@coderifts/agent-guard 8.5.0 → 9.1.0

package/README.md

@@ -257,7 +257,10 @@ Honesty (do not over-claim):
 - **CAS / conditional write** is a **host assertion** (`conditional_write: true` on the write).
   This package never writes and cannot verify the swap. `requireConditionalWrite` refuses
   `enforced: true` when the host does not report it. No atomic CAS at commit; T3 observes the
-  result after the write (not atomic).
+  result after the write (not atomic). Under `ENFORCING_STRICT`, `enforced` remains that
+  pre-write fact; the final success name is `authorized_and_committed` only when
+  `cas_evidence` is `executor_attested` and the attestation cross-checks grant/receipt —
+  otherwise `authorized_not_committed` (`commit_evidence_missing`).
 - Host-invoked raw tools outside the returned table remain invisible
   (`calls_outside_guarded_path_invisible`). `composition_assurance.inescapable_runtime` stays false.
 
@@ -570,30 +573,46 @@ honest, so the composition hands the caller the piece it owns and stops.
 
 #### `deployGate` and deploy-time `bindDeploy`
 
-`deployGate` is the pure decision. **`bindDeploy`** is the pure **caller** at the moment of
-deploying: the host supplies `{ environment, artifact_id, receipt, pipeline_enforcement }`; the
-package composes `deployGate` and returns a decision. No I/O, no receipt re-verify, no CD call.
+`deployGate` is the pure decision. **`bindDeploy`** is the pure **caller** at the
+moment of deploying. Two **explicit, non-guessable** receipt input modes (9.0.0;
+P0 / audit 2026-08-24):
 
-Same shape as the merge gate (`gateDecision` is pure; GitHub enforces outside us). Deploy differs:
-there is no PR status check to hang on, and **the environment name is a host assertion** — the
-receipt’s `bound_environment` is signed evidence; the target environment string is not. A host can
-claim `staging` while deploying to production; the package cannot tell. The result always reports
-`environment.provenance: 'host_asserted'` (never `verified`).
+**(a) TOKEN mode (recommended).** Pass the signed chain_receipt token plus
+`{ registry | pinnedKeyPem }` and the decision envelope. The guard verifies
+**locally** (Ed25519, kid / retired window, body-hash, ID104 leeway). No
+HTTP — SDK 3.4.0 `client.verifyReceipt` is I/O and is not used here.
+
+**(b) VERIFIED-VIEW mode.** Pass `{ view_spec: 'deploy-receipt-view.v1',
+verified: true, verify_status, currently_authorized, bounds… }` produced by a
+verification the host attributes. Stamp with `asVerifiedDeployReceiptView`.
+The marker is the same idiom as `proof_spec` / `attestation_spec`.
+
+A bare `{ currently_authorized: true }` with **no** `view_spec` and **no**
+token is DENY `unverified_receipt_view` — not `receipt_not_authorized`.
+
+`g.verification = { mode, verify_status }` is observation (not a preimage).
+The environment name remains a **host assertion**
+(`environment.provenance: 'host_asserted'`).
 
 ```typescript
-import { bindDeploy } from '@coderifts/agent-guard';
+import { bindDeploy, asVerifiedDeployReceiptView, deployGate } from '@coderifts/agent-guard';
+
+// TOKEN (recommended)
+const g = deployGate({
+  deployTarget: { environment: 'production', artifact_id: digest },
+  token: { token, decision_result, registry }, // or pinnedKeyPem
+  requiredContext: { operation: 'deploy', enforcement: { enforcement: 'ENFORCING', bypass_possible: false } },
+});
+// g.verification.mode === 'token'
 
+// VERIFIED-VIEW (host already verified)
 const r = bindDeploy({
   environment: { name: 'production', provenance: 'host_asserted' },
   artifact_id: digest,
-  receipt: receiptView, // finished view — not re-verified here
+  receipt: asVerifiedDeployReceiptView(computedView, 'VERIFIED_CURRENT'),
   pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
 });
-// r.decision_allows_deploy  — pure decision only
-// r.pipeline_action         — always 'not_observed' (we did not block or run the pipeline)
-// r.environment.provenance  — always 'host_asserted'
-// r.inescapable_deploy      — only true under ENFORCING ∧ ¬bypass (from the gate, not a host flag)
-if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
+if (!r.decision_allows_deploy) process.exit(1);
 ```
 
 #### `deployGate` is also the publish / register gate
@@ -606,24 +625,19 @@ verdict, enforcement residual). Prefer **`bindDeploy`** at the live step; raw `d
 for hosts that already build the full input.
 
 ```typescript
-import { deployGate } from '@coderifts/agent-guard';
+import { deployGate, asVerifiedDeployReceiptView } from '@coderifts/agent-guard';
 
-// npm publish — same gate, operation label 'publish'
 const g = deployGate({
   deployTarget: {
     environment: 'npm',
     artifact_id: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
   },
-  // Receipt view: server receipt must have been issued for operation 'publish' (T7 match).
-  // bound_environment / bound_artifact_id are NOT server-emitted signed fields — the caller
-  // supplies them on this view alongside the token (deploy-gate's "view of the finished receipt").
-  receipt,
+  receipt: asVerifiedDeployReceiptView(publishView, 'VERIFIED_CURRENT'),
   requiredContext: {
     operation: 'publish',
     enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
   },
 });
-// g.deploy_allowed — decision flag (name is historical; see caveat)
 ```
 
 MCP **register** is the same shape: set `operation: 'register'` and put the **manifest digest** in

package/dist/cjs/cas-attestation.d.ts

@@ -105,7 +105,29 @@ export type EvaluateCasEvidenceOpts = {
     registry?: ExecutorKeyRegistry | null;
     grant?: string | null;
     receipt_digest?: string | null;
+    grant_fields?: {
+        jti?: string;
+        scope_hash?: string;
+        state_nonce?: string;
+        receipt_digest?: string;
+    } | null;
+    /** Strict-only tightening of derived.authorized_and_committed. Absent = 9.0.0 formula. */
+    profile?: 'ENFORCING_STRICT';
 };
+/** Existing CasAttestation.derived name and its honest sibling — not a parallel taxonomy. */
+export type CommitLabel = 'authorized_and_committed' | 'authorized_not_committed';
+export declare const COMMIT_EVIDENCE_MISSING: "commit_evidence_missing";
+export type StrictCommitObservation = {
+    commit_label: CommitLabel;
+    commit_evidence_reason?: typeof COMMIT_EVIDENCE_MISSING;
+};
+/**
+ * ENFORCING_STRICT success name. authorized_and_committed only when the evidence class is
+ * executor_attested AND a kernel binding (grant jti / scope_hash / receipt_digest) was supplied
+ * so the attestation actually cross-checked this outcome. Otherwise authorized_not_committed
+ * with reason commit_evidence_missing. Observation-side — does not change enforced.
+ */
+export declare function strictCommitObservation(outcome: unknown, evidence: CasEvidence | undefined, opts?: EvaluateCasEvidenceOpts): StrictCommitObservation;
 /** Pull the attestation token from the CAS outcome or the mutation response body. */
 export declare function extractExecutorAttestationToken(outcome: unknown): string | null;
 /**

package/dist/cjs/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAkBF,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAgDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAgB/F;AAiCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CA0ChB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAClF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AAaF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAgB/F;AAiCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAkDhB"}

package/dist/cjs/cas-attestation.js

@@ -13,7 +13,8 @@
  * widening the proof spec.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CAS_ATTESTATION_SPEC = void 0;
+exports.COMMIT_EVIDENCE_MISSING = exports.CAS_ATTESTATION_SPEC = void 0;
+exports.strictCommitObservation = strictCommitObservation;
 exports.extractExecutorAttestationToken = extractExecutorAttestationToken;
 exports.evaluateCasEvidence = evaluateCasEvidence;
 exports.isGuardExecutionProof = isGuardExecutionProof;
@@ -31,6 +32,40 @@ const LIMITS = Object.freeze({
     does_not_claim_host_cannot_bypass: true,
     does_not_claim_governance_redecision: true,
 });
+exports.COMMIT_EVIDENCE_MISSING = 'commit_evidence_missing';
+function bindingIntendedSupplied(outcome, opts) {
+    const from = intendedFromOutcome(outcome);
+    if (opts.grant && String(opts.grant).length > 0)
+        return true;
+    if (from.grant && String(from.grant).length > 0)
+        return true;
+    if (opts.receipt_digest && String(opts.receipt_digest).length > 0)
+        return true;
+    if (from.receipt_digest && String(from.receipt_digest).length > 0)
+        return true;
+    const gf = opts.grant_fields;
+    if (gf && (gf.jti || gf.scope_hash || gf.receipt_digest))
+        return true;
+    return false;
+}
+/**
+ * ENFORCING_STRICT success name. authorized_and_committed only when the evidence class is
+ * executor_attested AND a kernel binding (grant jti / scope_hash / receipt_digest) was supplied
+ * so the attestation actually cross-checked this outcome. Otherwise authorized_not_committed
+ * with reason commit_evidence_missing. Observation-side — does not change enforced.
+ */
+function strictCommitObservation(outcome, evidence, opts = {}) {
+    const crossChecked = evidence != null
+        && evidence.class === 'executor_attested'
+        && bindingIntendedSupplied(outcome, opts);
+    if (crossChecked) {
+        return { commit_label: 'authorized_and_committed' };
+    }
+    return {
+        commit_label: 'authorized_not_committed',
+        commit_evidence_reason: exports.COMMIT_EVIDENCE_MISSING,
+    };
+}
 const ABSENT_EVIDENCE = Object.freeze({
     class: 'absent',
     attest_status: null,
@@ -91,6 +126,7 @@ function evaluateCasEvidence(outcome, opts = {}) {
     const fromOutcome = intendedFromOutcome(outcome);
     const grant = opts.grant || fromOutcome.grant || null;
     const receipt_digest = opts.receipt_digest || fromOutcome.receipt_digest || null;
+    const grant_fields = opts.grant_fields || null;
     if (!registry || !Array.isArray(registry.keys)) {
         return hostClaimed(null, null, null);
     }
@@ -102,6 +138,8 @@ function evaluateCasEvidence(outcome, opts = {}) {
         intended.grant = grant;
     if (receipt_digest)
         intended.receipt_digest = receipt_digest;
+    if (grant_fields)
+        intended.grant_fields = grant_fields;
     const wantsIntended = Object.keys(intended).length > 0;
     let verified;
     try {
@@ -208,7 +246,15 @@ function buildCasAttestation(proof, outcome, opts = {}) {
     const write_ran = cas.write_ran === true;
     const stale_during_commit = cas.status === 'committed_stale_detected';
     const refused = cas.status === 'refused';
-    const authorized_and_committed = receipt_verified && cas.status === 'committed';
+    const cas_evidence = evaluateCasEvidence(outcome, opts);
+    let authorized_and_committed = receipt_verified && cas.status === 'committed';
+    // ENFORCING_STRICT: the existing derived name now requires executor_attested + kernel
+    // cross-check. Non-strict keeps the 9.0.0 formula (receipt verified + clean commit).
+    if (opts.profile === 'ENFORCING_STRICT') {
+        const obs = strictCommitObservation(outcome, cas_evidence, opts);
+        authorized_and_committed = authorized_and_committed
+            && obs.commit_label === 'authorized_and_committed';
+    }
     const attestation = {
         attestation_spec: exports.CAS_ATTESTATION_SPEC,
         references: Object.freeze({
@@ -225,7 +271,7 @@ function buildCasAttestation(proof, outcome, opts = {}) {
             stale_during_commit,
             refused,
         }),
-        cas_evidence: evaluateCasEvidence(outcome, opts),
+        cas_evidence,
         limits: LIMITS,
     };
     return freezeAttestation(attestation);

package/dist/cjs/cas-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAyIH,0EAYC;AAqBD,kDAmDC;AAGD,sDAQC;AAGD,kEAgBC;AAuCD,kDA8CC;AA9UD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AAmFH,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IAEjF,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAEhF,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;SACR,CAAC;QACF,YAAY,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cas-attestation.js","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0JH,0DAeC;AAmBD,0EAYC;AAqBD,kDAyDC;AAGD,sDAQC;AAGD,kEAgBC;AAuCD,kDAsDC;AA/YD,wCAA4D;AAG5D,6DAA4D;AAG5D,uEAAuE;AAC1D,QAAA,oBAAoB,GAAG,oBAA6B,CAAC;AAqBlE,MAAM,MAAM,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjD,iCAAiC,EAAE,IAAI;IACvC,mDAAmD,EAAE,IAAI;IACzD,sCAAsC,EAAE,IAAI;IAC5C,qDAAqD,EAAE,IAAI;IAC3D,iCAAiC,EAAE,IAAI;IACvC,oCAAoC,EAAE,IAAI;CAC3C,CAAC,CAAC;AA6FU,QAAA,uBAAuB,GAAG,yBAAkC,CAAC;AAO1E,SAAS,uBAAuB,CAAC,OAAgB,EAAE,IAA6B;IAC9E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,OAAgB,EAChB,QAAiC,EACjC,OAAgC,EAAE;IAElC,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI;WAChC,QAAQ,CAAC,KAAK,KAAK,mBAAmB;WACtC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,0BAA0B;QACxC,sBAAsB,EAAE,+BAAuB;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAgB,MAAM,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,MAAqB,EAAE,GAAkB,EAAE,GAAkB;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,CAAC,oBAAoB,CAAC;IAChC,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAI,CAA6B,CAAC,oBAAoB,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,QAAQ,GAAgD,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC7D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SAC3E,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,OAAgB,EAChB,OAAgC,EAAE;IAElC,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IAEzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAIV,EAAE,CAAC;IACP,IAAI,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,IAAI,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,cAAc,CAAC;IAC7D,IAAI,YAAY;QAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,gCAA0B,EAAC,KAAK,EAAE;YAC3C,QAAQ;YACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,QAAQ,CAAC,OAAkC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;WACpB,CAAC,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,mCAAmC,CAAC,EAAE,CAAC;QACvG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,YAAY,EAAE,GAAG;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,2DAA2D;AAC3D,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAiF,CAAC;IAC5F,OAAO,CAAC,CAAC,UAAU,KAAK,yCAAoB;WACvC,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,qBAAqB,IAAI,IAAI;WAC/B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,2BAA2B,CAAC,CAAU;IACpD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAyB,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAgC,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAmD,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,CAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAwB,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,IAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAc;YACzB,MAAM,EAAE,qBAA8B;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,2BAA2B;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,IAAa;QACxB,MAAM,EAAE,qBAA8B;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB;KACxF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,OAA2C,EAC3C,OAAgC,EAAE;IAElC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,+FAA+F;cAC7F,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,yFAAyF;cACvF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;IACzC,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,KAAK,0BAA0B,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IACzC,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,wBAAwB,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9E,sFAAsF;IACtF,qFAAqF;IACrF,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,wBAAwB,GAAG,wBAAwB;eAC9C,GAAG,CAAC,YAAY,KAAK,0BAA0B,CAAC;IACvD,CAAC;IAED,MAAM,WAAW,GAAmB;QAClC,gBAAgB,EAAE,4BAAoB;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,qBAAqB,EAAE,yBAAyB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC7E,gBAAgB;SACjB,CAAC;QACF,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,wBAAwB;YACxB,SAAS;YACT,mBAAmB;YACnB,OAAO;SACR,CAAC;QACF,YAAY;QACZ,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAiB;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cjs/deploy-bind.d.ts

@@ -11,15 +11,15 @@
  *      signed evidence; the deploy target's environment string is not verified by us.
  *      A host can claim "staging" while deploying to production. The output says so.
  *
- * This module performs NO I/O, does NOT re-verify receipts, and does NOT act on a
- * pipeline. pipeline_action is always 'not_observed'. inescapable_deploy still comes
- * only from deployGate (ENFORCING ∧ ¬bypass) — never flipped here.
+ * TOKEN mode: bindDeploy forwards `token` to deployGate, which verifies locally
+ * (no HTTP). VERIFIED-VIEW must carry the guard-defined view_spec. pipeline_action
+ * is always 'not_observed'. inescapable_deploy still comes only from deployGate.
  *
  * External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
  * (deployBind). That is a consumer; this is the package-local pure entry hosts should
  * call so the decision logic has a first-class caller in-repo.
  */
-import { type DeployEnforcementState, type DeployGateDecision, type DeployGateReason, type DeployReceiptView, type GateStatusState } from './deploy-gate.js';
+import { type DeployEnforcementState, type DeployGateDecision, type DeployGateReason, type DeployReceiptView, type GateStatusState, type DeployTokenReceipt } from './deploy-gate.js';
 /** Reasons a fresh re-preflight for this { env, artifact } can repair. */
 declare const REPAIRABLE: ReadonlySet<DeployGateReason>;
 /**
@@ -45,10 +45,12 @@ export type BindDeployInput = {
     service?: string;
     pipeline_run_id?: string;
     /**
-     * Finished receipt VIEW (fields already produced + lifecycle-evaluated elsewhere).
-     * This function does not verify signatures or re-issue receipts. null → no_receipt.
+     * VERIFIED-VIEW (must carry view_spec) or null. TOKEN mode: pass `token` instead.
+     * A bare currently_authorized boolean is denied as unverified_receipt_view.
      */
-    receipt: DeployReceiptView | null;
+    receipt?: DeployReceiptView | null;
+    /** TOKEN mode: signed chain_receipt + registry | pinnedKeyPem. Guard verifies. */
+    token?: DeployTokenReceipt;
     /**
      * Host-observed pipeline enforcement (CD config / step policy). Same role as
      * ProtectionState for merge — an input, not a package discovery.

package/dist/cjs/deploy-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-bind.d.ts","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,QAAA,MAAM,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAS5C,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,eAAe,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC9C,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+EAA+E;IAC/E,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,mBAAmB,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,MAAM,EAAE,gBAAgB,CAAC;IACzB,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,uBAAuB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAWF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAmDnE;AAED,OAAO,EAAE,UAAU,IAAI,yBAAyB,EAAE,CAAC"}
+{"version":3,"file":"deploy-bind.d.ts","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,QAAA,MAAM,UAAU,EAAE,WAAW,CAAC,gBAAgB,CAc5C,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,eAAe,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC9C,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,kFAAkF;IAClF,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+EAA+E;IAC/E,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,mBAAmB,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,MAAM,EAAE,gBAAgB,CAAC;IACzB,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,EAAE,uBAAuB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAAC;AAWF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAoDnE;AAED,OAAO,EAAE,UAAU,IAAI,yBAAyB,EAAE,CAAC"}

package/dist/cjs/deploy-bind.js

@@ -12,9 +12,9 @@
  *      signed evidence; the deploy target's environment string is not verified by us.
  *      A host can claim "staging" while deploying to production. The output says so.
  *
- * This module performs NO I/O, does NOT re-verify receipts, and does NOT act on a
- * pipeline. pipeline_action is always 'not_observed'. inescapable_deploy still comes
- * only from deployGate (ENFORCING ∧ ¬bypass) — never flipped here.
+ * TOKEN mode: bindDeploy forwards `token` to deployGate, which verifies locally
+ * (no HTTP). VERIFIED-VIEW must carry the guard-defined view_spec. pipeline_action
+ * is always 'not_observed'. inescapable_deploy still comes only from deployGate.
  *
  * External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
  * (deployBind). That is a consumer; this is the package-local pure entry hosts should
@@ -34,6 +34,11 @@ const REPAIRABLE = new Set([
     'body_hash_mismatch',
     'no_receipt',
     'inputs_incomplete',
+    'unverified_receipt_view',
+    'invalid_signature',
+    'expired',
+    'unknown_key',
+    'retired_key',
 ]);
 exports.DEPLOY_REPAIRABLE_REASONS = REPAIRABLE;
 function asHostAssertedEnvironment(env) {
@@ -90,6 +95,7 @@ function bindDeploy(input) {
     const gate = (0, deploy_gate_js_1.deployGate)({
         deployTarget,
         receipt: input.receipt,
+        token: input.token,
         requiredContext,
         ...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
         ...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),

package/dist/cjs/deploy-bind.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAoIH,gCAmDC;AArLD,qDAQ0B;AAE1B,0EAA0E;AAC1E,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAC;AAmKoB,+CAAyB;AA/EhD,SAAS,yBAAyB,CAAC,GAAqC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,iFAAiF;IACjF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC;IAE9C,MAAM,YAAY,GAAiB;QACjC,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IAEF,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE,WAAW,EAAE,SAAkB,EAAE,eAAe,EAAE,IAAI,EAAE;QACrG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAI;YACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,2BAAU,EAAC;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,sBAAsB,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QACpD,mBAAmB,EAAE,IAAI,CAAC,KAAK;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,WAAW,EAAE,qCAAqC;QAClD,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AA4IH,gCAoDC;AA9LD,qDAS0B;AAE1B,0EAA0E;AAC1E,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAsKoB,+CAAyB;AAhFhD,SAAS,yBAAyB,CAAC,GAAqC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,iFAAiF;IACjF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC;IAE9C,MAAM,YAAY,GAAiB;QACjC,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IAEF,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE,WAAW,EAAE,SAAkB,EAAE,eAAe,EAAE,IAAI,EAAE;QACrG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAI;YACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,2BAAU,EAAC;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,sBAAsB,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QACpD,mBAAmB,EAAE,IAAI,CAAC,KAAK;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,WAAW,EAAE,qCAAqC;QAClD,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI;KACrD,CAAC;AACJ,CAAC"}

package/dist/cjs/deploy-gate.d.ts

@@ -4,9 +4,12 @@
  * receipt and the observed pipeline-enforcement state?"
  *
  * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
- * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
- * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
- * inputs → same output (D9).
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
+ * chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
+ * host-attributed view ONLY with the guard-defined provenance marker. A bare
+ * `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
+ * inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
+ * outcome; it does not enter any fingerprint preimage.
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
@@ -19,8 +22,16 @@
  * secrets.
  */
 import type { GateStatusState, EnforcementState } from './merge-gate.js';
+import { type DeployTokenReceipt } from './deploy-receipt-token.js';
 export type { GateStatusState, EnforcementState } from './merge-gate.js';
-/** The 14 deploy-gate reason codes (§1.1 + change-set residual). Success uses allow_current_deploy;
+export type { DeployTokenReceipt } from './deploy-receipt-token.js';
+/**
+ * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
+ * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
+ * `currently_authorized: true` alone is untrusted input.
+ */
+export declare const DEPLOY_RECEIPT_VIEW_SPEC: "deploy-receipt-view.v1";
+/** Deploy-gate reason codes (§1.1 + change-set residual + 9.0.0 verification). Success uses allow_current_deploy;
  *  enforcement_not_configured / bypass_open / change_set_not_rebound name honesty residuals on an
  *  otherwise-green check; fingerprint_mismatch is a hard failure (not a residual). */
 export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_not_authorized' | 'operation_mismatch' | 'env_mismatch' | 'stale_artifact' | 'fingerprint_mismatch' | 'body_hash_mismatch' | 'target_mismatch' | 'decision_not_allow' | 'inputs_incomplete' | 'enforcement_not_configured' | 'bypass_open'
@@ -30,7 +41,13 @@ export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_
  * fingerprint_mismatch (hard failure when a re-bind WAS requested and disagreed).
  * deploy_allowed may stay true.
  */
- | 'change_set_not_rebound';
+ | 'change_set_not_rebound'
+/**
+ * Caller handed a receipt view with currently_authorized (or bounds) but no TOKEN and no
+ * guard-defined view_spec provenance. Distinct from receipt_not_authorized: "you didn't prove
+ * it" ≠ "verification says no".
+ */
+ | 'unverified_receipt_view' | 'invalid_signature' | 'expired' | 'unknown_key' | 'retired_key';
 /** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
 export type DeployTarget = {
     environment: string;
@@ -55,7 +72,28 @@ export type DeployReceiptView = {
     body_hash?: string;
     target_id?: string;
     signature_valid?: boolean;
+    /**
+     * VERIFIED-VIEW provenance. Must equal DEPLOY_RECEIPT_VIEW_SPEC together with
+     * `verified: true` or the gate denies unverified_receipt_view.
+     */
+    view_spec?: string;
+    verified?: boolean;
+    verify_status?: string;
 };
+/** VERIFIED-VIEW: host-attributed, guard-defined marker required. */
+export type VerifiedDeployReceiptView = DeployReceiptView & {
+    view_spec: typeof DEPLOY_RECEIPT_VIEW_SPEC;
+    verified: true;
+    verify_status: string;
+};
+export type DeployVerificationMode = 'token' | 'verified_view' | 'unverified' | 'none';
+export type DeployVerificationObservation = {
+    mode: DeployVerificationMode;
+    verify_status: string | null;
+};
+/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
+export declare function asVerifiedDeployReceiptView(view: DeployReceiptView, verify_status?: string): VerifiedDeployReceiptView;
+export declare function isVerifiedDeployReceiptView(r: DeployReceiptView | null | undefined): r is VerifiedDeployReceiptView;
 /** Pipeline-enforcement observation (from the host's CD-config read — the pure gate consumes it). */
 export type DeployEnforcementState = {
     enforcement: EnforcementState;
@@ -79,7 +117,13 @@ export type DeployRequiredContext = {
 };
 export type DeployGateInput = {
     deployTarget: DeployTarget;
-    receipt: DeployReceiptView | null;
+    /**
+     * VERIFIED-VIEW (or null). A bare currently_authorized boolean is untrusted.
+     * TOKEN mode uses `token` instead (recommended).
+     */
+    receipt?: DeployReceiptView | VerifiedDeployReceiptView | null;
+    /** TOKEN mode: signed chain_receipt + registry | pinnedKeyPem. Guard verifies locally. */
+    token?: DeployTokenReceipt;
     requiredContext: DeployRequiredContext;
     /** Incomplete/no-receipt → pending when true, else failure (default false). */
     allowPending?: boolean;
@@ -112,6 +156,10 @@ export type DeployGateDecision = {
         bound_artifact_id: string | null;
         operation: string | null;
     };
+    /**
+     * Observation: which input mode ran and the verify_status. Not a preimage field.
+     */
+    verification: DeployVerificationObservation;
 };
 /**
  * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.

package/dist/cjs/deploy-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB,CAAC;AAE7B,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAkHrE"}
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAG,wBAAiC,CAAC;AAE1E;;sFAEsF;AACtF,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa;AACf;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;GAIG;GACD,yBAAyB,GACzB,mBAAmB,GACnB,SAAS,GACT,aAAa,GACb,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,GAAG;IAC1D,SAAS,EAAE,OAAO,wBAAwB,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,MAAM,CAAC;AAEvF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,EACvB,aAAa,SAAqB,GACjC,yBAAyB,CAO3B;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,yBAAyB,CAInH;AAED,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,yBAAyB,GAAG,IAAI,CAAC;IAC/D,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF;;OAEG;IACH,YAAY,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAqJrE"}

package/dist/cjs/deploy-gate.js

@@ -5,9 +5,12 @@
  * receipt and the observed pipeline-enforcement state?"
  *
  * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
- * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
- * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
- * inputs → same output (D9).
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). TOKEN mode verifies a
+ * chain-receipt locally (Ed25519 + registry/pinned PEM; no HTTP). VERIFIED-VIEW mode accepts a
+ * host-attributed view ONLY with the guard-defined provenance marker. A bare
+ * `currently_authorized: true` is not proof (P0 / external audit 2026-08-24). Same
+ * inputs → same output (D9). Observation `verification.{mode,verify_status}` is recorded on the
+ * outcome; it does not enter any fingerprint preimage.
  *
  * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
  * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
@@ -20,7 +23,31 @@
  * secrets.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_RECEIPT_VIEW_SPEC = void 0;
+exports.asVerifiedDeployReceiptView = asVerifiedDeployReceiptView;
+exports.isVerifiedDeployReceiptView = isVerifiedDeployReceiptView;
 exports.deployGate = deployGate;
+const deploy_receipt_token_js_1 = require("./deploy-receipt-token.js");
+/**
+ * Guard-defined VERIFIED-VIEW provenance marker (same idiom as `proof_spec` /
+ * `attestation_spec`). A host that already verified (CLI, etc.) MUST set this —
+ * `currently_authorized: true` alone is untrusted input.
+ */
+exports.DEPLOY_RECEIPT_VIEW_SPEC = 'deploy-receipt-view.v1';
+/** Stamp a computed view so deployGate will accept it as VERIFIED-VIEW (not TOKEN). */
+function asVerifiedDeployReceiptView(view, verify_status = 'VERIFIED_CURRENT') {
+    return {
+        ...view,
+        view_spec: exports.DEPLOY_RECEIPT_VIEW_SPEC,
+        verified: true,
+        verify_status,
+    };
+}
+function isVerifiedDeployReceiptView(r) {
+    return !!r
+        && r.view_spec === exports.DEPLOY_RECEIPT_VIEW_SPEC
+        && r.verified === true;
+}
 // ── helpers (pure) ────────────────────────────────────────────────────────────────────────────────
 function norm(s) {
     return String(s == null ? '' : s).trim().toLowerCase();
@@ -73,29 +100,62 @@ function deployGate(input) {
     const allowPending = input.allowPending ?? rc.allowPending ?? false;
     const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
     const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
-    const receipt = input.receipt;
-    const detail = {
+    let verification = { mode: 'none', verify_status: null };
+    let receipt = input.receipt;
+    const detailOf = (r) => ({
         environment: norm(target.environment),
         artifact_id: norm(target.artifact_id),
-        bound_environment: receipt && receipt.bound_environment != null ? norm(receipt.bound_environment) : null,
-        bound_artifact_id: receipt && receipt.bound_artifact_id != null ? norm(receipt.bound_artifact_id) : null,
-        operation: receipt && receipt.operation != null ? String(receipt.operation) : null,
-    };
+        bound_environment: r && r.bound_environment != null ? norm(r.bound_environment) : null,
+        bound_artifact_id: r && r.bound_artifact_id != null ? norm(r.bound_artifact_id) : null,
+        operation: r && r.operation != null ? String(r.operation) : null,
+    });
     const deny = (state, reason) => ({
         deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false,
         residuals: [],
-        detail,
+        detail: detailOf(receipt),
+        verification,
     });
     // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
     if (!target.environment || String(target.environment).trim() === ''
         || !target.artifact_id || String(target.artifact_id).trim() === '') {
         return deny(allowPending ? 'pending' : 'failure', 'inputs_incomplete');
     }
-    // 1) no receipt → fail-closed (D4).
+    // TOKEN mode (recommended): guard verifies locally. Wins over a sibling receipt view.
+    const tokenInput = input.token;
+    if (tokenInput && typeof tokenInput.token === 'string' && tokenInput.token.length > 0) {
+        const tv = (0, deploy_receipt_token_js_1.verifyDeployReceiptToken)(tokenInput, {
+            operation: opRequired,
+            environment: target.environment,
+            artifact_id: target.artifact_id,
+        });
+        verification = { mode: 'token', verify_status: tv.status };
+        if (tv.denyReason) {
+            receipt = tv.view;
+            return deny('failure', tv.denyReason);
+        }
+        receipt = tv.view;
+    }
+    else if (receipt === null || receipt === undefined) {
+        // 1) no receipt and no token → fail-closed (D4).
+        return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
+    }
+    else if (isVerifiedDeployReceiptView(receipt)) {
+        verification = {
+            mode: 'verified_view',
+            verify_status: typeof receipt.verify_status === 'string' ? receipt.verify_status : null,
+        };
+    }
+    else {
+        // Bare currently_authorized (or any view without the guard-defined marker).
+        verification = { mode: 'unverified', verify_status: null };
+        return deny('failure', 'unverified_receipt_view');
+    }
     if (receipt === null || receipt === undefined) {
         return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
     }
     // 2) lifecycle authorization — a valid signature alone is NOT sufficient (D5).
+    //    In TOKEN mode currently_authorized was COMPUTED; in VERIFIED-VIEW it is host-attributed
+    //    behind view_spec (not a sneaked boolean).
     if (receipt.currently_authorized !== true) {
         return deny('failure', 'receipt_not_authorized');
     }
@@ -168,7 +228,8 @@ function deployGate(input) {
         inescapable_deploy,
         residuals,
         ...(residual ? { residual } : {}),
-        detail,
+        detail: detailOf(receipt),
+        verification,
     };
 }
 //# sourceMappingURL=deploy-gate.js.map