@coderifts/agent-guard 14.1.0 → 15.1.0

package/dist/esm/deploy-receipt-token.js

@@ -12,6 +12,7 @@
  *
  * No fetch. Same inputs → same output.
  */
+import { readNextAgentStep } from './next-agent-step.js';
 import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
 import { isReceiptExpired } from '@coderifts/sdk';
 import { computeBodyHash } from './receipt-binding.js';
@@ -32,6 +33,48 @@ function reconstructInput(payload) {
     }
     return v1;
 }
+/**
+ * The key-withdrawal half of the published verifier's status taxonomy
+ * (`receipt-verifier/verify.js` deriveStatus, RECEIPT_FORMAT.md §7.1),
+ * transliterated. Returns the refusal status, or null to continue.
+ *
+ * Order matters and matches the reference: an unknown status fails closed before
+ * anything else is read; `revoked_at` kills the whole key history because the
+ * attacker chooses `ts`; `retired_at` only rejects receipts signed at or after
+ * it. A revoked key is never valid — UNDECIDABLE is not a softer accept, it
+ * reports that a legitimate pre-compromise receipt cannot be told apart from a
+ * backdated forgery.
+ *
+ * Kept as a small local function rather than a shared import: this package ships
+ * pure and dependency-light, and the reference core is CommonJS with a CLI and
+ * `fs` at module scope. `test/vendor-core.test.js` pins agreement with a
+ * byte-identical copy of that core, so the two cannot drift silently.
+ */
+function deriveKeyWithdrawalStatus(ts, keyMeta) {
+    const KNOWN_STATUSES = ['active', 'retired', 'revoked', null];
+    if (!KNOWN_STATUSES.includes(keyMeta.status))
+        return 'UNKNOWN_KEY_STATUS';
+    if (typeof keyMeta.revoked_at === 'string' && keyMeta.revoked_at.length > 0)
+        return 'KEY_REVOKED';
+    if (typeof keyMeta.retired_at === 'string' && keyMeta.retired_at.length > 0 && ts) {
+        const issued = Date.parse(ts);
+        const retired = Date.parse(keyMeta.retired_at);
+        if (Number.isFinite(issued) && Number.isFinite(retired) && issued >= retired) {
+            return 'KEY_RETIRED_AFTER_SIGNING';
+        }
+    }
+    if (keyMeta.status === 'revoked') {
+        const at = keyMeta.compromised_at;
+        if (typeof at !== 'string' || at.length === 0)
+            return 'REVOKED_KEY_UNDECIDABLE';
+        const boundary = Date.parse(at);
+        const issued = typeof ts === 'string' ? Date.parse(ts) : NaN;
+        if (!Number.isFinite(boundary) || !Number.isFinite(issued))
+            return 'REVOKED_KEY_UNDECIDABLE';
+        return issued >= boundary ? 'REVOKED_KEY' : 'REVOKED_KEY_UNDECIDABLE';
+    }
+    return null;
+}
 function isIssueTimeWithinKeyWindow(ts, keyMeta) {
     if (!keyMeta || keyMeta.status === 'active')
         return true;
@@ -56,6 +99,12 @@ function isIssueTimeWithinKeyWindow(ts, keyMeta) {
         return false;
     return true;
 }
+function optionalString(source, field) {
+    if (!source || typeof source !== 'object')
+        return null;
+    const v = source[field];
+    return typeof v === 'string' && v.length > 0 ? v : null;
+}
 function resolveKey(kid, registry, pinnedKeyPem) {
     if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
         try {
@@ -64,6 +113,8 @@ function resolveKey(kid, registry, pinnedKeyPem) {
                 status: 'active',
                 valid_from: null,
                 retired_at: null,
+                revoked_at: null,
+                compromised_at: null,
             };
         }
         catch {
@@ -79,9 +130,11 @@ function resolveKey(kid, registry, pinnedKeyPem) {
     try {
         return {
             publicKey: createPublicKey(entry.public_key_pem),
-            status: entry.status === 'retired' ? 'retired' : 'active',
+            status: typeof entry.status === 'string' ? entry.status : null,
             valid_from: entry.valid_from || null,
             retired_at: entry.retired_at || null,
+            revoked_at: optionalString(entry, 'revoked_at'),
+            compromised_at: optionalString(entry, 'compromised_at'),
         };
     }
     catch {
@@ -114,6 +167,11 @@ function viewFromEnvelope(envelope, payload, currently_authorized) {
             : (typeof payload.fp === 'string' ? payload.fp : undefined),
         body_hash: typeof payload.bh === 'string' ? payload.bh : undefined,
         target_id: envelope.target_id == null ? undefined : String(envelope.target_id),
+        // Read from the envelope the caller supplied. On the currently_authorized path the
+        // body hash has already bound it; on the expired / retired-key paths the signature
+        // was authentic too. Every path that did NOT authenticate returns through fail(),
+        // which sets view: null — so this field cannot carry an unsigned step.
+        next_agent_step: readNextAgentStep(envelope),
     };
 }
 /**
@@ -164,6 +222,17 @@ export function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
         }
     }
+    // A key the registry has withdrawn is judged BEFORE any authorization path.
+    // The signature verified — that is precisely the problem a withdrawal exists
+    // to answer, and no timestamp on a receipt the attacker minted may rehabilitate it.
+    const withdrawn = deriveKeyWithdrawalStatus(typeof payload.ts === 'string' ? payload.ts : undefined, resolved);
+    if (withdrawn) {
+        return fail(withdrawn, withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown_key_status' : 'revoked_key', {
+            payload,
+            authz_reason: withdrawn.toLowerCase(),
+            key_status: withdrawn === 'UNKNOWN_KEY_STATUS' ? 'unknown' : 'revoked',
+        });
+    }
     if (resolved.status === 'retired') {
         if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
             return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });

package/dist/esm/deploy-receipt-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAevD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAkCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAiF;IAEjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAsB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAqBvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAyCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,yBAAyB,CAChC,EAAsB,EACtB,OAAyF;IAEzF,MAAM,cAAc,GAAiC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAE1E,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IAElG,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7E,OAAO,2BAA2B,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,yBAAyB,CAAC;QAC7F,OAAO,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAwF;IAExF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD,SAAS,cAAc,CAAC,MAAe,EAAE,KAAa;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC9D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;YAC/C,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC9E,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,uEAAuE;QACvE,eAAe,EAAE,iBAAiB,CAAC,QAAQ,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,oFAAoF;IACpF,MAAM,SAAS,GAAG,yBAAyB,CACzC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EACvD,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,EAAE;YAChG,OAAO;YACP,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE;YACrC,UAAU,EAAE,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}

package/dist/esm/execution-grant.d.ts

@@ -13,10 +13,110 @@ export type ExecutionGrantConfig = {
     }) => string | Promise<string>;
     /** Default 'v1' this wave. ATOMIC construction requires 'v2'. */
     grantVersion?: 'v1' | 'v2';
+    /**
+     * The V2 binding a grant request should carry (AUDIT P1 / RES-1).
+     *
+     * MEASURED before adding: the guard's authorize request sent only
+     * `include_execution_grant` and `state_nonce`, and the SDK's
+     * PreflightChangeSetRequest declares NEITHER these fields NOR `state_nonce` —
+     * the guard builds its own request literal and posts it as `unknown`, so the
+     * wire shape is guard-local. Adding them here is therefore a guard-side
+     * config surface, not a claim that the SDK type endorses them.
+     *
+     * Every one is OPTIONAL and every one is sent only when set. A deployment
+     * that does not configure a field gets it NAMED in the observation's
+     * `v2_fields_absent`, never a placeholder on the wire.
+     *
+     * ── DEPRECATED ALIASES (1198) ────────────────────────────────────────────
+     * The canonical home is the TOP LEVEL of the withCodeRifts input, where
+     * executorId/adapterId/targetUri already lived before this config existed
+     * (with-coderifts.ts:394-396) and where the ATOMIC construction check reads
+     * them. Setting them here still works and still reaches the wire — but a
+     * value here that DISAGREES with the top level is an initialization error,
+     * because the two used to feed different halves of the system with nothing
+     * reconciling them. See resolveV2Fields.
+     *
+     * Unreleased when this was written — added after the 14.1.0 release and never
+     * published — so no adopter depends on the nested spelling.
+     */
+    executorId?: string;
+    adapterId?: string;
+    targetUri?: string;
+    tenantId?: string;
+    policyHash?: string;
+    audienceHash?: string;
 };
+/**
+ * THE CANONICAL V2 FIELD SET (roadmap 1198).
+ *
+ * MEASURED SPLIT-BRAIN, which is what this exists to end:
+ *   · executorId / adapterId / targetUri lived in BOTH the top-level input
+ *     (with-coderifts.ts:394-396 → the ATOMIC construction check and the
+ *     posture tuple) and the nested executionGrant config (→ the authorize
+ *     request). Nothing compared them, so a configuration could bind the
+ *     profile to one executor and put another — or none — on the wire.
+ *   · policyHash had a READER and no writer: atomic-profile.ts:247 passes
+ *     `input.policyHash` to the posture verifier and with-coderifts.ts:911-915
+ *     never forwarded it, so that binding was permanently undefined.
+ *   · tenantId / audienceHash existed on the wire side only.
+ *
+ * This reads both spellings, REFUSES a disagreement, and returns one set that
+ * the wire and the profile both use. A field neither side supplies stays
+ * genuinely absent — the case 6bca531's named-absent was written for, and now
+ * the only case it covers.
+ */
+export declare const V2_FIELD_KEYS: readonly ["executorId", "adapterId", "targetUri", "tenantId", "policyHash", "audienceHash"];
+export type V2FieldKey = typeof V2_FIELD_KEYS[number];
+export type V2Fields = Partial<Record<V2FieldKey, string>>;
+/**
+ * Resolve the canonical set from an input carrying either spelling.
+ *
+ * THROWS on disagreement. Preferring one silently is what produced the split:
+ * a caller who set both would have one quietly ignored, with no way to see
+ * which one survived.
+ */
+export declare function resolveV2Fields(input?: {
+    executorId?: unknown;
+    adapterId?: unknown;
+    targetUri?: unknown;
+    tenantId?: unknown;
+    policyHash?: unknown;
+    audienceHash?: unknown;
+    executionGrant?: ExecutionGrantConfig | null;
+} | null): V2Fields;
+/** The V2 request fields, in the wire spelling. One list, used to send and to report. */
+export declare const V2_WIRE_FIELDS: readonly [readonly ["executor_id", "executorId"], readonly ["adapter_id", "adapterId"], readonly ["target_uri", "targetUri"], readonly ["tenant_id", "tenantId"], readonly ["policy_hash", "policyHash"], readonly ["audience_hash", "audienceHash"]];
+export type V2WireResult = {
+    /** Wire-name -> value, for the fields this deployment actually configured. */
+    fields: Record<string, string>;
+    /** Wire-names this deployment did NOT configure. Named, never placeheld. */
+    absent: string[];
+};
+/**
+ * Build the V2 field set for an authorize request.
+ *
+ * V1 sends nothing here: the fields describe a v2 binding, and attaching them
+ * to a v1 request would assert a shape the grant does not have.
+ *
+ * A value that is not a non-empty string is ABSENT, not empty-string-sent. An
+ * empty executor_id on the wire is indistinguishable from a real one that
+ * happens to be blank, and the server would bind it.
+ */
+export declare function v2WireFields(config: {
+    executionGrant?: ExecutionGrantConfig;
+} | null | undefined): V2WireResult;
 export type ExecutionGrantObservation = {
     requested: boolean;
     arrived: boolean;
+    /** Which grant shape was requested. */
+    grant_version?: 'v1' | 'v2';
+    /**
+     * The V2 binding this request actually carried, and what it could not.
+     * `v2_fields_absent` is the honest half: a field the deployment never
+     * configured is reported here rather than sent as an empty placeholder.
+     */
+    v2_fields_sent?: string[];
+    v2_fields_absent?: string[];
 };
 export type ExecutionGrantCallContext = {
     execution_grant: string | null;

package/dist/esm/execution-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}
+{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,iEAAiE;IACjE,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,6FAEf,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,CAAC,EAAE;IACtC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C,GAAG,IAAI,GAAG,QAAQ,CAiClB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,uPAOhB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG;IACzB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACnE,YAAY,CAiBd;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}

package/dist/esm/execution-grant.js

@@ -4,6 +4,104 @@
  * Grant request is per guardToolCall invocation (local vars). The token is not
  * a verdict input and is not folded into any fingerprint preimage.
  */
+/**
+ * THE CANONICAL V2 FIELD SET (roadmap 1198).
+ *
+ * MEASURED SPLIT-BRAIN, which is what this exists to end:
+ *   · executorId / adapterId / targetUri lived in BOTH the top-level input
+ *     (with-coderifts.ts:394-396 → the ATOMIC construction check and the
+ *     posture tuple) and the nested executionGrant config (→ the authorize
+ *     request). Nothing compared them, so a configuration could bind the
+ *     profile to one executor and put another — or none — on the wire.
+ *   · policyHash had a READER and no writer: atomic-profile.ts:247 passes
+ *     `input.policyHash` to the posture verifier and with-coderifts.ts:911-915
+ *     never forwarded it, so that binding was permanently undefined.
+ *   · tenantId / audienceHash existed on the wire side only.
+ *
+ * This reads both spellings, REFUSES a disagreement, and returns one set that
+ * the wire and the profile both use. A field neither side supplies stays
+ * genuinely absent — the case 6bca531's named-absent was written for, and now
+ * the only case it covers.
+ */
+export const V2_FIELD_KEYS = Object.freeze([
+    'executorId', 'adapterId', 'targetUri', 'tenantId', 'policyHash', 'audienceHash',
+]);
+/**
+ * Resolve the canonical set from an input carrying either spelling.
+ *
+ * THROWS on disagreement. Preferring one silently is what produced the split:
+ * a caller who set both would have one quietly ignored, with no way to see
+ * which one survived.
+ */
+export function resolveV2Fields(input) {
+    const top = (input || {});
+    const nested = ((input && input.executionGrant) || {});
+    const out = {};
+    const conflicts = [];
+    for (const key of V2_FIELD_KEYS) {
+        const t = typeof top[key] === 'string' && top[key].length > 0
+            ? top[key] : undefined;
+        const n = typeof nested[key] === 'string' && nested[key].length > 0
+            ? nested[key] : undefined;
+        if (t !== undefined && n !== undefined && t !== n) {
+            conflicts.push(`  ${key}: top-level ${JSON.stringify(t)} vs executionGrant.${key} ${JSON.stringify(n)}`);
+            continue;
+        }
+        const v = t !== undefined ? t : n;
+        if (v !== undefined)
+            out[key] = v;
+    }
+    if (conflicts.length > 0) {
+        const err = new Error('withCodeRifts: the V2 identity fields are configured in two places and they disagree.\n'
+            + `${conflicts.join('\n')}\n\n`
+            + 'These feed DIFFERENT halves of the system — the top level binds the ATOMIC construction '
+            + 'check and the posture receipt, the executionGrant copy goes on the authorize request — so '
+            + 'a disagreement builds a grant against one identity and verifies against another. Set each '
+            + 'field ONCE, at the top level; the executionGrant spelling is a deprecated alias.');
+        err.code = 'V2_FIELDS_CONFLICT';
+        throw err;
+    }
+    return out;
+}
+/** The V2 request fields, in the wire spelling. One list, used to send and to report. */
+export const V2_WIRE_FIELDS = Object.freeze([
+    ['executor_id', 'executorId'],
+    ['adapter_id', 'adapterId'],
+    ['target_uri', 'targetUri'],
+    ['tenant_id', 'tenantId'],
+    ['policy_hash', 'policyHash'],
+    ['audience_hash', 'audienceHash'],
+]);
+/**
+ * Build the V2 field set for an authorize request.
+ *
+ * V1 sends nothing here: the fields describe a v2 binding, and attaching them
+ * to a v1 request would assert a shape the grant does not have.
+ *
+ * A value that is not a non-empty string is ABSENT, not empty-string-sent. An
+ * empty executor_id on the wire is indistinguishable from a real one that
+ * happens to be blank, and the server would bind it.
+ */
+export function v2WireFields(config) {
+    const g = config && config.executionGrant;
+    const fields = {};
+    const absent = [];
+    if (!g || g.grantVersion !== 'v2') {
+        return { fields, absent: V2_WIRE_FIELDS.map(([wire]) => wire) };
+    }
+    // ONE SOURCE. Reading `config.executionGrant` directly here was half of the
+    // 1198 split: the profile read the top level and the wire read the nested
+    // copy, and a value set only at the top level never left the process.
+    const resolved = resolveV2Fields(config);
+    for (const [wire, key] of V2_WIRE_FIELDS) {
+        const v = resolved[key];
+        if (typeof v === 'string' && v.length > 0)
+            fields[wire] = v;
+        else
+            absent.push(wire);
+    }
+    return { fields, absent };
+}
 export function isExecutionGrantEnabled(config) {
     return !!(config && config.executionGrant && config.executionGrant.enabled === true);
 }

package/dist/esm/execution-grant.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-grant.js","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,MAAM,UAAU,uBAAuB,CAAC,MAAoE;IAC1G,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAI,QAA0C,CAAC,eAAe,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,EAAE,GAAG,MAAM,CAAE,CAAoB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAAoD,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiD,EACjD,IAAoE,EACpE,SAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAClF,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC;YACzB,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"execution-grant.js","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6CH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;CACxE,CAAC,CAAC;AAKZ;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAQxB;IACN,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAA4B,CAAC;IAClF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,GAAG,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC;YACvE,CAAC,CAAE,GAAG,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACrC,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,MAAM,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC;YAC7E,CAAC,CAAE,MAAM,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAExC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzG,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,yFAAyF;cACvF,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;cAC7B,0FAA0F;cAC1F,4FAA4F;cAC5F,4FAA4F;cAC5F,kFAAkF,CACrF,CAAC;QACD,GAAgC,CAAC,IAAI,GAAG,oBAAoB,CAAC;QAC9D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,WAAW,EAAE,UAAU,CAAC;IACzB,CAAC,aAAa,EAAE,YAAY,CAAC;IAC7B,CAAC,eAAe,EAAE,cAAc,CAAC;CACzB,CAAC,CAAC;AASZ;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAoE;IAEpE,MAAM,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAA+C,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAiB,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAoBD,MAAM,UAAU,uBAAuB,CAAC,MAAoE;IAC1G,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAI,QAA0C,CAAC,eAAe,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,EAAE,GAAG,MAAM,CAAE,CAAoB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAAoD,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiD,EACjD,IAAoE,EACpE,SAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAClF,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC;YACzB,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/esm/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAkehC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAqc1B"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAugBhC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAwe1B"}

package/dist/esm/guard.js

@@ -22,7 +22,9 @@ import { buildCasAttestation, evaluateCasEvidence, isExecuteIfUnchangedOutcome,
 import { deliverMonitoring, monitoringDeliveryFailClosed, } from './monitoring-delivery.js';
 import { tryIssueMonitoringAttestation } from './monitoring-attestation.js';
 import { observePolicyPresence } from './policy.js';
-import { isExecutionGrantEnabled, isSignerUnavailableError, readExecutionGrantToken, resolveStateNonceForCall, } from './execution-grant.js';
+import { buildDenyRemedy, denyErrorForReason } from './deny-remedy.js';
+import { readNextAgentStep } from './next-agent-step.js';
+import { isExecutionGrantEnabled, isSignerUnavailableError, v2WireFields, readExecutionGrantToken, resolveStateNonceForCall, } from './execution-grant.js';
 // Per-config breaker state (time-window; not consecutive).
 const breakers = new WeakMap();
 const nowMs = () => Date.now();
@@ -219,12 +221,43 @@ function coverageSnap(config) {
 function coverageOutcomeFieldsFrom(s) {
     return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
 }
-function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
+/**
+ * Every refusal the guard reaches before the factory runs. `call` is optional so
+ * the refusal does not depend on it: without it the outcome is exactly what it
+ * was before the remedy existed; with it the outcome additionally names the
+ * next step.
+ *
+ * The remedy is attached AFTER the verdict. No branch below reads it, and none
+ * can turn executed:false into anything else.
+ */
+function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs, call) {
     const commit_observation = {
         status: 'not_observed', observed_at: iso(), host_attestation: 'absent',
     };
     const base = { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
     const cov = coverageSnap(config);
+    // Only an UNAVAILABLE verdict carries a cause. A BLOCK or REQUEST_APPROVAL is a
+    // policy decision on a grant that verified fine — obtaining another grant is not
+    // the next step there, so those refusals carry no remedy.
+    const cause = 'cause' in verdict ? verdict.cause : null;
+    // I-1288f — the DECISION's step, from the envelope, and ONLY when this run verified
+    // the receipt. A BLOCK on an unverified envelope is still a BLOCK (the verdict does
+    // not soften), but the remediation text on it is unauthenticated: the response came
+    // over the network and nothing here bound it. SKIPPED and UNAVAILABLE verdicts carry
+    // no envelope at all, so `'envelope' in verdict` is the second guard.
+    const nextStep = ('envelope' in verdict && 'receiptVerified' in verdict
+        && verdict.receiptVerified === true)
+        ? readNextAgentStep(verdict.envelope)
+        : null;
+    const remedy = call
+        ? buildDenyRemedy({
+            error: denyErrorForReason(cause),
+            target: call.toolName || null,
+            // The guard's own input fingerprint, already sha256:<hex>.
+            fingerprint: fingerprint(call),
+            observed: { cause, resolution: 'resolution' in verdict ? verdict.resolution : null },
+        })
+        : null;
     const out = {
         ...base,
         proof: buildExecutionProof({
@@ -242,6 +275,8 @@ function blocked(config, verdict, preflighted, freshness, conditional_write, mon
         ...(monitoring_attestation ? { monitoring_attestation } : {}),
         ...coverageOutcomeFieldsFrom(cov),
         ...(grantObs ? { execution_grant: grantObs } : {}),
+        ...(remedy ? { remedy } : {}),
+        ...(nextStep ? { next_step: nextStep } : {}),
     };
     return attachPolicyPresence(out, config);
 }
@@ -495,7 +530,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         const v = unavailableVerdict({ cause: 'MISSING_ARTIFACT_CONTENT', failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
-        return blocked(config, v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, undefined, undefined, undefined, redacted);
     }
     // config validation: lkg policy requires an LkgStore.
     if (failPolicy === 'lkg' && !config.lkg) {
@@ -527,6 +562,30 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         request.include_execution_grant = true;
         if (nonceRes.nonce)
             request.state_nonce = nonceRes.nonce;
+        // ── V2 WIRE FIELDS (AUDIT P1 / RES-1) ────────────────────────────────────
+        // The builder used to send include_execution_grant and state_nonce and
+        // nothing else, so the V2 binding the config demanded never reached the
+        // wire. Each configured field is attached; each unconfigured one is NAMED
+        // in the observation rather than sent as an empty placeholder, which the
+        // server would otherwise bind as a real value.
+        const wire = v2WireFields(config);
+        if (config.executionGrant?.grantVersion === 'v2') {
+            request.grant_version = 'v2';
+            for (const [k, v] of Object.entries(wire.fields))
+                request[k] = v;
+        }
+        // Recorded ONLY for v2. On v1 these fields are not "absent" — they are not
+        // part of that grant shape at all, and stamping six absences onto every v1
+        // observation would report a gap where there is no field. It also keeps the
+        // v1 observation byte-identical for the callers already pinning it.
+        if (config.executionGrant?.grantVersion === 'v2') {
+            grantObs = {
+                ...grantObs,
+                grant_version: 'v2',
+                v2_fields_sent: Object.keys(wire.fields),
+                v2_fields_absent: wire.absent,
+            };
+        }
     }
     // request-attributable payload cap => PAYLOAD_TOO_LARGE (integrity) => closed.
     const cap = config.maxPayloadBytes ?? 1_000_000;
@@ -545,7 +604,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         if (pf.integrity) {
             emit(config, { type: 'breaker_tripped', at: iso(), cause: pf.cause });
             const v = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs, redacted);
         }
         // availability
         const availCause = pf.cause;
@@ -555,7 +614,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
             if (breakerTripped(config))
                 emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
             const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs, redacted);
         }
         if (failPolicy === 'open' && !breakerTripped(config)) {
             emit(config, { type: 'preflight_unavailable', at: iso(), cause: availCause, action: 'CONTINUE' });
@@ -574,7 +633,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         if (breakerTripped(config))
             emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-        return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
+        return blocked(config, v, false, basis, cw, undefined, undefined, grantObs, redacted);
     }
     // We have a response. Read the decision (envelope-first) and verify the receipt.
     const rd = readDecision(pf.response);
@@ -635,8 +694,8 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, detection.artifacts);
         return gate.decision === 'BLOCK'
-            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs)
-            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs);
+            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs, redacted)
+            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs, redacted);
     }
     const kind = gate.kind; // 'ALLOW' | 'MONITOR' — allow-class, safe, non-degraded, artifact-bound.
     // Native grant: allow-class authorize that requested a grant must RECEIVE one.
@@ -824,7 +883,7 @@ function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts,
     const v = unavailableVerdict({ cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
     const { basis } = freshnessFor(config, redacted, fctx, arts);
     const { basis: cw } = conditionalWriteFor(config, redacted, cwctx, arts);
-    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
+    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs, redacted);
 }
 function isExpired(envelope) {
     const exp = envelope.expires_at;