB,CAAC;AAIH,oCAAoC;AACpC,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACzG,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAa,EAAE,WAAkB,EAAE,QAAe,EAAE,EAAE;IAC7D,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,GACA,UAAU,GAAG,IAAI,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CA+CpE"}

package/dist/esm/deny-remedy.js

@@ -0,0 +1,122 @@
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+export const DENY_ERROR = Object.freeze({
+    GRANT_REQUIRED: 'CODERIFTS_GRANT_REQUIRED',
+    GRANT_INVALID: 'CODERIFTS_GRANT_INVALID',
+    GRANT_MISMATCH: 'CODERIFTS_GRANT_MISMATCH',
+});
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+export const DOES_NOT_PROMISE = 'a grant does not guarantee execution (CAS may still fail)';
+export const ARGS_SHAPE = Object.freeze({
+    artifacts: 'Array<{ id, type, before, after }> — the change set being authorized',
+    context: '{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize',
+});
+const FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+export function buildDenyRemedy({ error, target = null, fingerprint = null, observed = null }) {
+    if (!error || !Object.values(DENY_ERROR).includes(error))
+        return null;
+    const remedy = {
+        error,
+        // Null, never a wildcard: a surface that cannot name what it refused must
+        // not emit a value a reader could take for "everything".
+        target: typeof target === 'string' && target.length > 0 ? target : null,
+        // Only a well-formed fingerprint. A malformed one is dropped rather than
+        // passed through, because a caller comparing it would get a false mismatch.
+        fingerprint: typeof fingerprint === 'string' && FINGERPRINT_RE.test(fingerprint)
+            ? fingerprint
+            : null,
+        action_required: {
+            tool: 'preflight_change_set',
+            mode: 'authorize',
+            args_shape: { ...ARGS_SHAPE },
+        },
+        does_not_promise: DOES_NOT_PROMISE,
+    };
+    if (observed && typeof observed === 'object')
+        remedy.observed = observed;
+    return remedy;
+}
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+export function denyErrorForReason(reason) {
+    switch (String(reason || '').toLowerCase()) {
+        // Nothing was presented.
+        case 'receipt_missing':
+        case 'missing_receipt':
+        case 'missing_grant_header':
+        case 'decision_missing':
+        case 'missing_decision_result':
+        case 'no_preflight_response':
+        case 'grant_not_supplied':
+            return DENY_ERROR.GRANT_REQUIRED;
+        // Something was presented and did not hold up.
+        case 'receipt_invalid':
+        case 'receipt_unverified':
+        case 'invalid_signature':
+        case 'unknown_key':
+        case 'unknown_kid':
+        case 'dsse_malformed':
+        case 'dsse_unsupported':
+        case 'dsse_predicate_mismatch':
+        case 'malformed':
+        case 'grant_malformed':
+        case 'grant_unverified':
+        case 'grant_expired':
+            return DENY_ERROR.GRANT_INVALID;
+        // It held up, but it is not about this request.
+        case 'scope_mismatch':
+        case 'target_mismatch':
+        case 'operation_mismatch':
+        case 'grant_scope_mismatch':
+        case 'mode_mismatch':
+        case 'repo_mismatch':
+        case 'base_mismatch':
+        case 'head_mismatch':
+        case 'grant_does_not_cover_path':
+        case 'grant_bound_elsewhere':
+        case 'receipt_envelope_mismatch':
+        case 'artifact_mismatch':
+        case 'grant_unbound':
+        case 'grant_wrong_audience':
+            return DENY_ERROR.GRANT_MISMATCH;
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=deny-remedy.js.map

package/dist/esm/deny-remedy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.js","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,cAAc,EAAE,0BAA0B;IAC1C,aAAa,EAAE,yBAAyB;IACxC,cAAc,EAAE,0BAA0B;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2DAA2D,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,sEAAsE;IACjF,OAAO,EAAE,wGAAwG;CAClH,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAe/C;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAK1D;IAED,IAAI,CAAC,KAAK,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpF,MAAM,MAAM,GAAe;QACzB,KAAK;QACL,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACvE,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW,EAAE,OAAO,WAAW,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9E,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,IAAI;QACR,eAAe,EAAE;YACf,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE;SAC9B;QACD,gBAAgB,EAAE,gBAAgB;KACnC,CAAC;IACF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe;IAChD,QAAQ,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3C,yBAAyB;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,uBAAuB,CAAC;QAC7B,KAAK,oBAAoB;YACvB,OAAO,UAAU,CAAC,cAAc,CAAC;QAEnC,+CAA+C;QAC/C,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB,CAAC;QACtB,KAAK,kBAAkB,CAAC;QACxB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,eAAe;YAClB,OAAO,UAAU,CAAC,aAAa,CAAC;QAElC,gDAAgD;QAChD,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,2BAA2B,CAAC;QACjC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,2BAA2B,CAAC;QACjC,KAAK,mBAAmB,CAAC;QACzB,KAAK,eAAe,CAAC;QACrB,KAAK,sBAAsB;YACzB,OAAO,UAAU,CAAC,cAAc,CAAC;QAEnC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/esm/deploy-gate.d.ts

@@ -37,6 +37,8 @@ import type { GateStatusState, EnforcementState } from './merge-gate.js';
 import { type DeployTokenReceipt } from './deploy-receipt-token.js';
 export type { GateStatusState, EnforcementState } from './merge-gate.js';
 export type { DeployTokenReceipt } from './deploy-receipt-token.js';
+import { type NextAgentStep } from './next-agent-step.js';
+export type { NextAgentStep } from './next-agent-step.js';
 /**
  * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
  * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
@@ -59,7 +61,20 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
  * guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
  * it" ≠ "verification says no".
  */
- | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
+ | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key'
+/**
+ * The registry has withdrawn this key: status `revoked`, or a `revoked_at`
+ * timestamp on the entry. Distinct from retired_key, which is a planned
+ * rotation whose pre-rotation receipts stay meaningful. NOT repairable by
+ * re-requesting a receipt — the same key would sign it.
+ */
+ | 'revoked_key'
+/**
+ * The registry carries a key status this verifier does not understand. Fails
+ * closed rather than reading it as healthy: an unrecognised status is more
+ * likely a withdrawal we cannot parse than a permission we should grant.
+ */
+ | 'unknown_key_status';
 /** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
 export type DeployTarget = {
     environment: string;
@@ -172,6 +187,22 @@ export type DeployGateDecision = {
      * Observation: which input mode ran and the verify_status. Not a preimage field.
      */
     verification: DeployVerificationObservation;
+    /**
+     * I-1288f — the DECISION's own remediation suggestion, lifted verbatim from the
+     * `decision_result` envelope this gate verified.
+     *
+     * PRESENT ONLY IN TOKEN MODE. `verified_view` and `unverified` receipts are
+     * host-supplied views: nothing in this process checked a signature over their
+     * contents, so a step read from one would be guidance with no issuer behind it.
+     * TOKEN mode is the only path where the guard itself bound the body hash.
+     *
+     * Absent when the envelope carried none, on every allow-class deploy (the issuer
+     * sends null), and on every non-token mode. Additive: not a verdict input, not a
+     * preimage field, and no branch below reads it — see the deep-equal test.
+     *
+     * NOT PERMISSION: branch on `reason` / `deploy_allowed`, never on this.
+     */
+    next_step?: NextAgentStep;
 };
 /**
  * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.

package/dist/esm/deploy-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa;AACf;;;;;GAKG;GACD,aAAa;AACf;;;;GAIG;GACD,oBAAoB,CAAC;AAEzB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;IAC5C;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAmKrE"}

package/dist/esm/deploy-gate.js

@@ -34,6 +34,7 @@
  * secrets.
  */
 import { verifyDeployReceiptToken, } from './deploy-receipt-token.js';
+import { readNextAgentStep } from './next-agent-step.js';
 /**
  * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
  * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
@@ -115,12 +116,23 @@ export function deployGate(input) {
         bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
         operation: r && r.operation != null ? String(r.operation) : null,
     });
-    const deny = (state, reason) => ({
-        deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
-        residuals: [],
-        detail: detailOf(receipt),
-        verification,
-    });
+    /**
+     * The step is read from `receipt` ONLY when this run verified a token itself. A
+     * verified-view or unverified receipt is a host claim about someone else's check,
+     * and `fail()` in the token verifier returns `view: null`, so a token that did not
+     * authenticate has no view to read from either. Both guards, stated once here.
+     */
+    const nextStepOf = (r) => (verification.mode === 'token' ? readNextAgentStep(r) : null);
+    const deny = (state, reason) => {
+        const step = nextStepOf(receipt);
+        return {
+            deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
+            residuals: [],
+            detail: detailOf(receipt),
+            verification,
+            ...(step ? { next_step: step } : {}),
+        };
+    };
     // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
     if (!target.environment || String(target.environment).trim() === ''
         || !target.artifact_id || String(target.artifact_id).trim() === '') {

package/dist/esm/deploy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EACL,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAKnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,wBAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,wBAAwB,CAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EACL,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AAInC,OAAO,EAAE,iBAAiB,EAAsB,MAAM,sBAAsB,CAAC;AAG7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAiC,CAAC;AAkG1E,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,wBAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0FD,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH;;;;;OAKG;IACH,MAAM,UAAU,GAAG,CAAC,CAAuC,EAAwB,EAAE,CAAC,CACpF,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5D,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO;YACL,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;YAClF,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;YACzB,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC;IAEF,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,wBAAwB,CAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/esm/deploy-receipt-token.d.ts

@@ -12,6 +12,7 @@
  *
  * No fetch. Same inputs → same output.
  */
+import { type NextAgentStep } from './next-agent-step.js';
 import type { ExecutorKeyRegistry } from '@coderifts/sdk';
 /** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
 export type TokenDerivedReceiptView = {
@@ -24,6 +25,12 @@ export type TokenDerivedReceiptView = {
     verdict_fingerprint?: string;
     body_hash?: string;
     target_id?: string;
+    /**
+     * I-1288f — the decision's own remediation suggestion, lifted from the envelope.
+     * Only ever populated by viewFromEnvelope, which runs after the body hash bound.
+     * `fail()` returns `view: null`, so no unverified token can produce one.
+     */
+    next_agent_step?: NextAgentStep | null;
 };
 export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
 export type DeployTokenReceipt = {
@@ -36,7 +43,7 @@ export type DeployTokenReceipt = {
     /** Air-gap single PEM (kid-agnostic). */
     pinnedKeyPem?: string;
 };
-export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
+export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION' | 'KEY_REVOKED' | 'REVOKED_KEY' | 'REVOKED_KEY_UNDECIDABLE' | 'KEY_RETIRED_AFTER_SIGNING' | 'UNKNOWN_KEY_STATUS';
 export type DeployTokenVerifyResult = {
     valid: boolean;
     status: DeployTokenVerifyStatus;
@@ -46,7 +53,7 @@ export type DeployTokenVerifyResult = {
     denyReason: string | null;
     payload?: Record<string, unknown>;
     view: TokenDerivedReceiptView | null;
-    key_status: 'active' | 'retired' | null;
+    key_status: 'active' | 'retired' | 'revoked' | 'unknown' | null;
 };
 /**
  * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).

package/dist/esm/deploy-receipt-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}
+{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,GAGrB,aAAa,GACb,aAAa,GACb,yBAAyB,GACzB,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;CACjE,CAAC;AAgMF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA0IzB"}