@coderifts/agent-guard 8.5.0 → 9.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +33 -22
- package/dist/cjs/deploy-bind.d.ts +9 -7
- package/dist/cjs/deploy-bind.d.ts.map +1 -1
- package/dist/cjs/deploy-bind.js +9 -3
- package/dist/cjs/deploy-bind.js.map +1 -1
- package/dist/cjs/deploy-gate.d.ts +54 -6
- package/dist/cjs/deploy-gate.d.ts.map +1 -1
- package/dist/cjs/deploy-gate.js +73 -12
- package/dist/cjs/deploy-gate.js.map +1 -1
- package/dist/cjs/deploy-receipt-token.d.ts +59 -0
- package/dist/cjs/deploy-receipt-token.d.ts.map +1 -0
- package/dist/cjs/deploy-receipt-token.js +245 -0
- package/dist/cjs/deploy-receipt-token.js.map +1 -0
- package/dist/cjs/index.d.ts +4 -2
- package/dist/cjs/index.d.ts.map +1 -1
- package/dist/cjs/index.js +7 -1
- package/dist/cjs/index.js.map +1 -1
- package/dist/esm/deploy-bind.d.ts +9 -7
- package/dist/esm/deploy-bind.d.ts.map +1 -1
- package/dist/esm/deploy-bind.js +9 -3
- package/dist/esm/deploy-bind.js.map +1 -1
- package/dist/esm/deploy-gate.d.ts +54 -6
- package/dist/esm/deploy-gate.d.ts.map +1 -1
- package/dist/esm/deploy-gate.js +70 -12
- package/dist/esm/deploy-gate.js.map +1 -1
- package/dist/esm/deploy-receipt-token.d.ts +59 -0
- package/dist/esm/deploy-receipt-token.d.ts.map +1 -0
- package/dist/esm/deploy-receipt-token.js +241 -0
- package/dist/esm/deploy-receipt-token.js.map +1 -0
- package/dist/esm/index.d.ts +4 -2
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.js +2 -1
- package/dist/esm/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -570,30 +570,46 @@ honest, so the composition hands the caller the piece it owns and stops.
|
|
|
570
570
|
|
|
571
571
|
#### `deployGate` and deploy-time `bindDeploy`
|
|
572
572
|
|
|
573
|
-
`deployGate` is the pure decision. **`bindDeploy`** is the pure **caller** at the
|
|
574
|
-
|
|
575
|
-
|
|
573
|
+
`deployGate` is the pure decision. **`bindDeploy`** is the pure **caller** at the
|
|
574
|
+
moment of deploying. Two **explicit, non-guessable** receipt input modes (9.0.0;
|
|
575
|
+
P0 / audit 2026-08-24):
|
|
576
576
|
|
|
577
|
-
|
|
578
|
-
|
|
579
|
-
|
|
580
|
-
|
|
581
|
-
|
|
577
|
+
**(a) TOKEN mode (recommended).** Pass the signed chain_receipt token plus
|
|
578
|
+
`{ registry | pinnedKeyPem }` and the decision envelope. The guard verifies
|
|
579
|
+
**locally** (Ed25519, kid / retired window, body-hash, ID104 leeway). No
|
|
580
|
+
HTTP — SDK 3.4.0 `client.verifyReceipt` is I/O and is not used here.
|
|
581
|
+
|
|
582
|
+
**(b) VERIFIED-VIEW mode.** Pass `{ view_spec: 'deploy-receipt-view.v1',
|
|
583
|
+
verified: true, verify_status, currently_authorized, bounds… }` produced by a
|
|
584
|
+
verification the host attributes. Stamp with `asVerifiedDeployReceiptView`.
|
|
585
|
+
The marker is the same idiom as `proof_spec` / `attestation_spec`.
|
|
586
|
+
|
|
587
|
+
A bare `{ currently_authorized: true }` with **no** `view_spec` and **no**
|
|
588
|
+
token is DENY `unverified_receipt_view` — not `receipt_not_authorized`.
|
|
589
|
+
|
|
590
|
+
`g.verification = { mode, verify_status }` is observation (not a preimage).
|
|
591
|
+
The environment name remains a **host assertion**
|
|
592
|
+
(`environment.provenance: 'host_asserted'`).
|
|
582
593
|
|
|
583
594
|
```typescript
|
|
584
|
-
import { bindDeploy } from '@coderifts/agent-guard';
|
|
595
|
+
import { bindDeploy, asVerifiedDeployReceiptView, deployGate } from '@coderifts/agent-guard';
|
|
596
|
+
|
|
597
|
+
// TOKEN (recommended)
|
|
598
|
+
const g = deployGate({
|
|
599
|
+
deployTarget: { environment: 'production', artifact_id: digest },
|
|
600
|
+
token: { token, decision_result, registry }, // or pinnedKeyPem
|
|
601
|
+
requiredContext: { operation: 'deploy', enforcement: { enforcement: 'ENFORCING', bypass_possible: false } },
|
|
602
|
+
});
|
|
603
|
+
// g.verification.mode === 'token'
|
|
585
604
|
|
|
605
|
+
// VERIFIED-VIEW (host already verified)
|
|
586
606
|
const r = bindDeploy({
|
|
587
607
|
environment: { name: 'production', provenance: 'host_asserted' },
|
|
588
608
|
artifact_id: digest,
|
|
589
|
-
receipt:
|
|
609
|
+
receipt: asVerifiedDeployReceiptView(computedView, 'VERIFIED_CURRENT'),
|
|
590
610
|
pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
|
|
591
611
|
});
|
|
592
|
-
|
|
593
|
-
// r.pipeline_action — always 'not_observed' (we did not block or run the pipeline)
|
|
594
|
-
// r.environment.provenance — always 'host_asserted'
|
|
595
|
-
// r.inescapable_deploy — only true under ENFORCING ∧ ¬bypass (from the gate, not a host flag)
|
|
596
|
-
if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
|
|
612
|
+
if (!r.decision_allows_deploy) process.exit(1);
|
|
597
613
|
```
|
|
598
614
|
|
|
599
615
|
#### `deployGate` is also the publish / register gate
|
|
@@ -606,24 +622,19 @@ verdict, enforcement residual). Prefer **`bindDeploy`** at the live step; raw `d
|
|
|
606
622
|
for hosts that already build the full input.
|
|
607
623
|
|
|
608
624
|
```typescript
|
|
609
|
-
import { deployGate } from '@coderifts/agent-guard';
|
|
625
|
+
import { deployGate, asVerifiedDeployReceiptView } from '@coderifts/agent-guard';
|
|
610
626
|
|
|
611
|
-
// npm publish — same gate, operation label 'publish'
|
|
612
627
|
const g = deployGate({
|
|
613
628
|
deployTarget: {
|
|
614
629
|
environment: 'npm',
|
|
615
630
|
artifact_id: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
|
|
616
631
|
},
|
|
617
|
-
|
|
618
|
-
// bound_environment / bound_artifact_id are NOT server-emitted signed fields — the caller
|
|
619
|
-
// supplies them on this view alongside the token (deploy-gate's "view of the finished receipt").
|
|
620
|
-
receipt,
|
|
632
|
+
receipt: asVerifiedDeployReceiptView(publishView, 'VERIFIED_CURRENT'),
|
|
621
633
|
requiredContext: {
|
|
622
634
|
operation: 'publish',
|
|
623
635
|
enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
|
|
624
636
|
},
|
|
625
637
|
});
|
|
626
|
-
// g.deploy_allowed — decision flag (name is historical; see caveat)
|
|
627
638
|
```
|
|
628
639
|
|
|
629
640
|
MCP **register** is the same shape: set `operation: 'register'` and put the **manifest digest** in
|
|
@@ -11,15 +11,15 @@
|
|
|
11
11
|
* signed evidence; the deploy target's environment string is not verified by us.
|
|
12
12
|
* A host can claim "staging" while deploying to production. The output says so.
|
|
13
13
|
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
14
|
+
* TOKEN mode: bindDeploy forwards `token` to deployGate, which verifies locally
|
|
15
|
+
* (no HTTP). VERIFIED-VIEW must carry the guard-defined view_spec. pipeline_action
|
|
16
|
+
* is always 'not_observed'. inescapable_deploy still comes only from deployGate.
|
|
17
17
|
*
|
|
18
18
|
* External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
|
|
19
19
|
* (deployBind). That is a consumer; this is the package-local pure entry hosts should
|
|
20
20
|
* call so the decision logic has a first-class caller in-repo.
|
|
21
21
|
*/
|
|
22
|
-
import { type DeployEnforcementState, type DeployGateDecision, type DeployGateReason, type DeployReceiptView, type GateStatusState } from './deploy-gate.js';
|
|
22
|
+
import { type DeployEnforcementState, type DeployGateDecision, type DeployGateReason, type DeployReceiptView, type GateStatusState, type DeployTokenReceipt } from './deploy-gate.js';
|
|
23
23
|
/** Reasons a fresh re-preflight for this { env, artifact } can repair. */
|
|
24
24
|
declare const REPAIRABLE: ReadonlySet<DeployGateReason>;
|
|
25
25
|
/**
|
|
@@ -45,10 +45,12 @@ export type BindDeployInput = {
|
|
|
45
45
|
service?: string;
|
|
46
46
|
pipeline_run_id?: string;
|
|
47
47
|
/**
|
|
48
|
-
*
|
|
49
|
-
*
|
|
48
|
+
* VERIFIED-VIEW (must carry view_spec) or null. TOKEN mode: pass `token` instead.
|
|
49
|
+
* A bare currently_authorized boolean is denied as unverified_receipt_view.
|
|
50
50
|
*/
|
|
51
|
-
receipt
|
|
51
|
+
receipt?: DeployReceiptView | null;
|
|
52
|
+
/** TOKEN mode: signed chain_receipt + registry | pinnedKeyPem. Guard verifies. */
|
|
53
|
+
token?: DeployTokenReceipt;
|
|
52
54
|
/**
|
|
53
55
|
* Host-observed pipeline enforcement (CD config / step policy). Same role as
|
|
54
56
|
* ProtectionState for merge — an input, not a package discovery.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-bind.d.ts","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,
|
|
1
|
+
{"version":3,"file":"deploy-bind.d.ts","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,QAAA,MAAM,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAc5C,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,eAAe,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC9C,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,kFAAkF;IAClF,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+EAA+E;IAC/E,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,mBAAmB,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,MAAM,EAAE,gBAAgB,CAAC;IACzB,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,uBAAuB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAWF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAoDnE;AAED,OAAO,EAAE,UAAU,IAAI,yBAAyB,EAAE,CAAC"}
|
package/dist/cjs/deploy-bind.js
CHANGED
|
@@ -12,9 +12,9 @@
|
|
|
12
12
|
* signed evidence; the deploy target's environment string is not verified by us.
|
|
13
13
|
* A host can claim "staging" while deploying to production. The output says so.
|
|
14
14
|
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
15
|
+
* TOKEN mode: bindDeploy forwards `token` to deployGate, which verifies locally
|
|
16
|
+
* (no HTTP). VERIFIED-VIEW must carry the guard-defined view_spec. pipeline_action
|
|
17
|
+
* is always 'not_observed'. inescapable_deploy still comes only from deployGate.
|
|
18
18
|
*
|
|
19
19
|
* External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
|
|
20
20
|
* (deployBind). That is a consumer; this is the package-local pure entry hosts should
|
|
@@ -34,6 +34,11 @@ const REPAIRABLE = new Set([
|
|
|
34
34
|
'body_hash_mismatch',
|
|
35
35
|
'no_receipt',
|
|
36
36
|
'inputs_incomplete',
|
|
37
|
+
'unverified_receipt_view',
|
|
38
|
+
'invalid_signature',
|
|
39
|
+
'expired',
|
|
40
|
+
'unknown_key',
|
|
41
|
+
'retired_key',
|
|
37
42
|
]);
|
|
38
43
|
exports.DEPLOY_REPAIRABLE_REASONS = REPAIRABLE;
|
|
39
44
|
function asHostAssertedEnvironment(env) {
|
|
@@ -90,6 +95,7 @@ function bindDeploy(input) {
|
|
|
90
95
|
const gate = (0, deploy_gate_js_1.deployGate)({
|
|
91
96
|
deployTarget,
|
|
92
97
|
receipt: input.receipt,
|
|
98
|
+
token: input.token,
|
|
93
99
|
requiredContext,
|
|
94
100
|
...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
|
|
95
101
|
...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;
|
|
1
|
+
{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AA4IH,gCAoDC;AA9LD,qDAS0B;AAE1B,0EAA0E;AAC1E,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAsKoB,+CAAyB;AAhFhD,SAAS,yBAAyB,CAAC,GAAqC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,iFAAiF;IACjF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC;IAE9C,MAAM,YAAY,GAAiB;QACjC,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IAEF,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE,WAAW,EAAE,SAAkB,EAAE,eAAe,EAAE,IAAI,EAAE;QACrG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAI;YACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,2BAAU,EAAC;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,sBAAsB,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QACpD,mBAAmB,EAAE,IAAI,CAAC,KAAK;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,WAAW,EAAE,qCAAqC;QAClD,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI;KACrD,CAAC;AACJ,CAAC"}
|
|
@@ -4,9 +4,12 @@
|
|
|
4
4
|
* receipt and the observed pipeline-enforcement state?"
|
|
5
5
|
*
|
|
6
6
|
* Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
|
|
7
|
-
* (pipeline enforcement is an INPUT, observed by the host and passed in).
|
|
8
|
-
*
|
|
9
|
-
*
|
|
7
|
+
* (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
|
|
8
|
+
* chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
|
|
9
|
+
* host-attributed view ONLY with the guard-defined provenance marker. A bare
|
|
10
|
+
* `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
|
|
11
|
+
* inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
|
|
12
|
+
* outcome; it does not enter any fingerprint preimage.
|
|
10
13
|
*
|
|
11
14
|
* The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
|
|
12
15
|
* never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
|
|
@@ -19,8 +22,16 @@
|
|
|
19
22
|
* secrets.
|
|
20
23
|
*/
|
|
21
24
|
import type { GateStatusState, EnforcementState } from './merge-gate.js';
|
|
25
|
+
import { type DeployTokenReceipt } from './deploy-receipt-token.js';
|
|
22
26
|
export type { GateStatusState, EnforcementState } from './merge-gate.js';
|
|
23
|
-
|
|
27
|
+
export type { DeployTokenReceipt } from './deploy-receipt-token.js';
|
|
28
|
+
/**
|
|
29
|
+
* Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
|
|
30
|
+
* `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
|
|
31
|
+
* `currently_authorized: true` alone is untrusted input.
|
|
32
|
+
*/
|
|
33
|
+
export declare const DEPLOY_RECEIPT_VIEW_SPEC: "deploy-receipt-view.v1";
|
|
34
|
+
/** Deploy-gate reason codes (§1.1 + change-set residual + 9.0.0 verification). Success uses allow_current_deploy;
|
|
24
35
|
* enforcement_not_configured / bypass_open / change_set_not_rebound name honesty residuals on an
|
|
25
36
|
* otherwise-green check; fingerprint_mismatch is a hard failure (not a residual). */
|
|
26
37
|
export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_not_authorized' | 'operation_mismatch' | 'env_mismatch' | 'stale_artifact' | 'fingerprint_mismatch' | 'body_hash_mismatch' | 'target_mismatch' | 'decision_not_allow' | 'inputs_incomplete' | 'enforcement_not_configured' | 'bypass_open'
|
|
@@ -30,7 +41,13 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
|
|
|
30
41
|
* fingerprint_mismatch (hard failure when a re-bind WAS requested and disagreed).
|
|
31
42
|
* deploy_allowed may stay true.
|
|
32
43
|
*/
|
|
33
|
-
| 'change_set_not_rebound'
|
|
44
|
+
| 'change_set_not_rebound'
|
|
45
|
+
/**
|
|
46
|
+
* Caller handed a receipt view with currently_authorized (or bounds) but no TOKEN and no
|
|
47
|
+
* guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
|
|
48
|
+
* it" ≠ "verification says no".
|
|
49
|
+
*/
|
|
50
|
+
| 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
|
|
34
51
|
/** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
|
|
35
52
|
export type DeployTarget = {
|
|
36
53
|
environment: string;
|
|
@@ -55,7 +72,28 @@ export type DeployReceiptView = {
|
|
|
55
72
|
body_hash?: string;
|
|
56
73
|
target_id?: string;
|
|
57
74
|
signature_valid?: boolean;
|
|
75
|
+
/**
|
|
76
|
+
* VERIFIED-VIEW provenance. Must equal DEPLOY_RECEIPT_VIEW_SPEC together with
|
|
77
|
+
* `verified: true` or the gate denies unverified_receipt_view.
|
|
78
|
+
*/
|
|
79
|
+
view_spec?: string;
|
|
80
|
+
verified?: boolean;
|
|
81
|
+
verify_status?: string;
|
|
58
82
|
};
|
|
83
|
+
/** VERIFIED-VIEW: host-attributed, guard-defined marker required. */
|
|
84
|
+
export type VerifiedDeployReceiptView = DeployReceiptView & {
|
|
85
|
+
view_spec: typeof DEPLOY_RECEIPT_VIEW_SPEC;
|
|
86
|
+
verified: true;
|
|
87
|
+
verify_status: string;
|
|
88
|
+
};
|
|
89
|
+
export type DeployVerificationMode = 'token' | 'verified_view' | 'unverified' | 'none';
|
|
90
|
+
export type DeployVerificationObservation = {
|
|
91
|
+
mode: DeployVerificationMode;
|
|
92
|
+
verify_status: string | null;
|
|
93
|
+
};
|
|
94
|
+
/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
|
|
95
|
+
export declare function asVerifiedDeployReceiptView(view: DeployReceiptView, verify_status?: string): VerifiedDeployReceiptView;
|
|
96
|
+
export declare function isVerifiedDeployReceiptView(r: DeployReceiptView | null | undefined): r is VerifiedDeployReceiptView;
|
|
59
97
|
/** Pipeline-enforcement observation (from the host's CD-config read — the pure gate consumes it). */
|
|
60
98
|
export type DeployEnforcementState = {
|
|
61
99
|
enforcement: EnforcementState;
|
|
@@ -79,7 +117,13 @@ export type DeployRequiredContext = {
|
|
|
79
117
|
};
|
|
80
118
|
export type DeployGateInput = {
|
|
81
119
|
deployTarget: DeployTarget;
|
|
82
|
-
|
|
120
|
+
/**
|
|
121
|
+
* VERIFIED-VIEW (or null). A bare currently_authorized boolean is untrusted.
|
|
122
|
+
* TOKEN mode uses `token` instead (recommended).
|
|
123
|
+
*/
|
|
124
|
+
receipt?: DeployReceiptView | VerifiedDeployReceiptView | null;
|
|
125
|
+
/** TOKEN mode: signed chain_receipt + registry | pinnedKeyPem. Guard verifies locally. */
|
|
126
|
+
token?: DeployTokenReceipt;
|
|
83
127
|
requiredContext: DeployRequiredContext;
|
|
84
128
|
/** Incomplete/no-receipt → pending when true, else failure (default false). */
|
|
85
129
|
allowPending?: boolean;
|
|
@@ -112,6 +156,10 @@ export type DeployGateDecision = {
|
|
|
112
156
|
bound_artifact_id: string | null;
|
|
113
157
|
operation: string | null;
|
|
114
158
|
};
|
|
159
|
+
/**
|
|
160
|
+
* Observation: which input mode ran and the verify_status. Not a preimage field.
|
|
161
|
+
*/
|
|
162
|
+
verification: DeployVerificationObservation;
|
|
115
163
|
};
|
|
116
164
|
/**
|
|
117
165
|
* §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}
|
package/dist/cjs/deploy-gate.js
CHANGED
|
@@ -5,9 +5,12 @@
|
|
|
5
5
|
* receipt and the observed pipeline-enforcement state?"
|
|
6
6
|
*
|
|
7
7
|
* Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
|
|
8
|
-
* (pipeline enforcement is an INPUT, observed by the host and passed in).
|
|
9
|
-
*
|
|
10
|
-
*
|
|
8
|
+
* (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
|
|
9
|
+
* chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
|
|
10
|
+
* host-attributed view ONLY with the guard-defined provenance marker. A bare
|
|
11
|
+
* `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
|
|
12
|
+
* inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
|
|
13
|
+
* outcome; it does not enter any fingerprint preimage.
|
|
11
14
|
*
|
|
12
15
|
* The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
|
|
13
16
|
* never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
|
|
@@ -20,7 +23,31 @@
|
|
|
20
23
|
* secrets.
|
|
21
24
|
*/
|
|
22
25
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
26
|
+
exports.DEPLOY_RECEIPT_VIEW_SPEC = void 0;
|
|
27
|
+
exports.asVerifiedDeployReceiptView = asVerifiedDeployReceiptView;
|
|
28
|
+
exports.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
|
|
23
29
|
exports.deployGate = deployGate;
|
|
30
|
+
const deploy_receipt_token_js_1 = require("./deploy-receipt-token.js");
|
|
31
|
+
/**
|
|
32
|
+
* Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
|
|
33
|
+
* `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
|
|
34
|
+
* `currently_authorized: true` alone is untrusted input.
|
|
35
|
+
*/
|
|
36
|
+
exports.DEPLOY_RECEIPT_VIEW_SPEC = 'deploy-receipt-view.v1';
|
|
37
|
+
/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
|
|
38
|
+
function asVerifiedDeployReceiptView(view, verify_status = 'VERIFIED_CURRENT') {
|
|
39
|
+
return {
|
|
40
|
+
...view,
|
|
41
|
+
view_spec: exports.DEPLOY_RECEIPT_VIEW_SPEC,
|
|
42
|
+
verified: true,
|
|
43
|
+
verify_status,
|
|
44
|
+
};
|
|
45
|
+
}
|
|
46
|
+
function isVerifiedDeployReceiptView(r) {
|
|
47
|
+
return !!r
|
|
48
|
+
&& r.view_spec === exports.DEPLOY_RECEIPT_VIEW_SPEC
|
|
49
|
+
&& r.verified === true;
|
|
50
|
+
}
|
|
24
51
|
// ── helpers (pure) ────────────────────────────────────────────────────────────────────────────────
|
|
25
52
|
function norm(s) {
|
|
26
53
|
return String(s == null ? '' : s).trim().toLowerCase();
|
|
@@ -73,29 +100,62 @@ function deployGate(input) {
|
|
|
73
100
|
const allowPending = input.allowPending ?? rc.allowPending ?? false;
|
|
74
101
|
const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
|
|
75
102
|
const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
|
|
76
|
-
|
|
77
|
-
|
|
103
|
+
let verification = { mode: 'none', verify_status: null };
|
|
104
|
+
let receipt = input.receipt;
|
|
105
|
+
const detailOf = (r) => ({
|
|
78
106
|
environment: norm(target.environment),
|
|
79
107
|
artifact_id: norm(target.artifact_id),
|
|
80
|
-
bound_environment:
|
|
81
|
-
bound_artifact_id:
|
|
82
|
-
operation:
|
|
83
|
-
};
|
|
108
|
+
bound_environment: r && r.bound_environment != null ? norm(r.bound_environment) : null,
|
|
109
|
+
bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
|
|
110
|
+
operation: r && r.operation != null ? String(r.operation) : null,
|
|
111
|
+
});
|
|
84
112
|
const deny = (state, reason) => ({
|
|
85
113
|
deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
|
|
86
114
|
residuals: [],
|
|
87
|
-
detail,
|
|
115
|
+
detail: detailOf(receipt),
|
|
116
|
+
verification,
|
|
88
117
|
});
|
|
89
118
|
// 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
|
|
90
119
|
if (!target.environment || String(target.environment).trim() === ''
|
|
91
120
|
|| !target.artifact_id || String(target.artifact_id).trim() === '') {
|
|
92
121
|
return deny(allowPending ? 'pending' : 'failure', 'inputs_incomplete');
|
|
93
122
|
}
|
|
94
|
-
//
|
|
123
|
+
// TOKEN mode (recommended): guard verifies locally. Wins over a sibling receipt view.
|
|
124
|
+
const tokenInput = input.token;
|
|
125
|
+
if (tokenInput && typeof tokenInput.token === 'string' && tokenInput.token.length > 0) {
|
|
126
|
+
const tv = (0, deploy_receipt_token_js_1.verifyDeployReceiptToken)(tokenInput, {
|
|
127
|
+
operation: opRequired,
|
|
128
|
+
environment: target.environment,
|
|
129
|
+
artifact_id: target.artifact_id,
|
|
130
|
+
});
|
|
131
|
+
verification = { mode: 'token', verify_status: tv.status };
|
|
132
|
+
if (tv.denyReason) {
|
|
133
|
+
receipt = tv.view;
|
|
134
|
+
return deny('failure', tv.denyReason);
|
|
135
|
+
}
|
|
136
|
+
receipt = tv.view;
|
|
137
|
+
}
|
|
138
|
+
else if (receipt === null || receipt === undefined) {
|
|
139
|
+
// 1) no receipt and no token → fail-closed (D4).
|
|
140
|
+
return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
|
|
141
|
+
}
|
|
142
|
+
else if (isVerifiedDeployReceiptView(receipt)) {
|
|
143
|
+
verification = {
|
|
144
|
+
mode: 'verified_view',
|
|
145
|
+
verify_status: typeof receipt.verify_status === 'string' ? receipt.verify_status : null,
|
|
146
|
+
};
|
|
147
|
+
}
|
|
148
|
+
else {
|
|
149
|
+
// Bare currently_authorized (or any view without the guard-defined marker).
|
|
150
|
+
verification = { mode: 'unverified', verify_status: null };
|
|
151
|
+
return deny('failure', 'unverified_receipt_view');
|
|
152
|
+
}
|
|
95
153
|
if (receipt === null || receipt === undefined) {
|
|
96
154
|
return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
|
|
97
155
|
}
|
|
98
156
|
// 2) lifecycle authorization — a valid signature alone is NOT sufficient (D5).
|
|
157
|
+
// In TOKEN mode currently_authorized was COMPUTED; in VERIFIED-VIEW it is host-attributed
|
|
158
|
+
// behind view_spec (not a sneaked boolean).
|
|
99
159
|
if (receipt.currently_authorized !== true) {
|
|
100
160
|
return deny('failure', 'receipt_not_authorized');
|
|
101
161
|
}
|
|
@@ -168,7 +228,8 @@ function deployGate(input) {
|
|
|
168
228
|
inescapable_deploy,
|
|
169
229
|
residuals,
|
|
170
230
|
...(residual ? { residual } : {}),
|
|
171
|
-
detail,
|
|
231
|
+
detail: detailOf(receipt),
|
|
232
|
+
verification,
|
|
172
233
|
};
|
|
173
234
|
}
|
|
174
235
|
//# sourceMappingURL=deploy-gate.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAsGH,kEAUC;AAED,kEAIC;AA6GD,gCAqJC;AArXD,uEAGmC;AAKnC;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,wBAAiC,CAAC;AAqF1E,uFAAuF;AACvF,SAAgB,2BAA2B,CACzC,IAAuB,EACvB,aAAa,GAAG,kBAAkB;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,gCAAwB;QACnC,QAAQ,EAAE,IAAI;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,CAAuC;IACjF,OAAO,CAAC,CAAC,CAAC;WACL,CAAC,CAAC,SAAS,KAAK,gCAAwB;WACxC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AA0ED,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,uCAAuC;IACvI,MAAM,UAAU,GAAG,iBAAiB,KAAK,WAAW,IAAI,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,uCAAuC;IACvI,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE/E,IAAI,YAAY,GAAkC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,OAAO,GAAyC,KAAK,CAAC,OAAO,CAAC;IAElE,MAAM,QAAQ,GAAG,CAAC,CAAuC,EAAE,EAAE,CAAC,CAAC;QAC7D,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACtF,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACjE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK;QAClF,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/B,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,EAAE,GAAG,IAAA,kDAAwB,EAAC,UAAU,EAAE;YAC9C,SAAS,EAAE,UAAU;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,UAA8B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,iDAAiD;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,YAAY,GAAG;YACb,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;SACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,YAAY,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,+EAA+E;IAC/E,6FAA6F;IAC7F,+CAA+C;IAC/C,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,kGAAkG;IAClG,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,MAAM,kBAAkB,GAAG,aAAa,IAAI,OAAO,CAAC;IAEpD,mEAAmE;IACnE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;;YAChE,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;QACzB,YAAY;KACb,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* TOKEN-mode chain-receipt verification for deployGate.
|
|
3
|
+
*
|
|
4
|
+
* SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
|
|
5
|
+
* unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
|
|
6
|
+
* NOT exported by that SDK. This module:
|
|
7
|
+
* - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
|
|
8
|
+
* (`createPublicKey` + `verify`) — no new algorithm
|
|
9
|
+
* - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
|
|
10
|
+
* - reuses this package's `computeBodyHash` for envelope bind
|
|
11
|
+
* - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
|
|
12
|
+
*
|
|
13
|
+
* No fetch. Same inputs → same output.
|
|
14
|
+
*/
|
|
15
|
+
import type { ExecutorKeyRegistry } from '@coderifts/sdk';
|
|
16
|
+
/** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
|
|
17
|
+
export type TokenDerivedReceiptView = {
|
|
18
|
+
currently_authorized: boolean;
|
|
19
|
+
decision: string;
|
|
20
|
+
execution_action?: string;
|
|
21
|
+
operation?: string;
|
|
22
|
+
bound_environment?: string | null;
|
|
23
|
+
bound_artifact_id?: string | null;
|
|
24
|
+
verdict_fingerprint?: string;
|
|
25
|
+
body_hash?: string;
|
|
26
|
+
target_id?: string;
|
|
27
|
+
};
|
|
28
|
+
export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
|
|
29
|
+
export type DeployTokenReceipt = {
|
|
30
|
+
/** Signed chain_receipt token (`base64url(body).base64url(sig)`). */
|
|
31
|
+
token: string;
|
|
32
|
+
/** Body-hash-bound decision envelope (verifier family). Required for currently_authorized. */
|
|
33
|
+
decision_result?: Record<string, unknown>;
|
|
34
|
+
/** Well-known-shaped registry `{ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }`. */
|
|
35
|
+
registry?: ExecutorKeyRegistry;
|
|
36
|
+
/** Air-gap single PEM (kid-agnostic). */
|
|
37
|
+
pinnedKeyPem?: string;
|
|
38
|
+
};
|
|
39
|
+
export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION';
|
|
40
|
+
export type DeployTokenVerifyResult = {
|
|
41
|
+
valid: boolean;
|
|
42
|
+
status: DeployTokenVerifyStatus;
|
|
43
|
+
currently_authorized: boolean;
|
|
44
|
+
authz_reason: string | null;
|
|
45
|
+
/** When set, deployGate denies with this reason before bind checks. */
|
|
46
|
+
denyReason: string | null;
|
|
47
|
+
payload?: Record<string, unknown>;
|
|
48
|
+
view: TokenDerivedReceiptView | null;
|
|
49
|
+
key_status: 'active' | 'retired' | null;
|
|
50
|
+
};
|
|
51
|
+
/**
|
|
52
|
+
* Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
|
|
53
|
+
*/
|
|
54
|
+
export declare function verifyDeployReceiptToken(input: DeployTokenReceipt, _intended?: {
|
|
55
|
+
operation?: string;
|
|
56
|
+
environment?: string;
|
|
57
|
+
artifact_id?: string;
|
|
58
|
+
}, nowMs?: number): DeployTokenVerifyResult;
|
|
59
|
+
//# sourceMappingURL=deploy-receipt-token.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deploy-receipt-token.d.ts","sourceRoot":"","sources":["../../src/deploy-receipt-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAAG;IACpC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,kBAAkB,GAClB,4BAA4B,GAC5B,mBAAmB,GACnB,WAAW,GACX,aAAa,GACb,qBAAqB,CAAC;AAE1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC;CACzC,CAAC;AA+GF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,SAAS,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,EAClF,KAAK,CAAC,EAAE,MAAM,GACb,uBAAuB,CA2HzB"}
|