@coderifts/agent-guard 17.3.0 → 17.3.2

package/dist/esm/cas-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AAqJH;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9B,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAID,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,uBAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,oBAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,OAAO,GAAqD,IAAI,CAAC;IACrE,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IACpG,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sFAAsF;YACtF,0CAA0C;YAC1C,wBAAwB,GAAG,KAAK,CAAC;YACjC,OAAO,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC1E,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;qBAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;qBACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBAClB,8EAA8E;wBAC9E,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;wBACnE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBACtC,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBACvC,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjH,WAAW,EAAE;oBACX,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,8EAA8E;oBAC9E,2CAA2C;oBAC3C,8EAA8E;oBAC9E,MAAM,EAAE,CAAC,CAAS,EAAE,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC9F;gBACD,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW;gBACrC,QAAQ,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACvD,wBAAwB,GAAG,CAAC,CAAC,wBAAwB,KAAK,IAAI,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,uFAAuF;QACvF,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,yBAAyB;QACzB,EAAE;QACF,yDAAyD;QACzD,wDAAwD;QACxD,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4DAA4D;QAC5D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,wDAAwD;QACxD,6FAA6F;QAC7F,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,oBAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,qFAAqF;YACrF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA8JH;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,8EAA8E;QAC9E,OAAO,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9B,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,OAAiD,EACjD,GAAY;IAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;gBAAE,SAAS;YACtF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACd,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;gBAC5B,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE;YACzC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;YAC/B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,OAAO,IAAI,2CAA2C;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAID,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;WACtC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC1E,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAEpC,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2CAA2C;IAC3C,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4EAA4E;IAC5E,EAAE;IACF,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IAC7F,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,uBAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,oBAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;eAC/B,CAAC,CAAC,MAAM,KAAK,0BAA0B;eACvC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC;eAClC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,SAAkB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;IACrD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,IAAI,OAAO,GAAqD,IAAI,CAAC;IACrE,IAAI,sCAAsC,GAAG,KAAK,CAAC;IACnD,sFAAsF;IACtF,qFAAqF;IACrF,4FAA4F;IAC5F,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,+FAA+F;IAC/F,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,CAAC;IACpG,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,sFAAsF;YACtF,0CAA0C;YAC1C,wBAAwB,GAAG,KAAK,CAAC;YACjC,OAAO,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACvG,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;gBACrF,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI;qBAChC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,cAAc,CAAC;qBAClD,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBACvB,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;wBACrC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC1E,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI;qBAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;qBACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBAClB,8EAA8E;wBAC9E,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;wBACnE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;wBAC5B,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC;gBACtC,mFAAmF;gBACnF,EAAE;gBACF,yFAAyF;gBACzF,0FAA0F;gBAC1F,sFAAsF;gBACtF,EAAE;gBACF,2FAA2F;gBAC3F,uFAAuF;gBACvF,0FAA0F;gBAC1F,6EAA6E;gBAC7E,OAAO,EAAE,IAAI,CAAC,aAAa;oBACzB,CAAC,CAAC;wBACA,KAAK,EAAE,IAAI,CAAC,aAAa;wBACzB,OAAO,EAAE,cAAc;wBACvB,WAAW,EAAE,IAAI;wBACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxD;oBACD,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjH,WAAW,EAAE;oBACX,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,8EAA8E;oBAC9E,2CAA2C;oBAC3C,8EAA8E;oBAC9E,MAAM,EAAE,CAAC,CAAS,EAAE,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC9F;gBACD,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW;gBACrC,QAAQ,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC;aACnD,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACvD,oFAAoF;YACpF,EAAE;YACF,0FAA0F;YAC1F,uFAAuF;YACvF,4FAA4F;YAC5F,wEAAwE;YACxE,EAAE;YACF,0FAA0F;YAC1F,wFAAwF;YACxF,wBAAwB,GAAG,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,uFAAuF;QACvF,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,8FAA8F;QAC9F,wFAAwF;QACxF,yBAAyB;QACzB,EAAE;QACF,yDAAyD;QACzD,wDAAwD;QACxD,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,4DAA4D;QAC5D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,wDAAwD;QACxD,6FAA6F;QAC7F,sFAAsF;QACtF,gFAAgF;QAChF,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,KAAK,cAAc,CAAC;QAC1D,sCAAsC,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,WAAW,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,oBAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;YACP,aAAa;YACb,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,sCAAsC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,qFAAqF;YACrF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/esm/vendor/VENDOR.sha256

@@ -15,24 +15,61 @@
 # against an unauthenticated document is not a binding.
 #
 # Do not edit these files here. Recopy from receipt-verifier and re-pin.
-# PER-FILE PROVENANCE, mixed on purpose. Collapsing this to one revision would lie: verify.js is
-# pinned at 6048195 and has NOT been recopied, because 1306's keyring-shape fix is the behaviour
-# this guard was tested against and recopying HEAD would change a verifier nobody measured again.
-# The 1423 evidence core is vendored at HEAD. test/vendor-parity.test.js checks each file against
-# ITS OWN revision, not against HEAD, so an honest mixed pin does not read as drift.
+# PER-FILE PROVENANCE, RETIRED. It said verify.js was held at 6048195 because "recopying HEAD
+# would change a verifier nobody measured again" — true when written. MEASURED before retiring it:
+# the 6048195 -> v1.0.0 delta on verify.js is ZERO non-comment lines (CLI usage docs), so the
+# reason did not apply to this delta. verify-evidence.js was older still and did not export
+# verifyEvidenceRootBinding at all, which is why the shared core needed a fail-closed guard against
+# its own missing dependency. The core is now ONE released tag.
 #
 #   verify.js                   6048195c0bcf7e2594a2d78e83cfc082ea615790
 #   arity.js                    724aa9ae8171f1acf629c3c6b4879dc056575f20
 #   verify-grant.js             a472bf9073781cba25d83c7d1406b1a7c4af0b94
 #   verify-prove-transcript.js  724aa9ae8171f1acf629c3c6b4879dc056575f20
-#   verified-execution-binding.js  1e41542296551139c41e2d4b4cff2e67bc42aa06
 #   verify-evidence.js          724aa9ae8171f1acf629c3c6b4879dc056575f20
 #   keys/coderifts-keys.json    724aa9ae8171f1acf629c3c6b4879dc056575f20
 
-verify.js  363e52c72ec4b913e1f3edc8e2029848feaeacb1efa6c07960fe5e5f195c23b3
+# ── THE RECEIPT-VERIFIER CORE IS PINNED TO A RELEASED TAG ───────────────────────────────────
+#
+# The shared verification core here comes from receipt-verifier **v1.0.1**, peeled commit
+# 51a8224439959a5b46c0b09e9a2cd67117f05d56.
+#
+# It was pinned to a WORKING TREE and to per-file commits. Both are honest about where the bytes
+# came from and neither is a provenance a stranger can resolve: a working tree is not fetchable,
+# so "the vendored bytes match upstream" reduced to "they match whatever is on this machine right
+# now". A released tag is a name anyone can check out — that is the difference between a pin and
+# a note.
+#
+# The hash lines below are UNCHANGED by the re-pin. Where a file already matched the tag this is
+# prose only; where it did not, it was re-copied from the tag and that is recorded below.
+#
+#
+# ── AND THE TAG IS SIGNED, WHICH IS THE PART A STRANGER CAN CHECK ───────────────────────────
+#
+# v1.0.0 was an unsigned tag: a name anyone can check out, and also a name anyone with push access
+# can move. v1.0.1 is annotated and SSH-signed, so the pin now resolves to an identity and not
+# only to bytes.
+#
+#   tag object   06dd74f36f60e0b4d22dd4667732fe0a27575287
+#   peeled commit 51a8224439959a5b46c0b09e9a2cd67117f05d56
+#   signer       zsobpeter@gmail.com
+#   fingerprint  SHA256:7yRXTm9zKGicfFpzL+7lpwFoPaoSwxAJlabB3jwxw2Y
+#
+# Verify it yourself, in a checkout of receipt-verifier:
+#
+#   git tag -v v1.0.1
+#   -> Good "git" signature for zsobpeter@gmail.com with ED25519 key SHA256:7yRXTm9zKGicfFpzL+7lpwFoPaoSwxAJlabB3jwxw2Y
+#
+# The peeled commit is UNCHANGED from v1.0.0 — the core is byte-identical and this re-pin moves no
+# hash line. What it adds is who stands behind the bytes.
+# source_commit: 51a8224439959a5b46c0b09e9a2cd67117f05d56 (receipt-verifier v1.0.1, signed)
+#
+
+verify.js  348d3f851cd79bf63298b51da422d11be980820576ab0bf0a2990b9f007d6249
 arity.js  721fcac58b960b5e2aa1af91edb6cfc87ebe828a6da73879967ef79a1ca474e8
-verify-grant.js  127b53de3be77196862c10a8812221de0a5112cf1d3feae12d347a6021852df7
+verify-grant.js  4a0ad5bd7bb8282e086bea99dcaf8ca278370d80019c5681d2942bf11bc87504
 verify-prove-transcript.js  3bb17bd4f16d5ee3cf3fbb754b4df9aa570a615ca94ff2a97b751c4fabd3bd0d
-verify-evidence.js  7ca498fad4b23e4ae8f28c42c30058bc3526a00d5cc6d6f36380335bf25d3288
-verified-execution-binding.js  e48ea29b9f8b0c5b1754187788cbaf78cdaf0b505848c05d1ae3ffebb30218f2
+verify-evidence.js  98cd9b989a25095e0442f91f68a1adecd6e6a2a5b05902bf2580b8cba973c5e2
+verified-execution-binding.js  9d0259e916f2bcd32029744c3e9ec81448bcefa46e6ad3f054c8a650dc0482b7
 keys/coderifts-keys.json  bfe0c898cda3c3a4c8141726d0adb4cdb7eb9762de6264e430eff6469b90422e
+evidence-root.js  4d5476fc44bbfc2a847feeb313a1c6c08ef7fd832a2348ef3c244bd8d3f03fcd

package/dist/esm/vendor/evidence-root.js

@@ -0,0 +1,188 @@
+'use strict';
+
+/**
+ * cr.evidence.root.v1 — ONE signed manifest that binds a set of tokens to ONE run.
+ *
+ * ── THE ATTACK THIS EXISTS FOR (1432) ───────────────────────────────────────────────────────
+ *
+ * 1423 made every token in a prove artifact authenticate against its issuer's key. That closed
+ * forgery and left something open, which the second auditor found and which was reproduced three
+ * ways before this file existed: take a REAL second run of the same producer, at the same commit,
+ * and move one of ITS tokens into the first run's artifact. Recompute the pin. Everything still
+ * verifies — because nothing was forged. Each token really was issued, really is signed, and
+ * really says what it says.
+ *
+ *   transcript_token from run B → graded COVERED
+ *   execution_grant  from run B → graded COVERED
+ *   chain_receipt    from run B → graded COVERED
+ *
+ * Authenticity is a property of a TOKEN. "These tokens are one run" is a property of a SET, and no
+ * per-token signature can carry it. So a set needs its own signature.
+ *
+ * ── WHAT THE ROOT IS, AND WHAT IT IS NOT ────────────────────────────────────────────────────
+ *
+ * It is the producer saying, under its own key: "this run emitted exactly these bytes". The
+ * binding is the sha256 of each token's EXACT bytes, not a claim copied out of it — a substituted
+ * token has different bytes, so its digest cannot match, whatever it says inside.
+ *
+ * It is NOT a second opinion on any token's validity. A root cannot make an expired grant current
+ * or a bad signature good; every per-token check still runs and still decides. The root adds one
+ * sentence the others could not say.
+ *
+ * ── WHY IT IS SIGNED BY THE EXECUTOR ────────────────────────────────────────────────────────
+ *
+ * The executor is the only party present for the whole run: it mints the challenge, consumes the
+ * grant, seals the attestation and signs the transcript. The issuer sees one authorize; the
+ * provider sees one merge. A manifest of the run has to be signed by whoever witnessed the run,
+ * and that is the executor — the same key the correlation already uses, deliberately, so a reader
+ * verifying one is verifying the other's signer too.
+ *
+ * The residual is stated rather than hidden: this is the EXECUTOR's account of its own run. It
+ * makes splicing detectable, not impossible for the executor itself. An executor that lies about
+ * its own run was never constrained by its own signature — what the root removes is the ability of
+ * a THIRD party (anyone who can edit a vendored artifact) to assemble two honest runs into one.
+ */
+
+const crypto = require('node:crypto');
+
+const ROOT_V = 'cr.evidence.root.v1';
+const ROOT_SIGNING_PREFIX = 'crevidenceroot.v1';
+
+/**
+ * The slots a root accounts for. MANDATORY ones must be present and non-null: a root that simply
+ * omits a token would let deletion — the strongest tamper there is — read as "not applicable".
+ */
+const SLOTS = Object.freeze({
+  chain_receipt: { mandatory: true },
+  execution_grant: { mandatory: true },
+  transcript_token: { mandatory: true },
+  correlation: { mandatory: true },
+  atomic_attestation: { mandatory: false },
+  provider_readback: { mandatory: false },
+});
+const SLOT_NAMES = Object.freeze(Object.keys(SLOTS));
+
+const sha256pref = (bytes) =>
+  `sha256:${crypto.createHash('sha256').update(bytes).digest('hex')}`;
+
+/** RFC 8785-shaped canonical JSON: sorted keys, no whitespace, no invented values. */
+function canonicalJson(value) {
+  if (value === null) return 'null';
+  const t = typeof value;
+  if (t === 'boolean' || t === 'string') return JSON.stringify(value);
+  if (t === 'number') {
+    if (!Number.isFinite(value)) throw new TypeError('canonicalJson: non-finite number');
+    return JSON.stringify(value);
+  }
+  if (t === 'undefined') throw new TypeError('canonicalJson: undefined');
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+}
+
+/**
+ * The exact bytes signed. The WHOLE body under canonical JSON, so every field is covered and a
+ * future field cannot be added without breaking the signature.
+ */
+function rootSigningInput(body) {
+  return `${ROOT_SIGNING_PREFIX}|${canonicalJson(body)}`;
+}
+
+/**
+ * Digest a token exactly as it travels.
+ *
+ * A STRING is hashed as utf8 bytes. An OBJECT — the correlation is one — is hashed as canonical
+ * JSON, so key order in a re-serialised artifact cannot change the digest of a value nobody
+ * edited. Absent is null, never the empty-string hash: `sha256('')` is a real value and would
+ * make "no token" indistinguishable from "a token that happens to be empty".
+ */
+function digestToken(token) {
+  if (token == null) return null;
+  if (typeof token === 'string') return token.length === 0 ? null : sha256pref(Buffer.from(token, 'utf8'));
+  return sha256pref(Buffer.from(canonicalJson(token), 'utf8'));
+}
+
+/**
+ * Build and sign a root.
+ *
+ * @param {object} o
+ * @param {string} o.run_id
+ * @param {{name: string, version: string, commit: string|null}} o.producer
+ * @param {string} o.operation
+ * @param {string} o.target_uri
+ * @param {string|null} o.contract_commit
+ * @param {object} o.tokens        slot name → the token as it travels (string or object)
+ * @param {object} o.claims        { grant_id, receipt_hash, scope_hash, policy_hash, state_token_hash }
+ * @param {import('crypto').KeyObject} o.privateKey
+ * @param {string} o.executor_kid
+ */
+function buildEvidenceRoot(o) {
+  const artifact_digests = {};
+  for (const name of SLOT_NAMES) {
+    artifact_digests[name] = digestToken(o.tokens ? o.tokens[name] : null);
+  }
+  const c = o.claims || {};
+  const body = {
+    v: ROOT_V,
+    run_id: String(o.run_id),
+    executor_kid: String(o.executor_kid),
+    producer: {
+      name: String(o.producer.name),
+      version: String(o.producer.version),
+      commit: o.producer.commit == null ? null : String(o.producer.commit),
+    },
+    operation: o.operation == null ? null : String(o.operation),
+    target_uri: o.target_uri == null ? null : String(o.target_uri),
+    contract_commit: o.contract_commit == null ? null : String(o.contract_commit),
+    artifact_digests,
+    // The CLAIMS the run asserts. They are ALSO inside the tokens; carrying them here is what
+    // lets a verifier compare the two and refuse a manifest that agrees with itself but not with
+    // its own evidence.
+    grant_id: c.grant_id == null ? null : String(c.grant_id),
+    receipt_hash: c.receipt_hash == null ? null : String(c.receipt_hash),
+    scope_hash: c.scope_hash == null ? null : String(c.scope_hash),
+    policy_hash: c.policy_hash == null ? null : String(c.policy_hash),
+    state_token_hash: c.state_token_hash == null ? null : String(c.state_token_hash),
+  };
+  const signature = crypto.sign(null, Buffer.from(rootSigningInput(body), 'utf8'), o.privateKey);
+  return { ...body, signature: signature.toString('base64url') };
+}
+
+/** Verify a root's own signature. Says nothing about the tokens — that is verifyEvidenceEnvelope. */
+function verifyEvidenceRoot(root, publicKey) {
+  if (!root || root.v !== ROOT_V) {
+    return { valid: false, status: 'ROOT_MALFORMED', reason: 'not_an_evidence_root' };
+  }
+  if (typeof root.signature !== 'string' || root.signature.length === 0) {
+    return { valid: false, status: 'ROOT_MALFORMED', reason: 'no_signature' };
+  }
+  if (!publicKey) {
+    return { valid: false, status: 'ROOT_UNKNOWN_KEY', reason: 'unknown_kid' };
+  }
+  const { signature, ...body } = root;
+  let ok = false;
+  try {
+    ok = crypto.verify(
+      null, Buffer.from(rootSigningInput(body), 'utf8'), publicKey,
+      Buffer.from(signature, 'base64url'),
+    );
+  } catch (_) {
+    return { valid: false, status: 'ROOT_INVALID_SIGNATURE', reason: 'signature_error' };
+  }
+  return ok
+    ? { valid: true, status: 'ROOT_VALID' }
+    : { valid: false, status: 'ROOT_INVALID_SIGNATURE', reason: 'signature_mismatch' };
+}
+
+module.exports = {
+  ROOT_V,
+  ROOT_SIGNING_PREFIX,
+  SLOTS,
+  SLOT_NAMES,
+  canonicalJson,
+  rootSigningInput,
+  digestToken,
+  buildEvidenceRoot,
+  verifyEvidenceRoot,
+  sha256pref,
+};

package/dist/esm/vendor/verified-execution-binding.js

@@ -43,6 +43,7 @@ const crypto = require('node:crypto');
 
 const { verifyExecutionGrant } = require('./verify-grant.js');
 const { verifyEvidenceRootBinding } = require('./verify-evidence.js');
+const { verifyReceipt } = require('./verify.js');
 
 const BINDING_V = 'cr.verified-execution-binding.v1';
 
@@ -57,6 +58,24 @@ const STATE = Object.freeze({
   RECORDED_UNWITNESSED: 'RECORDED_UNWITNESSED',
   NOT_COMMITTED: 'NOT_COMMITTED',
   AUTHORIZED_AND_COMMITTED: 'AUTHORIZED_AND_COMMITTED',
+  /**
+   * A CUSTOM aggregation was satisfied — and it is NOT the global success token.
+   *
+   * ── THE HOLE THIS CLOSES, REPRODUCED BEFORE IT WAS WRITTEN ──────────────────────────────
+   *
+   *   valid grant + committed + NO attestation + NO root, required: ['issuer_grant']
+   *     -> AUTHORIZED_AND_COMMITTED, authorized_and_committed: true
+   *
+   * Nothing was forged. The caller simply asked for less, and the function handed back the token
+   * every consumer reads as "authorized and committed". `required[]` was a strictness dial that
+   * also selected the NAME of success, so narrowing the dial upgraded the verdict — the strongest
+   * word in the vocabulary, reachable by asking for the least.
+   *
+   * A caller may still choose its own authorities. What it may no longer do is call the result by
+   * the global name. `AUTHORIZED_AND_COMMITTED` is now reachable ONLY through a closed, versioned
+   * profile whose authority set the caller does not get to shorten.
+   */
+  CUSTOM_REQUIREMENTS_SATISFIED: 'CUSTOM_REQUIREMENTS_SATISFIED',
 });
 
 /** What each authority is allowed to be missing for, so a caller can choose its own strictness. */
@@ -67,6 +86,36 @@ const AUTHORITY = Object.freeze({
   PROVIDER_WITNESS: 'provider_witness',
 });
 
+/**
+ * CLOSED, VERSIONED ASSURANCE PROFILES.
+ *
+ * A profile fixes its authority set. The caller names the profile; it does not get to edit what
+ * the profile means, and the version in the name is what lets the set change later without
+ * silently changing what an older caller was promised.
+ *
+ * `TRUSTED_EXECUTOR_INTEGRITY_V1` is the honest ceiling of a single-machine chain: the decision
+ * receipt verified, the issuer's grant verified, the executor's attestation verified, and one
+ * signed root binding the set to one run. It says nothing about a third party, and the name is
+ * chosen so it cannot be read as one — `EXTERNALLY_WITNESSED_EXECUTION_V1` is a different profile
+ * and no producer can satisfy it today (no signed-witness format exists), which is why it is not
+ * declared here as an empty promise.
+ */
+const PROFILE = Object.freeze({
+  TRUSTED_EXECUTOR_INTEGRITY_V1: Object.freeze({
+    name: 'TRUSTED_EXECUTOR_INTEGRITY_V1',
+    authorities: Object.freeze([
+      AUTHORITY.ISSUER_GRANT,
+      AUTHORITY.EXECUTOR_ATTESTATION,
+      AUTHORITY.ONE_RUN_ROOT,
+    ]),
+    // The receipt is mandatory in every profile and is not listed as an authority because it is
+    // not optional anywhere — it gates the whole predicate above the state machine.
+    proof_scope: 'TRUSTED_EXECUTOR',
+    externally_witnessed: false,
+  }),
+});
+const PROFILE_NAMES = Object.freeze(Object.keys(PROFILE));
+
 const sha256pref = (v) =>
   `sha256:${crypto.createHash('sha256').update(String(v), 'utf8').digest('hex')}`;
 
@@ -116,12 +165,55 @@ function grantClaims(token) {
  * @param {{artifact: object, executorKey}} [o.evidenceRoot]
  * @param {{signed: boolean}} [o.providerReadback]
  * @param {boolean} o.committed
- * @param {string[]} [o.required]  authorities this caller demands; default: grant + attestation.
+ * @param {string} [o.profile]     a CLOSED profile name (see PROFILE). Its authority set cannot be
+ *        edited by the caller, and only a profile can reach AUTHORIZED_AND_COMMITTED.
+ * @param {string[]} [o.required]  a CUSTOM authority set. Legal, and it can never produce the
+ *        global success token — a satisfied custom set reads CUSTOM_REQUIREMENTS_SATISFIED.
  */
 function verifiedExecutionBinding(o = {}) {
-  const required = new Set(Array.isArray(o.required) && o.required.length
-    ? o.required
-    : [AUTHORITY.ISSUER_GRANT, AUTHORITY.EXECUTOR_ATTESTATION]);
+  // ── WHICH SET, AND WHO CHOSE IT ─────────────────────────────────────────────────────────
+  //
+  // A profile and a custom set are different KINDS of question, so they are answered separately
+  // and never merged. Passing both is refused rather than resolved by precedence: a caller that
+  // names a profile and then also lists authorities is asking two things at once, and picking one
+  // silently is how a caller ends up believing it got the other.
+  const profileName = typeof o.profile === 'string' && o.profile ? o.profile : null;
+  const customRequired = Array.isArray(o.required) && o.required.length ? o.required : null;
+  if (profileName && customRequired) {
+    return {
+      v: BINDING_V,
+      authorized_and_committed: false,
+      requirements_satisfied: false,
+      profile: null,
+      proof_scope: null,
+      externally_witnessed: false,
+      state: STATE.UNAUTHORIZED,
+      authorities: {},
+      shortfalls: ['profile: both `profile` and `required` were supplied — a closed profile\'s '
+        + 'authority set is not editable, so this asks two different questions at once'],
+      does_not_prove: [],
+    };
+  }
+  if (profileName && !Object.prototype.hasOwnProperty.call(PROFILE, profileName)) {
+    // FAIL CLOSED on an unknown profile. Falling back to a default would let a typo — or a caller
+    // written against a future version — silently receive a weaker check than it named.
+    return {
+      v: BINDING_V,
+      authorized_and_committed: false,
+      requirements_satisfied: false,
+      profile: null,
+      proof_scope: null,
+      externally_witnessed: false,
+      state: STATE.UNAUTHORIZED,
+      authorities: {},
+      shortfalls: [`profile: unknown assurance profile "${profileName}"; known: ${PROFILE_NAMES.join(', ')}`],
+      does_not_prove: [],
+    };
+  }
+  const profile = profileName ? PROFILE[profileName] : null;
+  const required = new Set(profile
+    ? profile.authorities
+    : (customRequired || [AUTHORITY.ISSUER_GRANT, AUTHORITY.EXECUTOR_ATTESTATION]));
   const shortfalls = [];
   const authorities = {};
   const note = (name, ok, detail) => {
@@ -225,9 +317,31 @@ function verifiedExecutionBinding(o = {}) {
   if (!er || !er.artifact) {
     note(AUTHORITY.ONE_RUN_ROOT, false,
       'no cr.evidence.root.v1 was supplied, so these bytes are not shown to be one run');
+  } else if (typeof verifyEvidenceRootBinding !== 'function') {
+    // ── A MISSING VERIFIER IS A REFUSAL, NEVER A CRASH ───────────────────────────────────
+    //
+    // MEASURED on a consumer: agent-guard vendors an OLDER `verify-evidence.js` that does not
+    // export `verifyEvidenceRootBinding` (true on its HEAD too), so this line threw a TypeError
+    // the moment anyone passed an `evidenceRoot`. Latent there — that guard holds no root — and
+    // the SHAPE is what matters: a crash is not an answer, and a caller cannot tell "the core
+    // blew up" from "the core is unavailable" from "the binding failed".
+    //
+    // Every OTHER dependency this file has is already used unconditionally, so this is the one
+    // place a mixed vendor pin can leave a hole. Refusing here is the fail-closed answer, and it
+    // names the cause rather than reporting a generic unbound root.
+    note(AUTHORITY.ONE_RUN_ROOT, false,
+      'the evidence-root verifier is not available in this build (the vendored verify-evidence.js '
+      + 'does not export verifyEvidenceRootBinding) — the root was NOT checked, and an unchecked '
+      + 'root is refused rather than reported as unbound');
   } else {
-    const r = verifyEvidenceRootBinding(er.artifact, { executorKey: er.executorKey, sidecars: er.sidecars });
-    note(AUTHORITY.ONE_RUN_ROOT, r.ok === true, r.ok ? 'bound' : (r.failures[0] || 'unbound'));
+    let r;
+    try {
+      r = verifyEvidenceRootBinding(er.artifact, { executorKey: er.executorKey, sidecars: er.sidecars });
+    } catch (err) {
+      r = { ok: false, failures: [`the evidence-root verifier threw: ${(err && err.message) || 'error'}`] };
+    }
+    note(AUTHORITY.ONE_RUN_ROOT, r.ok === true,
+      r.ok ? 'bound' : ((r.failures && r.failures[0]) || 'unbound'));
   }
 
   // ── 4. THE PROVIDER WITNESS ────────────────────────────────────────────────────────────
@@ -273,11 +387,65 @@ function verifiedExecutionBinding(o = {}) {
   // Left as-is deliberately: making a bare boolean insufficient would change the input shape of
   // all five consumers at once, and that belongs with the closed-profile work (1465), not
   // half-done in a round that would leave them broken. The gap is named, not narrowed in silence.
-  const receiptOk = !!(o.receipt && o.receipt.verified === true);
-  const receiptAsserted = receiptOk && !(o.receipt.token && (o.receipt.keyring || o.receipt.publicKey));
-  if (!receiptOk) shortfalls.unshift('receipt: the decision receipt did not verify');
+  // ── THE DECISION RECEIPT, VERIFIED HERE WHEN IT CAN BE ─────────────────────────────────
+  //
+  // ── THE FOURTH CALLER-BOOLEAN THIS REPOSITORY HAS MET ──────────────────────────────────
+  //
+  //   providerReadback: { signed: true }   believed because it was set        (closed)
+  //   attestation:      { present: true }  believed because it was set        (closed)
+  //   call_hash present == "tool-call bound"                                  (pre-empted)
+  //   receipt:          { verified: true } believed because it was set        (this)
+  //
+  // `receipt.verified` is the CALLER's word. With no token and no keyring, nothing was checked and
+  // this function had no way to check it — and a caller that simply set the flag reached a
+  // satisfied verdict. `receipt_caller_asserted` recorded it, which is honest reporting and not a
+  // gate: a field nobody branches on does not stop anything.
+  //
+  // Now: when a token AND a key source are supplied, THIS function verifies the receipt. When they
+  // are not, the assertion is accepted only for a CUSTOM aggregation — where the caller owns its
+  // own question — and can never reach AUTHORIZED_AND_COMMITTED, which is the word every consumer
+  // reads as the answer.
+  const rc = o.receipt || {};
+  let receiptOk = false;
+  let receiptAsserted = false;
+  let receiptDetail = 'the decision receipt did not verify';
+  const keySource = rc.keyring || rc.publicKey;
+  if (typeof rc.token === 'string' && rc.token.length > 0 && keySource) {
+    let rv;
+    try {
+      rv = verifyReceipt(rc.token, {
+        ctx: { ...(rc.keyring ? { keyring: rc.keyring } : { publicKey: rc.publicKey }),
+          expectedKid: rc.expectedKid === undefined ? null : rc.expectedKid },
+        ...(Number.isFinite(rc.now) ? { now: rc.now } : {}),
+      });
+    } catch (err) {
+      rv = { valid: false, status: 'VERIFIER_ERROR', reason: (err && err.message) || 'error' };
+    }
+    receiptOk = rv.valid === true;
+    if (!receiptOk) receiptDetail = `the decision receipt did not verify (${rv.status}: ${rv.reason})`;
+  } else if (rc.verified === true) {
+    // Accepted, and MARKED. The state machine below refuses to hand this the global name.
+    receiptOk = true;
+    receiptAsserted = true;
+  } else if (rc.token || keySource) {
+    receiptDetail = 'the receipt was supplied without '
+      + `${rc.token ? 'a keyring or public key' : 'its token'}, so it could not be verified here`;
+  } else {
+    receiptDetail = 'no decision receipt was supplied';
+  }
+  if (!receiptOk) shortfalls.unshift(`receipt: ${receiptDetail}`);
+  if (receiptAsserted) {
+    shortfalls.push('decision_receipt: `verified` was taken on the caller\'s word — no token and '
+      + 'no keyring were supplied, so nothing was checked here');
+  }
 
-  let state = STATE.AUTHORIZED_AND_COMMITTED;
+  // THE NAME OF SUCCESS DEPENDS ON WHO CHOSE THE SET, not on how much of it passed. A custom
+  // aggregation that meets everything it asked for is satisfied — and says so in its own words.
+  // A CALLER-ASSERTED RECEIPT CAN NEVER BE THE GLOBAL CLAIM. It is not downgraded to a failure —
+  // a custom aggregation may legitimately own that determination — but the strongest word in the
+  // vocabulary is not available to a run whose receipt nobody verified.
+  let state = (profile && !receiptAsserted)
+    ? STATE.AUTHORIZED_AND_COMMITTED : STATE.CUSTOM_REQUIREMENTS_SATISFIED;
   if (!receiptOk || (required.has(AUTHORITY.ISSUER_GRANT) && !grantOk)) state = STATE.UNAUTHORIZED;
   else if (required.has(AUTHORITY.EXECUTOR_ATTESTATION) && !attOk) state = STATE.COMMIT_UNPROVEN;
   else if (required.has(AUTHORITY.ONE_RUN_ROOT) && !authorities[AUTHORITY.ONE_RUN_ROOT].ok) {
@@ -285,11 +453,31 @@ function verifiedExecutionBinding(o = {}) {
   } else if (required.has(AUTHORITY.PROVIDER_WITNESS) && !authorities[AUTHORITY.PROVIDER_WITNESS].ok) {
     state = STATE.RECORDED_UNWITNESSED;
   } else if (!committed) state = STATE.NOT_COMMITTED;
+  // The default set (no profile, no custom list) is the historical grant+attestation pair. It is
+  // an implicit choice by the caller, not a profile, so it lands in the custom lane too.
+
 
   return {
     v: BINDING_V,
     authorized_and_committed: state === STATE.AUTHORIZED_AND_COMMITTED,
+    /**
+     * Did the set THIS CALLER ASKED FOR pass? True for a satisfied profile and for a satisfied
+     * custom aggregation alike.
+     *
+     * Separated from `authorized_and_committed` on purpose. A caller that only wants to know
+     * whether its own question was answered should not have to string-compare a state name, and
+     * — more importantly — should not be tempted to read the global claim because it was the only
+     * boolean available. That temptation is how `required: ['issuer_grant']` came to mean
+     * "authorized and committed" in the first place.
+     */
+    requirements_satisfied: state === STATE.AUTHORIZED_AND_COMMITTED
+      || state === STATE.CUSTOM_REQUIREMENTS_SATISFIED,
     state,
+    /** Which closed profile answered this, or null when the caller aggregated its own set. */
+    profile: profile ? profile.name : null,
+    /** Stated on every result so a reader never has to infer it from the state name. */
+    proof_scope: profile ? profile.proof_scope : null,
+    externally_witnessed: profile ? profile.externally_witnessed : false,
     authorities,
     shortfalls,
     /** True when `receipt.verified` was taken on the caller's word rather than established here. */
@@ -313,4 +501,7 @@ function verifiedExecutionBinding(o = {}) {
   };
 }
 
-module.exports = { verifiedExecutionBinding, STATE, AUTHORITY, BINDING_V, grantClaims, attestationClaims };
+module.exports = {
+  verifiedExecutionBinding, STATE, AUTHORITY, PROFILE, PROFILE_NAMES, BINDING_V,
+  grantClaims, attestationClaims,
+};