@coderifts/agent-guard 8.4.0 → 9.0.0

package/dist/cjs/deploy-gate.d.ts

@@ -4,9 +4,12 @@
  * receipt and the observed pipeline-enforcement state?"
  *
  * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
- * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
- * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
- * inputs → same output (D9).
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
+ * chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
+ * host-attributed view ONLY with the guard-defined provenance marker. A bare
+ * `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
+ * inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
+ * outcome; it does not enter any fingerprint preimage.
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
@@ -19,8 +22,16 @@
  * secrets.
  */
 import type { GateStatusState, EnforcementState } from './merge-gate.js';
+import { type DeployTokenReceipt } from './deploy-receipt-token.js';
 export type { GateStatusState, EnforcementState } from './merge-gate.js';
-/** The 14 deploy-gate reason codes (§1.1 + change-set residual). Success uses allow_current_deploy;
+export type { DeployTokenReceipt } from './deploy-receipt-token.js';
+/**
+ * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
+ * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
+ * `currently_authorized: true` alone is untrusted input.
+ */
+export declare const DEPLOY_RECEIPT_VIEW_SPEC: "deploy-receipt-view.v1";
+/** Deploy-gate reason codes (§1.1 + change-set residual + 9.0.0 verification). Success uses allow_current_deploy;
  *  enforcement_not_configured / bypass_open / change_set_not_rebound name honesty residuals on an
  *  otherwise-green check; fingerprint_mismatch is a hard failure (not a residual). */
 export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_not_authorized' | 'operation_mismatch' | 'env_mismatch' | 'stale_artifact' | 'fingerprint_mismatch' | 'body_hash_mismatch' | 'target_mismatch' | 'decision_not_allow' | 'inputs_incomplete' | 'enforcement_not_configured' | 'bypass_open'
@@ -30,7 +41,13 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
  * fingerprint_mismatch (hard failure when a re-bind WAS requested and disagreed).
  * deploy_allowed may stay true.
  */
- | 'change_set_not_rebound';
+ | 'change_set_not_rebound'
+/**
+ * Caller handed a receipt view with currently_authorized (or bounds) but no TOKEN and no
+ * guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
+ * it" ≠ "verification says no".
+ */
+ | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
 /** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
 export type DeployTarget = {
     environment: string;
@@ -55,7 +72,28 @@ export type DeployReceiptView = {
     body_hash?: string;
     target_id?: string;
     signature_valid?: boolean;
+    /**
+     * VERIFIED-VIEW provenance. Must equal DEPLOY_RECEIPT_VIEW_SPEC together with
+     * `verified: true` or the gate denies unverified_receipt_view.
+     */
+    view_spec?: string;
+    verified?: boolean;
+    verify_status?: string;
 };
+/** VERIFIED-VIEW: host-attributed, guard-defined marker required. */
+export type VerifiedDeployReceiptView = DeployReceiptView & {
+    view_spec: typeof DEPLOY_RECEIPT_VIEW_SPEC;
+    verified: true;
+    verify_status: string;
+};
+export type DeployVerificationMode = 'token' | 'verified_view' | 'unverified' | 'none';
+export type DeployVerificationObservation = {
+    mode: DeployVerificationMode;
+    verify_status: string | null;
+};
+/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
+export declare function asVerifiedDeployReceiptView(view: DeployReceiptView, verify_status?: string): VerifiedDeployReceiptView;
+export declare function isVerifiedDeployReceiptView(r: DeployReceiptView | null | undefined): r is VerifiedDeployReceiptView;
 /** Pipeline-enforcement observation (from the host's CD-config read — the pure gate consumes it). */
 export type DeployEnforcementState = {
     enforcement: EnforcementState;
@@ -79,7 +117,13 @@ export type DeployRequiredContext = {
 };
 export type DeployGateInput = {
     deployTarget: DeployTarget;
-    receipt: DeployReceiptView | null;
+    /**
+     * VERIFIED-VIEW (or null). A bare currently_authorized boolean is untrusted.
+     * TOKEN mode uses `token` instead (recommended).
+     */
+    receipt?: DeployReceiptView | VerifiedDeployReceiptView | null;
+    /** TOKEN mode: signed chain_receipt + registry | pinnedKeyPem. Guard verifies locally. */
+    token?: DeployTokenReceipt;
     requiredContext: DeployRequiredContext;
     /** Incomplete/no-receipt → pending when true, else failure (default false). */
     allowPending?: boolean;
@@ -112,6 +156,10 @@ export type DeployGateDecision = {
         bound_artifact_id: string | null;
         operation: string | null;
     };
+    /**
+     * Observation: which input mode ran and the verify_status. Not a preimage field.
+     */
+    verification: DeployVerificationObservation;
 };
 /**
  * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.

package/dist/cjs/deploy-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB,CAAC;AAE7B,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAkHrE"}
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}

package/dist/cjs/deploy-gate.js

@@ -5,9 +5,12 @@
  * receipt and the observed pipeline-enforcement state?"
  *
  * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
- * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
- * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
- * inputs → same output (D9).
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
+ * chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
+ * host-attributed view ONLY with the guard-defined provenance marker. A bare
+ * `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
+ * inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
+ * outcome; it does not enter any fingerprint preimage.
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
@@ -20,7 +23,31 @@
  * secrets.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_RECEIPT_VIEW_SPEC = void 0;
+exports.asVerifiedDeployReceiptView = asVerifiedDeployReceiptView;
+exports.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
 exports.deployGate = deployGate;
+const deploy_receipt_token_js_1 = require("./deploy-receipt-token.js");
+/**
+ * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
+ * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
+ * `currently_authorized: true` alone is untrusted input.
+ */
+exports.DEPLOY_RECEIPT_VIEW_SPEC = 'deploy-receipt-view.v1';
+/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
+function asVerifiedDeployReceiptView(view, verify_status = 'VERIFIED_CURRENT') {
+    return {
+        ...view,
+        view_spec: exports.DEPLOY_RECEIPT_VIEW_SPEC,
+        verified: true,
+        verify_status,
+    };
+}
+function isVerifiedDeployReceiptView(r) {
+    return !!r
+        && r.view_spec === exports.DEPLOY_RECEIPT_VIEW_SPEC
+        && r.verified === true;
+}
 // ── helpers (pure) ────────────────────────────────────────────────────────────────────────────────
 function norm(s) {
     return String(s == null ? '' : s).trim().toLowerCase();
@@ -73,29 +100,62 @@ function deployGate(input) {
     const allowPending = input.allowPending ?? rc.allowPending ?? false;
     const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
     const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
-    const receipt = input.receipt;
-    const detail = {
+    let verification = { mode: 'none', verify_status: null };
+    let receipt = input.receipt;
+    const detailOf = (r) => ({
         environment: norm(target.environment),
         artifact_id: norm(target.artifact_id),
-        bound_environment: receipt && receipt.bound_environment != null ? norm(receipt.bound_environment) : null,
-        bound_artifact_id: receipt && receipt.bound_artifact_id != null ? norm(receipt.bound_artifact_id) : null,
-        operation: receipt && receipt.operation != null ? String(receipt.operation) : null,
-    };
+        bound_environment: r && r.bound_environment != null ? norm(r.bound_environment) : null,
+        bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
+        operation: r && r.operation != null ? String(r.operation) : null,
+    });
     const deny = (state, reason) => ({
         deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
         residuals: [],
-        detail,
+        detail: detailOf(receipt),
+        verification,
     });
     // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
     if (!target.environment || String(target.environment).trim() === ''
         || !target.artifact_id || String(target.artifact_id).trim() === '') {
         return deny(allowPending ? 'pending' : 'failure', 'inputs_incomplete');
     }
-    // 1) no receipt → fail-closed (D4).
+    // TOKEN mode (recommended): guard verifies locally. Wins over a sibling receipt view.
+    const tokenInput = input.token;
+    if (tokenInput && typeof tokenInput.token === 'string' && tokenInput.token.length > 0) {
+        const tv = (0, deploy_receipt_token_js_1.verifyDeployReceiptToken)(tokenInput, {
+            operation: opRequired,
+            environment: target.environment,
+            artifact_id: target.artifact_id,
+        });
+        verification = { mode: 'token', verify_status: tv.status };
+        if (tv.denyReason) {
+            receipt = tv.view;
+            return deny('failure', tv.denyReason);
+        }
+        receipt = tv.view;
+    }
+    else if (receipt === null || receipt === undefined) {
+        // 1) no receipt and no token → fail-closed (D4).
+        return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
+    }
+    else if (isVerifiedDeployReceiptView(receipt)) {
+        verification = {
+            mode: 'verified_view',
+            verify_status: typeof receipt.verify_status === 'string' ? receipt.verify_status : null,
+        };
+    }
+    else {
+        // Bare currently_authorized (or any view without the guard-defined marker).
+        verification = { mode: 'unverified', verify_status: null };
+        return deny('failure', 'unverified_receipt_view');
+    }
     if (receipt === null || receipt === undefined) {
         return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
     }
     // 2) lifecycle authorization — a valid signature alone is NOT sufficient (D5).
+    //    In TOKEN mode currently_authorized was COMPUTED; in VERIFIED-VIEW it is host-attributed
+    //    behind view_spec (not a sneaked boolean).
     if (receipt.currently_authorized !== true) {
         return deny('failure', 'receipt_not_authorized');
     }
@@ -168,7 +228,8 @@ function deployGate(input) {
         inescapable_deploy,
         residuals,
         ...(residual ? { residual } : {}),
-        detail,
+        detail: detailOf(receipt),
+        verification,
     };
 }
 //# sourceMappingURL=deploy-gate.js.map

package/dist/cjs/deploy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA2JH,gCAkHC;AArJD,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACnF,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM;KACP,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAsGH,kEAUC;AAED,kEAIC;AA6GD,gCAqJC;AArXD,uEAGmC;AAKnC;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/cjs/deploy-receipt-token.d.ts

@@ -0,0 +1,59 @@
+/**
+ * TOKEN-mode chain-receipt verification for deployGate.
+ *
+ * SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
+ * unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
+ * NOT exported by that SDK. This module:
+ *   - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
+ *     (`createPublicKey` + `verify`) — no new algorithm
+ *   - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
+ *   - reuses this package's `computeBodyHash` for envelope bind
+ *   - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
+ *
+ * No fetch. Same inputs → same output.
+ */
+import type { ExecutorKeyRegistry } from '@coderifts/sdk';
+/** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
+export type TokenDerivedReceiptView = {
+    currently_authorized: boolean;
+    decision: string;
+    execution_action?: string;
+    operation?: string;
+    bound_environment?: string | null;
+    bound_artifact_id?: string | null;
+    verdict_fingerprint?: string;
+    body_hash?: string;
+    target_id?: string;
+};
+export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
+export type DeployTokenReceipt = {
+    /** Signed chain_receipt token (`base64url(body).base64url(sig)`). */
+    token: string;
+    /** Body-hash-bound decision envelope (verifier family). Required for currently_authorized. */
+    decision_result?: Record<string, unknown>;
+    /** Well-known-shaped registry `{ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }`. */
+    registry?: ExecutorKeyRegistry;
+    /** Air-gap single PEM (kid-agnostic). */
+    pinnedKeyPem?: string;
+};
+export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
+export type DeployTokenVerifyResult = {
+    valid: boolean;
+    status: DeployTokenVerifyStatus;
+    currently_authorized: boolean;
+    authz_reason: string | null;
+    /** When set, deployGate denies with this reason before bind checks. */
+    denyReason: string | null;
+    payload?: Record<string, unknown>;
+    view: TokenDerivedReceiptView | null;
+    key_status: 'active' | 'retired' | null;
+};
+/**
+ * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
+ */
+export declare function verifyDeployReceiptToken(input: DeployTokenReceipt, _intended?: {
+    operation?: string;
+    environment?: string;
+    artifact_id?: string;
+}, nowMs?: number): DeployTokenVerifyResult;
+//# sourceMappingURL=deploy-receipt-token.d.ts.map

package/dist/cjs/deploy-receipt-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}

package/dist/cjs/deploy-receipt-token.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * TOKEN-mode chain-receipt verification for deployGate.
+ *
+ * SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
+ * unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
+ * NOT exported by that SDK. This module:
+ *   - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
+ *     (`createPublicKey` + `verify`) — no new algorithm
+ *   - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
+ *   - reuses this package's `computeBodyHash` for envelope bind
+ *   - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
+ *
+ * No fetch. Same inputs → same output.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHAIN_SIGNING_PREFIX = void 0;
+exports.verifyDeployReceiptToken = verifyDeployReceiptToken;
+const node_crypto_1 = require("node:crypto");
+const sdk_1 = require("@coderifts/sdk");
+const receipt_binding_js_1 = require("./receipt-binding.js");
+exports.CHAIN_SIGNING_PREFIX = 'crchain.v1';
+function scalar(v) {
+    return v == null ? '' : String(v);
+}
+function reconstructInput(payload) {
+    const v1 = `${exports.CHAIN_SIGNING_PREFIX}|${scalar(payload.kid)}|${scalar(payload.fp)}|${scalar(payload.prev)}|${scalar(payload.caller)}|${scalar(payload.ts)}`;
+    if (payload.v === 4) {
+        return `${v1}|${scalar(payload.reg)}|${scalar(payload.ir)}|${scalar(payload.expires_at)}|${scalar(payload.bh)}`;
+    }
+    if (payload.v === 3) {
+        return `${v1}|${scalar(payload.reg)}|${scalar(payload.ir)}`;
+    }
+    if (payload.v === 2) {
+        return `${v1}|${scalar(payload.reg)}`;
+    }
+    return v1;
+}
+function isIssueTimeWithinKeyWindow(ts, keyMeta) {
+    if (!keyMeta || keyMeta.status === 'active')
+        return true;
+    if (keyMeta.status !== 'retired')
+        return false;
+    if (typeof keyMeta.retired_at !== 'string' || keyMeta.retired_at.length === 0)
+        return false;
+    if (typeof ts !== 'string' || ts.length === 0)
+        return false;
+    const issueMs = Date.parse(ts);
+    if (!Number.isFinite(issueMs))
+        return false;
+    if (keyMeta.valid_from) {
+        const fromMs = Date.parse(keyMeta.valid_from);
+        if (Number.isFinite(fromMs) && issueMs < fromMs)
+            return false;
+    }
+    const retiredMs = Date.parse(keyMeta.retired_at);
+    if (!Number.isFinite(retiredMs))
+        return false;
+    if (issueMs >= retiredMs)
+        return false;
+    return true;
+}
+function resolveKey(kid, registry, pinnedKeyPem) {
+    if (typeof pinnedKeyPem === 'string' && pinnedKeyPem.trim().length > 0) {
+        try {
+            return {
+                publicKey: (0, node_crypto_1.createPublicKey)(pinnedKeyPem),
+                status: 'active',
+                valid_from: null,
+                retired_at: null,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!registry || !Array.isArray(registry.keys) || !kid)
+        return null;
+    const matches = registry.keys.filter((k) => k && k.kid === kid && typeof k.public_key_pem === 'string');
+    if (matches.length === 0)
+        return null;
+    const entry = matches.find((k) => k.status === 'active') || matches[0];
+    try {
+        return {
+            publicKey: (0, node_crypto_1.createPublicKey)(entry.public_key_pem),
+            status: entry.status === 'retired' ? 'retired' : 'active',
+            valid_from: entry.valid_from || null,
+            retired_at: entry.retired_at || null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function fail(status, denyReason, extra = {}) {
+    return {
+        valid: false,
+        status,
+        currently_authorized: false,
+        authz_reason: extra.authz_reason ?? denyReason,
+        denyReason,
+        view: null,
+        key_status: extra.key_status ?? null,
+        payload: extra.payload,
+    };
+}
+function viewFromEnvelope(envelope, payload, currently_authorized) {
+    const artifact = envelope.target_id ?? envelope.artifact_digest ?? envelope.bound_artifact_id;
+    return {
+        currently_authorized,
+        decision: typeof envelope.decision === 'string' ? envelope.decision : '',
+        execution_action: typeof envelope.execution_action === 'string' ? envelope.execution_action : undefined,
+        operation: typeof envelope.operation === 'string' ? envelope.operation : undefined,
+        bound_environment: typeof envelope.environment === 'string' ? envelope.environment : null,
+        bound_artifact_id: artifact == null ? null : String(artifact),
+        verdict_fingerprint: typeof envelope.fingerprint === 'string'
+            ? envelope.fingerprint
+            : (typeof payload.fp === 'string' ? payload.fp : undefined),
+        body_hash: typeof payload.bh === 'string' ? payload.bh : undefined,
+        target_id: envelope.target_id == null ? undefined : String(envelope.target_id),
+    };
+}
+/**
+ * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
+ */
+function verifyDeployReceiptToken(input, _intended = {}, nowMs) {
+    const token = input && input.token;
+    if (typeof token !== 'string' || token.length === 0) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    const hasKeys = (input.pinnedKeyPem && String(input.pinnedKeyPem).trim().length > 0)
+        || (input.registry && Array.isArray(input.registry.keys) && input.registry.keys.length > 0);
+    if (!hasKeys) {
+        return fail('MALFORMED', 'inputs_incomplete', { authz_reason: 'keys_missing' });
+    }
+    const segments = token.split('.');
+    if (segments.length !== 2 || segments.some((s) => !s)) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(segments[0], 'base64url').toString('utf8'));
+    }
+    catch {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        return fail('MALFORMED', 'unverified_receipt_view');
+    }
+    if (typeof payload.v === 'number' && payload.v > 4) {
+        return fail('UNSUPPORTED_VERSION', 'unverified_receipt_view', { payload });
+    }
+    const kid = typeof payload.kid === 'string' ? payload.kid : '';
+    const resolved = resolveKey(kid, input.registry, input.pinnedKeyPem);
+    if (!resolved)
+        return fail('UNKNOWN_KEY', 'unknown_key', { payload });
+    let sigOk = false;
+    try {
+        sigOk = (0, node_crypto_1.verify)(null, Buffer.from(reconstructInput(payload), 'utf8'), resolved.publicKey, Buffer.from(segments[1], 'base64url'));
+    }
+    catch {
+        return fail('INVALID_SIGNATURE', 'invalid_signature', { payload });
+    }
+    if (!sigOk)
+        return fail('INVALID_SIGNATURE', 'invalid_signature', { payload });
+    for (const k of ['kid', 'fp', 'prev', 'caller', 'ts', 'reg', 'ir', 'expires_at', 'bh']) {
+        if (typeof payload[k] === 'string' && payload[k].includes('|')) {
+            return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'delimiter_in_field' });
+        }
+    }
+    if (resolved.status === 'retired') {
+        if (!isIssueTimeWithinKeyWindow(typeof payload.ts === 'string' ? payload.ts : undefined, resolved)) {
+            return fail('INVALID_SIGNATURE', 'invalid_signature', { payload, authz_reason: 'retired_key_outside_window' });
+        }
+        const envelope = input.decision_result && typeof input.decision_result === 'object'
+            ? input.decision_result
+            : undefined;
+        const view = envelope ? viewFromEnvelope(envelope, payload, false) : null;
+        return {
+            valid: true,
+            status: 'RETIRED_KEY_VALID_AT_ISSUE',
+            currently_authorized: false,
+            authz_reason: 'retired_key',
+            denyReason: 'retired_key',
+            payload,
+            view,
+            key_status: 'retired',
+        };
+    }
+    if (payload.v === 4 && typeof payload.expires_at === 'string') {
+        const exp = Date.parse(payload.expires_at);
+        const now = Number.isFinite(nowMs) ? nowMs : Date.now();
+        if ((0, sdk_1.isReceiptExpired)(exp, now, { environment: _intended.environment, operation: _intended.operation })) {
+            const envelope = input.decision_result && typeof input.decision_result === 'object'
+                ? input.decision_result
+                : undefined;
+            return {
+                valid: true,
+                status: 'VERIFIED_EXPIRED',
+                currently_authorized: false,
+                authz_reason: 'expired',
+                denyReason: 'expired',
+                payload,
+                view: envelope ? viewFromEnvelope(envelope, payload, false) : null,
+                key_status: 'active',
+            };
+        }
+    }
+    const envelope = input.decision_result && typeof input.decision_result === 'object'
+        ? input.decision_result
+        : undefined;
+    if (!envelope) {
+        return {
+            valid: true,
+            status: 'VERIFIED_CURRENT',
+            currently_authorized: false,
+            authz_reason: 'receipt_context_required',
+            denyReason: 'receipt_not_authorized',
+            payload,
+            view: null,
+            key_status: 'active',
+        };
+    }
+    let localBh = null;
+    try {
+        localBh = (0, receipt_binding_js_1.computeBodyHash)(envelope);
+    }
+    catch {
+        localBh = null;
+    }
+    if (typeof payload.bh !== 'string' || payload.bh !== localBh) {
+        return fail('INVALID_SIGNATURE', 'body_hash_mismatch', { payload, authz_reason: 'body_hash_mismatch' });
+    }
+    return {
+        valid: true,
+        status: 'VERIFIED_CURRENT',
+        currently_authorized: true,
+        authz_reason: 'ok',
+        denyReason: null,
+        payload,
+        view: viewFromEnvelope(envelope, payload, true),
+        key_status: 'active',
+    };
+}
+//# sourceMappingURL=deploy-receipt-token.js.map

package/dist/cjs/deploy-receipt-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipt-token.js","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAsKH,4DA+HC;AAnSD,6CAAsE;AACtE,wCAAkD;AAElD,6DAAuD;AAe1C,QAAA,oBAAoB,GAAG,YAAY,CAAC;AAkCjD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EAAE,GAAG,GAAG,4BAAoB,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1J,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,0BAA0B,CACjC,EAAsB,EACtB,OAAiF;IAEjF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,IAAA,6BAAe,EAAC,YAAY,CAAC;gBACxC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO;YACL,SAAS,EAAE,IAAA,6BAAe,EAAC,KAAK,CAAC,cAAc,CAAC;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,MAA+B,EAC/B,UAAkB,EAClB,QAA0C,EAAE;IAE5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM;QACN,oBAAoB,EAAE,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,UAAU;QAC9C,UAAU;QACV,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAgC,EAChC,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC9F,OAAO;QACL,oBAAoB;QACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACxE,gBAAgB,EAAE,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACvG,SAAS,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAClF,iBAAiB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzF,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7D,mBAAmB,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAC,QAAQ,CAAC,WAAW;YACtB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,SAAS,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,KAAyB,EACzB,YAAgF,EAAE,EAClF,KAAc;IAEd,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;WAC/E,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,oBAAY,EAClB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAC9C,QAAQ,CAAC,SAAS,EAClB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,OAAO,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,0BAA0B,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACjF,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,4BAA4B;YACpC,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,IAAI;YACJ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,IAAA,sBAAgB,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;gBACjF,CAAC,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,kBAAkB;gBAC1B,oBAAoB,EAAE,KAAK;gBAC3B,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAClE,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;QACjF,CAAC,CAAC,KAAK,CAAC,eAAe;QACvB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,kBAAkB;YAC1B,oBAAoB,EAAE,KAAK;YAC3B,YAAY,EAAE,0BAA0B;YACxC,UAAU,EAAE,wBAAwB;YACpC,OAAO;YACP,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,IAAA,oCAAe,EAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,kBAAkB;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,OAAO;QACP,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAC/C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC"}