@coderifts/agent-guard 17.2.0 → 17.3.0

package/dist/cjs/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CA8DhB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC;;;WAGG;QACH,sCAAsC,CAAC,EAAE,OAAO,CAAC;QACjD,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACrG,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;CACnD,CAAC;AAwBF,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,uEAAuE;IACvE,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,EACjD,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,CA0CrB;AAED,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,wCAAwC,CAAC;AAC7H,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AA8CF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAiIhB"}

package/dist/cjs/cas-attestation.js

@@ -33,6 +33,30 @@ const LIMITS = Object.freeze({
     does_not_claim_host_cannot_bypass: true,
     does_not_claim_governance_redecision: true,
 });
+/**
+ * THE CORE PREDICATE, quoted rather than recomputed (1459).
+ *
+ * MEASURED before this wiring: the guard reached the right answer with a formula of its own —
+ * `receipt_verified && committed && class === 'executor_attested' && strictCommitObservation(...)`.
+ * Correct, and bespoke. The auditor's point is that a predicate written twice is a predicate that
+ * drifts, and the Atomic bypass was exactly that: two formulas for one question, disagreeing.
+ *
+ * So the guard now shapes its inputs and QUOTES `verifiedExecutionBinding`. The named shortfall
+ * states (UNAUTHORIZED / COMMIT_UNPROVEN / ONE_RUN_UNPROVEN / …) surface here as a result, so an
+ * operator reads the same vocabulary the CLI, Prove and conformance print.
+ *
+ * Loaded lazily and behind try/catch: a packaging fault must surface as NOT authorized, never as a
+ * crash inside the guard, and never as a silent fallback to the old local formula.
+ */
+function coreBinding() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+        return require('./vendor/verified-execution-binding.js');
+    }
+    catch (_) {
+        return null;
+    }
+}
 /**
  * Authenticate an execution grant against the pinned ISSUER keyring, through the vendored
  * canonical core (receipt-verifier verify-grant.js — cr.exec.v1 AND cr.exec.v2).
@@ -349,19 +373,85 @@ function buildCasAttestation(proof, outcome, opts = {}) {
     const indeterminate = cas.status === 'indeterminate';
     const cas_evidence = evaluateCasEvidence(outcome, opts);
     let authorized_and_committed = receipt_verified && cas.status === 'committed';
+    let binding = null;
     let authorized_and_host_reported_committed = false;
     // ENFORCING_STRICT: the existing derived name now requires executor_attested + kernel
     // cross-check. Non-strict keeps the 9.0.0 formula (receipt verified + clean commit).
-    if (opts.profile === 'ENFORCING_STRICT') {
-        const obs = strictCommitObservation(outcome, cas_evidence, opts);
-        authorized_and_committed = authorized_and_committed
-            && obs.commit_label === 'authorized_and_committed';
+    // ── ONE PREDICATE FOR BOTH ENFORCING PROFILES ────────────────────────────────────────────
+    //
+    // The intersection is computed by the vendored core; this block only SHAPES the guard's inputs
+    // into the core's vocabulary. `required` names the two authorities an enforcing guard can
+    // actually establish from a tool outcome: it holds a grant and an attestation, and it does not
+    // hold a prove artifact or a provider readback — asking the core for `one_run_root` here would
+    // report a shortfall about evidence this surface never receives.
+    const enforcingProfile = opts.profile === 'ENFORCING_STRICT' || opts.profile === 'ENFORCING_ATOMIC';
+    if (enforcingProfile) {
+        const core = coreBinding();
+        const from = intendedFromOutcome(outcome);
+        const grantToken = (opts.grant && String(opts.grant)) || (from.grant && String(from.grant)) || '';
+        const attToken = extractExecutorAttestationToken(outcome);
+        if (!core) {
+            // FAIL-CLOSED, and named. Falling back to the local formula would recreate the second
+            // predicate this change exists to remove.
+            authorized_and_committed = false;
+            binding = { state: 'UNAUTHORIZED', shortfalls: ['the vendored core predicate could not be loaded'] };
+        }
+        else {
+            const keyring = opts.grant_keyring && Array.isArray(opts.grant_keyring.keys)
+                ? new Map(opts.grant_keyring.keys
+                    .filter((k) => k && typeof k.kid === 'string' && typeof k.public_key_pem === 'string')
+                    .map((k) => [k.kid, {
+                        // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+                        publicKey: require('node:crypto').createPublicKey(k.public_key_pem),
+                        status: k.status || 'active',
+                        retired_at: null,
+                        compromised_at: null,
+                    }]))
+                : null;
+            const r = core.verifiedExecutionBinding({
+                receipt: { verified: receipt_verified },
+                grant: { token: grantToken, keyring, expectedKid: null, ...(Number.isFinite(opts.now) ? { now: opts.now } : {}) },
+                attestation: {
+                    token: attToken,
+                    registry: opts.registry,
+                    // The SDK's verifier, handed in rather than reimplemented — the core holds no
+                    // attestation format knowledge of its own.
+                    // eslint-disable-next-line @typescript-eslint/no-var-requires, global-require
+                    verify: (t, o) => require('@coderifts/sdk').verifyExecutionAttestation(t, o),
+                },
+                committed: cas.status === 'committed',
+                required: ['issuer_grant', 'executor_attestation'],
+            });
+            binding = { state: r.state, shortfalls: r.shortfalls };
+            authorized_and_committed = r.authorized_and_committed === true;
+        }
     }
     if (opts.profile === 'ENFORCING_ATOMIC') {
-        const executorOk = cas_evidence.class === 'executor_attested';
+        // ── REPRODUCED THEN CLOSED (1447 / 1459) ────────────────────────────────────────────
+        //
+        // This branch used to read:
+        //
+        //     authorized_and_committed = receipt_verified && committed && class === 'executor_attested'
+        //
+        // and never asked whether the GRANT was signed by anyone. Measured on the public 17.2.0, with
+        // a forged-signature grant and a REAL attestation from a trusted executor bound to that
+        // grant's jti and scope:
+        //
+        //     ENFORCING_STRICT  authorized_and_committed = false
+        //     ENFORCING_ATOMIC  authorized_and_committed = true
+        //
+        // Two profiles of one product, one set of bytes, opposite answers. The attestation was doing
+        // all the work, and an attestation only ever says "I committed the grant with these ids" — it
+        // cannot say the ids belonged to a grant anyone authorized.
+        //
+        // BOTH branches now QUOTE the same predicate rather than each computing a formula. Strict is
+        // unchanged in behaviour and Atomic is brought up to it, which is the direction a disagreement
+        // between two enforcing profiles has to be resolved in.
+        // The verdict itself now comes from the core above — both enforcing profiles quote it, which
+        // is what makes them incapable of disagreeing. This branch keeps only the ATOMIC-only
+        // OBSERVATION name, which is a different fact and was never part of the bypass.
         const hostClaimed = cas_evidence.class === 'host_claimed';
         authorized_and_host_reported_committed = receipt_verified && cas.status === 'committed' && hostClaimed;
-        authorized_and_committed = receipt_verified && cas.status === 'committed' && executorOk;
     }
     const attestation = {
         attestation_spec: exports.CAS_ATTESTATION_SPEC,
@@ -382,6 +472,8 @@ function buildCasAttestation(proof, outcome, opts = {}) {
             ...(opts.profile === 'ENFORCING_ATOMIC'
                 ? { authorized_and_host_reported_committed }
                 : {}),
+            // The core's NAMED state, carried so an operator reads why rather than only whether.
+            ...(binding ? { authorization_state: binding.state } : {}),
         }),
         cas_evidence,
         limits: LIMITS,

package/dist/cjs/cas-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0MH,8CA8CC;AA6DD,0DAeC;AAmBD,0EAYC;AAqBD,kDAyDC;AAGD,sDAQC;AAGD,kEAuBC;AAgDD,kDAkEC;AAtkBD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA8JH;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAIY,QAAA,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,+BAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,GAAG,wBAAwB;eAC9C,GAAG,CAAC,YAAY,KAAK,0BAA0B,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,KAAK,mBAAmB,CAAC;QAC9D,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;QACvG,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC;IAC1F,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAgOH,8CA8CC;AA6DD,0DAeC;AAmBD,0EAYC;AAqBD,kDAyDC;AAGD,sDAQC;AAGD,kEAuBC;AAgDD,kDAqIC;AA/pBD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AAqJH;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9B,CAAC;AAWD;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAIY,QAAA,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,+BAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,OAAO,GAAqD,IAAI,CAAC;IACrE,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IACpG,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sFAAsF;YACtF,0CAA0C;YAC1C,wBAAwB,GAAG,KAAK,CAAC;YACjC,OAAO,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC1E,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;qBAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;qBACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBAClB,8EAA8E;wBAC9E,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;wBACnE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBACtC,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBACvC,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjH,WAAW,EAAE;oBACX,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,8EAA8E;oBAC9E,2CAA2C;oBAC3C,8EAA8E;oBAC9E,MAAM,EAAE,CAAC,CAAS,EAAE,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC9F;gBACD,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW;gBACrC,QAAQ,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACvD,wBAAwB,GAAG,CAAC,CAAC,wBAAwB,KAAK,IAAI,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,uFAAuF;QACvF,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,yBAAyB;QACzB,EAAE;QACF,yDAAyD;QACzD,wDAAwD;QACxD,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4DAA4D;QAC5D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,wDAAwD;QACxD,6FAA6F;QAC7F,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,qFAAqF;YACrF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cjs/vendor/VENDOR.sha256

@@ -23,14 +23,16 @@
 #
 #   verify.js                   6048195c0bcf7e2594a2d78e83cfc082ea615790
 #   arity.js                    724aa9ae8171f1acf629c3c6b4879dc056575f20
-#   verify-grant.js             724aa9ae8171f1acf629c3c6b4879dc056575f20
+#   verify-grant.js             a472bf9073781cba25d83c7d1406b1a7c4af0b94
 #   verify-prove-transcript.js  724aa9ae8171f1acf629c3c6b4879dc056575f20
+#   verified-execution-binding.js  1e41542296551139c41e2d4b4cff2e67bc42aa06
 #   verify-evidence.js          724aa9ae8171f1acf629c3c6b4879dc056575f20
 #   keys/coderifts-keys.json    724aa9ae8171f1acf629c3c6b4879dc056575f20
 
 verify.js  363e52c72ec4b913e1f3edc8e2029848feaeacb1efa6c07960fe5e5f195c23b3
 arity.js  721fcac58b960b5e2aa1af91edb6cfc87ebe828a6da73879967ef79a1ca474e8
-verify-grant.js  a285b021b32cc9c70c963de042154dc6be7175cdeaf722a88cc7699651a7c1ea
+verify-grant.js  127b53de3be77196862c10a8812221de0a5112cf1d3feae12d347a6021852df7
 verify-prove-transcript.js  3bb17bd4f16d5ee3cf3fbb754b4df9aa570a615ca94ff2a97b751c4fabd3bd0d
 verify-evidence.js  7ca498fad4b23e4ae8f28c42c30058bc3526a00d5cc6d6f36380335bf25d3288
+verified-execution-binding.js  e48ea29b9f8b0c5b1754187788cbaf78cdaf0b505848c05d1ae3ffebb30218f2
 keys/coderifts-keys.json  bfe0c898cda3c3a4c8141726d0adb4cdb7eb9762de6264e430eff6469b90422e

package/dist/cjs/vendor/verified-execution-binding.js

@@ -0,0 +1,316 @@
+'use strict';
+
+/**
+ * verifiedExecutionBinding — the ONE predicate that answers "authorized and committed".
+ *
+ * ── WHY ONE (1459) ──────────────────────────────────────────────────────────────────────────
+ *
+ * The same question was being answered in several places with different rules, and the answers
+ * disagreed. Measured on the public agent-guard 17.2.0, with a forged-signature grant and a REAL
+ * attestation from a trusted executor bound to that grant's jti and scope:
+ *
+ *     ENFORCING_STRICT  authorized_and_committed = false
+ *     ENFORCING_ATOMIC  authorized_and_committed = true
+ *
+ * Two profiles of one product, looking at one set of bytes, reaching opposite conclusions — because
+ * the Atomic formula was `receipt_verified && committed && class === 'executor_attested'` and never
+ * asked whether the GRANT was signed by anyone. A predicate that is recomputed is a predicate that
+ * drifts; this file exists so callers QUOTE the answer instead.
+ *
+ * ── FOUR AUTHORITIES, AND ONLY THEIR INTERSECTION ───────────────────────────────────────────
+ *
+ * Each is independently true or not, and each answers a different question. None of them implies
+ * another, which is exactly why the intersection — not any one of them — is the success condition:
+ *
+ *   issuer_grant          did CodeRifts authorize THIS change?      (a signature under a pinned key)
+ *   executor_attestation  did the executor commit THAT grant?       (a signature over the grant's ids)
+ *   one_run_root          are these bytes from ONE run?             (cr.evidence.root.v1 digests)
+ *   provider_witness      did the provider record it?               (a readback — UNSIGNED by nature)
+ *
+ * ── SHORTFALLS ARE NAMED, NOT FOLDED INTO `false` ───────────────────────────────────────────
+ *
+ * "Not authorized" and "authorized but the commit is unproven" are different facts with different
+ * remedies, and a boolean loses that. Every shortfall gets a state a human can act on, and the
+ * states are ORDERED by severity so the returned one is the most serious thing that is wrong.
+ *
+ * WHAT THIS DOES NOT DO. It reaches no network and holds no keys: every input is supplied by the
+ * caller, already-verified or verifiable, and the four authorities are recomputed here from those
+ * inputs rather than taken as claims. It also cannot see a lying executor — the root closes
+ * third-party splicing, not an executor misreporting its own run.
+ */
+
+const crypto = require('node:crypto');
+
+const { verifyExecutionGrant } = require('./verify-grant.js');
+const { verifyEvidenceRootBinding } = require('./verify-evidence.js');
+
+const BINDING_V = 'cr.verified-execution-binding.v1';
+
+/**
+ * Ordered most-severe first. The returned `state` is the FIRST unmet one, so a caller that renders
+ * a single line renders the thing that most needs fixing.
+ */
+const STATE = Object.freeze({
+  UNAUTHORIZED: 'UNAUTHORIZED',
+  COMMIT_UNPROVEN: 'COMMIT_UNPROVEN',
+  ONE_RUN_UNPROVEN: 'ONE_RUN_UNPROVEN',
+  RECORDED_UNWITNESSED: 'RECORDED_UNWITNESSED',
+  NOT_COMMITTED: 'NOT_COMMITTED',
+  AUTHORIZED_AND_COMMITTED: 'AUTHORIZED_AND_COMMITTED',
+});
+
+/** What each authority is allowed to be missing for, so a caller can choose its own strictness. */
+const AUTHORITY = Object.freeze({
+  ISSUER_GRANT: 'issuer_grant',
+  EXECUTOR_ATTESTATION: 'executor_attestation',
+  ONE_RUN_ROOT: 'one_run_root',
+  PROVIDER_WITNESS: 'provider_witness',
+});
+
+const sha256pref = (v) =>
+  `sha256:${crypto.createHash('sha256').update(String(v), 'utf8').digest('hex')}`;
+
+const b64json = (seg) => {
+  try { return JSON.parse(Buffer.from(seg, 'base64url').toString('utf8')); } catch (_) { return null; }
+};
+
+/** The four fields an attestation binds, read from its own signed preimage. */
+function attestationClaims(token) {
+  if (typeof token !== 'string') return null;
+  const seg = token.split('|');
+  if (seg.length !== 4 || !seg[2]) return null;
+  const body = b64json(seg[2]);
+  return body && typeof body === 'object' ? body : null;
+}
+
+/** The grant's identity, in one vocabulary across v1 and v2. */
+function grantClaims(token) {
+  if (typeof token !== 'string') return null;
+  const body = b64json(String(token).split('.')[0]);
+  if (!body || typeof body !== 'object') return null;
+  return {
+    v: body.v,
+    jti: body.grant_id || body.jti || null,
+    scope_hash: body.after_payload_hash || body.scope_hash || null,
+    receipt_hash: body.receipt_hash || body.receipt_digest || null,
+    operation: body.operation || null,
+    // The rest of what a grant SAYS, so the attestation can be checked against all of it rather
+    // than against the two fields that happened to be compared first.
+    target: body.target_uri || body.target_id || null,
+    tenant_id: body.tenant_id || null,
+    executor_id: body.executor_id || null,
+    adapter_id: body.adapter_id || null,
+    audience: body.audience_hash || body.audience || null,
+    policy_hash: body.policy_hash || null,
+    state_token: body.expected_state_token || body.state_nonce || null,
+  };
+}
+
+/**
+ * @param {object} o
+ * @param {{verified: boolean, token?: string}} o.receipt
+ * @param {{token: string, publicKey?, keyring?, intended?: object, now?: number}} o.grant
+ *        THE EXACT BYTES THE ISSUER SIGNED. Not a grant read back out of a tool result: a caller
+ *        that lets the executed tool hand back its own authorization has already lost.
+ * @param {{token: string, registry?: object, verify?: Function}} [o.attestation]
+ * @param {{artifact: object, executorKey}} [o.evidenceRoot]
+ * @param {{signed: boolean}} [o.providerReadback]
+ * @param {boolean} o.committed
+ * @param {string[]} [o.required]  authorities this caller demands; default: grant + attestation.
+ */
+function verifiedExecutionBinding(o = {}) {
+  const required = new Set(Array.isArray(o.required) && o.required.length
+    ? o.required
+    : [AUTHORITY.ISSUER_GRANT, AUTHORITY.EXECUTOR_ATTESTATION]);
+  const shortfalls = [];
+  const authorities = {};
+  const note = (name, ok, detail) => {
+    authorities[name] = { ok, required: required.has(name), detail };
+    if (!ok && required.has(name)) shortfalls.push(`${name}: ${detail}`);
+    return ok;
+  };
+
+  // ── 1. THE ISSUER GRANT ────────────────────────────────────────────────────────────────
+  const g = o.grant || {};
+  let grantOk = false;
+  let gClaims = null;
+  if (typeof g.token !== 'string' || g.token.length === 0) {
+    note(AUTHORITY.ISSUER_GRANT, false, 'no execution grant was supplied');
+  } else if (!g.publicKey && !g.keyring) {
+    // FAIL-CLOSED, and named as its own thing: "we had no key" is not "the signature was bad".
+    note(AUTHORITY.ISSUER_GRANT, false,
+      'no pinned issuer keyring was supplied, so the grant could not be authenticated');
+  } else {
+    const r = verifyExecutionGrant(g.token, {
+      ctx: { publicKey: g.publicKey, keyring: g.keyring, expectedKid: g.expectedKid ?? null },
+      ...(g.intended ? { intended: g.intended } : {}),
+      ...(Number.isFinite(g.now) ? { now: g.now } : {}),
+    });
+    gClaims = grantClaims(g.token);
+    grantOk = note(AUTHORITY.ISSUER_GRANT, r.valid === true,
+      `${r.status}${r.reason ? `/${r.reason}` : ''}`);
+  }
+
+  // ── 2. THE EXECUTOR ATTESTATION ────────────────────────────────────────────────────────
+  const a = o.attestation || {};
+  let attOk = false;
+  if (typeof a.token !== 'string' || a.token.length === 0) {
+    note(AUTHORITY.EXECUTOR_ATTESTATION, false, 'no executor attestation was supplied');
+  } else if (typeof a.verify !== 'function') {
+    note(AUTHORITY.EXECUTOR_ATTESTATION, false,
+      'no attestation verifier was supplied, so the commit could not be checked');
+  } else {
+    const r = a.verify(a.token, { registry: a.registry });
+    const sigOk = r && r.valid === true;
+    // BOUND TO THE VERIFIED GRANT'S OWN IDS — not to ids the caller passed alongside. This is the
+    // join that makes the two signatures one statement instead of two unrelated true things.
+    const c = attestationClaims(a.token);
+    // ── THE ATTESTATION MUST BIND THE SAME EXECUTION, NOT MERELY THE SAME NAMES (1464) ────
+    //
+    // REPRODUCED before this was written. A correctly-signed grant bound to receipt R1, and a
+    // correctly-signed attestation from a trusted executor bound to receipt R2, sharing a
+    // grant_jti and a scope_hash — R1 != R2 — read AUTHORIZED_AND_COMMITTED. Both signatures are
+    // real; the two documents describe DIFFERENT executions and the join could not tell.
+    //
+    // `jti` and `scope_hash` are the two fields an attacker controls most cheaply: they are copied
+    // FROM the grant into the attestation by whoever assembles the pair. Comparing only those is
+    // comparing a value with its own copy. What binds is the receipt each side was issued against,
+    // and — the strongest available — the sha256 of the exact grant token bytes.
+    const attReceipt = c ? String(c.receipt_digest || '') : '';
+    const grantReceipt = gClaims ? String(gClaims.receipt_hash || '') : '';
+    const mismatch = (() => {
+      if (!sigOk) return `attestation ${r ? r.status : 'unverifiable'}`;
+      if (!gClaims) return 'there is no verified grant for the attestation to bind';
+      if (String(c.grant_jti || '') !== String(gClaims.jti || '')) {
+        return 'the attestation binds a different grant id than the verified grant';
+      }
+      if (String(c.scope_hash || '') !== String(gClaims.scope_hash || '')) {
+        return 'the attestation binds a different scope than the verified grant';
+      }
+      // THE CROSS-RECEIPT CHECK. Empty on either side is a mismatch: an attestation that names no
+      // receipt cannot be shown to be about this authorization, and "unstated" must not read as
+      // "the same".
+      if (!attReceipt || !grantReceipt || attReceipt !== grantReceipt) {
+        return `the grant was issued against receipt ${grantReceipt || '(none)'} and the `
+          + `attestation commits receipt ${attReceipt || '(none)'} — two different executions`;
+      }
+      // ── WHAT cr.exec.attest.v1 CAN AND CANNOT BE ASKED ──────────────────────────────
+      //
+      // MEASURED, and it bounds this check rather than the check bounding the format: the
+      // attestation body is a CLOSED set — executor_kid, grant_jti, receipt_digest, scope_hash,
+      // committed_at, state_nonce, result_digest, meta. Any other key is refused
+      // ATTEST_MALFORMED / unknown_field by its own verifier.
+      //
+      // So target, operation, tenant, executor, adapter, audience and policy CANNOT be
+      // cross-checked here: the attestation never states them, and a comparison against a field
+      // that cannot exist is not a check — it is a line that always passes. They are named in
+      // `does_not_prove` instead, which is the honest place for a binding the format cannot carry.
+      //
+      // The same is true of the exact grant-token digest: there is no field for it. Binding the
+      // grant BYTES rather than its claims would be the tightest join available and it needs a
+      // format change (a `grant_token_digest` slot in cr.exec.attest.v2), not a check here.
+      //
+      // What the format DOES let us bind is the state nonce, and it is bound below.
+      if (gClaims.state_token != null && c.state_nonce != null
+        && String(gClaims.state_token) !== String(c.state_nonce)) {
+        return 'the grant and the attestation disagree about the state nonce';
+      }
+      return null;
+    })();
+    attOk = note(AUTHORITY.EXECUTOR_ATTESTATION, mismatch === null, mismatch || 'bound');
+  }
+
+  // ── 3. ONE RUN ─────────────────────────────────────────────────────────────────────────
+  const er = o.evidenceRoot || null;
+  if (!er || !er.artifact) {
+    note(AUTHORITY.ONE_RUN_ROOT, false,
+      'no cr.evidence.root.v1 was supplied, so these bytes are not shown to be one run');
+  } else {
+    const r = verifyEvidenceRootBinding(er.artifact, { executorKey: er.executorKey, sidecars: er.sidecars });
+    note(AUTHORITY.ONE_RUN_ROOT, r.ok === true, r.ok ? 'bound' : (r.failures[0] || 'unbound'));
+  }
+
+  // ── 4. THE PROVIDER WITNESS ────────────────────────────────────────────────────────────
+  // A readback is an UNSIGNED document by nature. It is carried, not verified, and this authority
+  // is false unless a caller states it was witnessed some stronger way — never true by default.
+  // ── A CALLER BOOLEAN IS NOT EVIDENCE (1465) ────────────────────────────────────────────
+  //
+  // REPRODUCED before this was written:
+  //
+  //   required: ['provider_witness'], receipt: {verified: true},
+  //   providerReadback: {signed: true}, committed: true, NO grant, NO attestation, NO root
+  //     → AUTHORIZED_AND_COMMITTED, shortfalls: []
+  //
+  // `signed: true` was a bare boolean the caller wrote, and this function aggregated it into a
+  // global success. Nothing was verified; a field named `signed` was believed because it was set.
+  //
+  // A witness now requires a VERIFIED witness envelope: bytes plus a verifier plus a trust anchor.
+  // No such format exists yet (phase D measured that the readback is unsigned by nature), so this
+  // authority cannot currently be satisfied at all — and saying that plainly is the honest answer.
+  // Asking for it yields RECORDED_UNWITNESSED, which is exactly what it means.
+  //
+  // NOT a breaking change for the five consumers: none of them requires `provider_witness` today
+  // (guard and contract-gate ask for issuer_grant + executor_attestation; prove and conformance for
+  // issuer_grant + one_run_root). It removes a way to LIE, not a way anyone works.
+  const pw = o.providerReadback || null;
+  const witnessVerified = !!(pw && pw.verified === true && pw.envelope && pw.verifier);
+  note(AUTHORITY.PROVIDER_WITNESS, witnessVerified,
+    pw
+      ? (pw.signed === true && !witnessVerified
+        ? 'the caller asserted `signed: true` and supplied no verifiable witness envelope — a '
+          + 'boolean is not evidence, and no signed-witness format exists yet'
+        : 'the provider readback is an unsigned document (carried, not verified)')
+      : 'no provider readback was supplied');
+
+  // ── THE INTERSECTION ───────────────────────────────────────────────────────────────────
+  const committed = o.committed === true;
+  // THE RECEIPT, and what this function can honestly say about it.
+  //
+  // `verified` is the CALLER's determination: this core is not given the receipt token or a
+  // keyring, so it cannot re-establish it. That is recorded rather than hidden — a reader of the
+  // result can see whether the receipt was verified HERE or asserted by whoever called.
+  //
+  // Left as-is deliberately: making a bare boolean insufficient would change the input shape of
+  // all five consumers at once, and that belongs with the closed-profile work (1465), not
+  // half-done in a round that would leave them broken. The gap is named, not narrowed in silence.
+  const receiptOk = !!(o.receipt && o.receipt.verified === true);
+  const receiptAsserted = receiptOk && !(o.receipt.token && (o.receipt.keyring || o.receipt.publicKey));
+  if (!receiptOk) shortfalls.unshift('receipt: the decision receipt did not verify');
+
+  let state = STATE.AUTHORIZED_AND_COMMITTED;
+  if (!receiptOk || (required.has(AUTHORITY.ISSUER_GRANT) && !grantOk)) state = STATE.UNAUTHORIZED;
+  else if (required.has(AUTHORITY.EXECUTOR_ATTESTATION) && !attOk) state = STATE.COMMIT_UNPROVEN;
+  else if (required.has(AUTHORITY.ONE_RUN_ROOT) && !authorities[AUTHORITY.ONE_RUN_ROOT].ok) {
+    state = STATE.ONE_RUN_UNPROVEN;
+  } else if (required.has(AUTHORITY.PROVIDER_WITNESS) && !authorities[AUTHORITY.PROVIDER_WITNESS].ok) {
+    state = STATE.RECORDED_UNWITNESSED;
+  } else if (!committed) state = STATE.NOT_COMMITTED;
+
+  return {
+    v: BINDING_V,
+    authorized_and_committed: state === STATE.AUTHORIZED_AND_COMMITTED,
+    state,
+    authorities,
+    shortfalls,
+    /** True when `receipt.verified` was taken on the caller's word rather than established here. */
+    receipt_caller_asserted: receiptAsserted,
+    // Said out loud so a caller cannot read success as more than it is.
+    does_not_prove: [
+      'that the executor told the truth about its own run — the evidence root closes third-party '
+      + 'splicing, not an executor misreporting itself',
+      'that a provider merged anything; `provider_witness` is an unsigned readback unless a caller '
+      + 'states otherwise',
+      'that the grant and the attestation agree about target, operation, tenant, executor, adapter, '
+      + 'audience or policy — cr.exec.attest.v1 is a closed field set that states none of them, so '
+      + 'those are UNCHECKED here rather than checked and equal (1464)',
+      'that the attestation commits the exact grant BYTES — the format carries no grant-token '
+      + 'digest, so the join is over the grant id, scope, receipt and state nonce',
+      ...(receiptAsserted
+        ? ['that the decision receipt verifies — `receipt.verified` was asserted by the caller and '
+          + 'not established here; this core is given no receipt token or keyring to check it with']
+        : []),
+    ],
+  };
+}
+
+module.exports = { verifiedExecutionBinding, STATE, AUTHORITY, BINDING_V, grantClaims, attestationClaims };

package/dist/cjs/vendor/verify-grant.js

@@ -70,8 +70,39 @@ function scalar(v) {
   return v == null ? '' : String(v);
 }
 
+/**
+ * cr.exec.v1 OPTIONAL signed fields — the ATOMIC profile's, and a DELIBERATE widening (1470).
+ *
+ * ── MEASURED BEFORE OPENING THE SET ─────────────────────────────────────────────────────────
+ *
+ * This verifier's allowed set was `['v', ...SIGNED_FIELDS]`, so a v1 grant carrying `state_nonce`
+ * read MALFORMED / unknown_field. That grant is not malformed: it is what the demo executor issues
+ * for the ATOMIC profile, and capability-demo's middleware has always signed and accepted it
+ * (OPTIONAL_SIGNED_FIELDS = ['state_nonce', 'deployment_id']). Fail-CLOSED, and wrong — this core
+ * is vendored into five consumers, so every one of them refused a valid ATOMIC grant.
+ *
+ * ── WHY WIDENING IS SAFE HERE, AND WHY IT IS STILL A DECISION ───────────────────────────────
+ *
+ * These fields are SIGNED: appended to the preimage, so a forger cannot add one without breaking
+ * the signature. The closed set never protected against injection; it protects against SEMANTIC
+ * DRIFT — a future field that RESTRICTS use must not be silently ignored by an older verifier that
+ * then says GRANT_CURRENT. `state_nonce` and `deployment_id` do not restrict: they NARROW, and a
+ * verifier that ignores them is not more permissive than one that does not know them.
+ *
+ * So the set is widened BY NAME, not opened. An actually-unknown field is still unknown_field, and
+ * test/v1-atomic-optional-fields.test.js records both halves so the next change is a decision
+ * rather than a rediscovery.
+ *
+ * ── APPENDED ONLY WHEN NON-EMPTY ────────────────────────────────────────────────────────────
+ *
+ * Byte-identical to capability-demo/packages/middleware/src/verify-grant.js. A BEARER grant's
+ * signing input must stay exactly what it was before ATOMIC existed, or every pre-ATOMIC issuance
+ * stops verifying — which is why presence, not declaration, decides the slot.
+ */
+const V1_OPTIONAL_SIGNED_FIELDS = Object.freeze(['state_nonce', 'deployment_id']);
+
 function reconstructSignedInput(payload) {
-  return [
+  const parts = [
     SIGNING_PREFIX,
     scalar(payload.kid),
     scalar(payload.receipt_digest),
@@ -82,7 +113,11 @@ function reconstructSignedInput(payload) {
     scalar(payload.jti),
     scalar(payload.iat),
     scalar(payload.exp),
-  ].join('|');
+  ];
+  for (const k of V1_OPTIONAL_SIGNED_FIELDS) {
+    if (payload[k] != null && String(payload[k]).length > 0) parts.push(String(payload[k]));
+  }
+  return parts.join('|');
 }
 
 function sha256pref(s) {
@@ -262,13 +297,19 @@ function verifyExecutionGrantInner(token, ctx, opts = {}) {
       return { valid: false, status: 'MALFORMED', reason: 'missing_field', payload };
     }
   }
-  const allowed = new Set(['v', ...SIGNED_FIELDS]);
+  const allowed = new Set(['v', ...SIGNED_FIELDS, ...V1_OPTIONAL_SIGNED_FIELDS]);
   for (const k of Object.keys(payload)) {
     if (!allowed.has(k)) {
       return { valid: false, status: 'MALFORMED', reason: 'unknown_field', payload };
     }
   }
 
+  for (const k of V1_OPTIONAL_SIGNED_FIELDS) {
+    if (payload[k] != null && typeof payload[k] !== 'string') {
+      return { valid: false, status: 'MALFORMED', reason: 'missing_field', payload };
+    }
+  }
+
   // 3. delimiter guard
   for (const k of SIGNED_FIELDS) {
     if (payload[k].includes('|')) {
@@ -513,6 +554,7 @@ module.exports = {
   SIGNING_PREFIX,
   SIGNING_PREFIX_V2,
   SIGNED_FIELDS,
+  V1_OPTIONAL_SIGNED_FIELDS,
   CLOCK_SKEW_LEEWAY_MS,
   isIssuedInFuture,
 };