@corca-org/ceal-host-darwin-arm64 1.0.15 → 1.0.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/ceal-host +0 -0
- package/libexec/ceal-host/claude-hook.mjs +200 -147
- package/libexec/ceal-host/claude-invocation-authentication.mjs +200 -147
- package/libexec/ceal-host/claude-producer.mjs +200 -147
- package/libexec/ceal-host/codex-hook.mjs +200 -147
- package/libexec/ceal-host/codex-invocation-authentication.mjs +200 -147
- package/libexec/ceal-host/codex-producer.mjs +200 -147
- package/libexec/ceal-host/control.mjs +202 -149
- package/libexec/ceal-host/relay.mjs +200 -147
- package/package.json +1 -1
- package/share/ceal-host/bundle-manifest.json +12 -12
- package/share/ceal-host/bundle-manifest.sigstore.json +1 -1
|
@@ -134,7 +134,7 @@ var client_wire_contract_default = {
|
|
|
134
134
|
"prompt"
|
|
135
135
|
],
|
|
136
136
|
discovery_command: "discovery",
|
|
137
|
-
discovery_manifest_schema_version: "ceal.discovery_manifest.
|
|
137
|
+
discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
|
|
138
138
|
discovery_manifest_document_fields: [
|
|
139
139
|
"discovery_manifest"
|
|
140
140
|
],
|
|
@@ -208,6 +208,7 @@ var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
|
|
|
208
208
|
var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
|
|
209
209
|
var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
|
|
210
210
|
var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
|
|
211
|
+
var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
|
|
211
212
|
var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
|
|
212
213
|
var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
|
|
213
214
|
var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
|
|
@@ -221,6 +222,17 @@ var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verifie
|
|
|
221
222
|
var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
|
|
222
223
|
var CEAL_PROTOCOL_VERSION = "1.4.0";
|
|
223
224
|
var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
|
|
225
|
+
var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
|
|
226
|
+
"audited_call_pending",
|
|
227
|
+
"continuation_read_pending",
|
|
228
|
+
"continuation_write_pending",
|
|
229
|
+
"provider_pacing_pending",
|
|
230
|
+
"corpus_replay_pending",
|
|
231
|
+
"corpus_append_pending",
|
|
232
|
+
"corpus_fence_pending",
|
|
233
|
+
"corpus_content_pending",
|
|
234
|
+
"corpus_transaction_pending"
|
|
235
|
+
]);
|
|
224
236
|
var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
|
|
225
237
|
var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
|
|
226
238
|
var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
|
|
@@ -230,10 +242,129 @@ var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
|
|
|
230
242
|
"policy_decision_revision"
|
|
231
243
|
]);
|
|
232
244
|
|
|
245
|
+
// packages/ceal-client-protocol/src/operation-next-actions.ts
|
|
246
|
+
var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
|
|
247
|
+
var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
|
|
248
|
+
var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
|
|
249
|
+
"select_did_you_mean",
|
|
250
|
+
"choose_new_output_path",
|
|
251
|
+
"choose_new_idempotency_key",
|
|
252
|
+
"restart_search",
|
|
253
|
+
"repeat_original_arguments",
|
|
254
|
+
// The occurrence this call addressed is settled and cannot move again -- a
|
|
255
|
+
// denied effect approval, an expired continuation -- so the caller runs the
|
|
256
|
+
// same call again as a new request. The refusal names the re-request; this
|
|
257
|
+
// word is the re-request.
|
|
258
|
+
CEAL_REPEAT_REQUEST_NEXT_ACTION,
|
|
259
|
+
"choose_new_request_identity",
|
|
260
|
+
// A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
|
|
261
|
+
"correct_argument",
|
|
262
|
+
// A resolver-owned input must move from caller operands into the declared
|
|
263
|
+
// resolver selection field.
|
|
264
|
+
"supply_resolver_selections",
|
|
265
|
+
// The graph names an upstream node whose Operation produces the resolver's
|
|
266
|
+
// occurrence, and it has not produced one yet. The caller runs that node
|
|
267
|
+
// first; the refusal used to share a code with a malformed resolver result,
|
|
268
|
+
// which is not fixable, so neither could carry a remedy.
|
|
269
|
+
"run_resolver_dependency",
|
|
270
|
+
// A replay carries the input the occurrence durably admitted, and this one
|
|
271
|
+
// carries a different one. The caller fixes it by presenting the original
|
|
272
|
+
// invocation, so it is a remedy; the coordinator minted the word at the
|
|
273
|
+
// replay guard and never declared it, which read as unguided to the scorer.
|
|
274
|
+
"use_original_input",
|
|
275
|
+
// The same mismatch on the Request binding rather than the input: the
|
|
276
|
+
// occurrence was admitted under one binding and the replay presents another.
|
|
277
|
+
"use_original_request_binding",
|
|
278
|
+
// The client's own filesystem write was refused -- EACCES, EPERM, or a
|
|
279
|
+
// read-only mount -- which is how an agent sandbox fences writes outside its
|
|
280
|
+
// workspace. The caller reruns the same command with unsandboxed or escalated
|
|
281
|
+
// execution; re-adopting the session cannot help, because the sandbox refuses
|
|
282
|
+
// that write too.
|
|
283
|
+
"rerun_outside_agent_sandbox",
|
|
284
|
+
// The refusal names the one Operation to read next in `describe_command`:
|
|
285
|
+
// an absent Operation id with a sole catalog-ranked candidate, or a known
|
|
286
|
+
// Operation invoked without its input. Describing only reads the verified
|
|
287
|
+
// contract and dispatches nothing, and the caller then retries with the
|
|
288
|
+
// named Operation or input, so it is guidance the scorer counts.
|
|
289
|
+
"describe_operation",
|
|
290
|
+
// The refusal names the caller's own personal connect Operation in
|
|
291
|
+
// `required_action_sequence`: the Operation asked for, or the credential
|
|
292
|
+
// the call ran on, needs a personal connection the caller does not hold
|
|
293
|
+
// (never connected, revoked, or expired). The caller runs that exact
|
|
294
|
+
// Operation, completes the consent it hands back, and retries the same call.
|
|
295
|
+
"connect_personal_account",
|
|
296
|
+
// The provider or Gateway named a bounded wait; the caller waits that long
|
|
297
|
+
// and submits the same read again.
|
|
298
|
+
"retry_after",
|
|
299
|
+
// The ref names a container of rows (a Notion database or data source), which
|
|
300
|
+
// has no body of its own; the caller searches its rows instead of reading it.
|
|
301
|
+
"search_container_rows"
|
|
302
|
+
];
|
|
303
|
+
var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
|
|
304
|
+
var NON_REMEDY_NEXT_ACTION_VALUES = [
|
|
305
|
+
// Only an administrator can take the named step -- approving a place for an
|
|
306
|
+
// Operation, granting a withheld capability -- so a non-administrator asks
|
|
307
|
+
// one. The refusal names the administrator step; this word is the ask.
|
|
308
|
+
"ask_admin",
|
|
309
|
+
"await_pending_approval",
|
|
310
|
+
"check_gateway",
|
|
311
|
+
"inspect_context_store",
|
|
312
|
+
"inspect_gateway",
|
|
313
|
+
"inspect_local_cache",
|
|
314
|
+
// The thin client prints these on its own behalf, before or after the wire.
|
|
315
|
+
// They were declared only as `CealClientLocalRemedy` keys and, for two of
|
|
316
|
+
// them, only as Go string literals -- a second and third vocabulary for one
|
|
317
|
+
// thing. `CealClientLocalRemedy` derives from this list now, so the client's
|
|
318
|
+
// remedies cannot drift from the words the protocol knows.
|
|
319
|
+
"inspect_local_client",
|
|
320
|
+
"inspect_local_command",
|
|
321
|
+
"inspect_local_output",
|
|
322
|
+
"inspect_local_route",
|
|
323
|
+
CEAL_INSPECT_RECEIPT_NEXT_ACTION,
|
|
324
|
+
"inspect_request",
|
|
325
|
+
"none",
|
|
326
|
+
// The provider refused because of its own configuration -- an API not
|
|
327
|
+
// enabled, an app scope missing -- which an operator changes in that
|
|
328
|
+
// provider's console. No caller edit and no retry fixes it.
|
|
329
|
+
"operator_action",
|
|
330
|
+
"recover",
|
|
331
|
+
"reconcile",
|
|
332
|
+
// Reconciliation of one named occurrence, not of the deployment: an
|
|
333
|
+
// occurrence with no admitted input commitment cannot be replayed safely and
|
|
334
|
+
// no edit to the call changes that. `reconcile` is the deployment-wide word.
|
|
335
|
+
"reconcile_occurrence",
|
|
336
|
+
"reduce_request_size",
|
|
337
|
+
// The Host's invocation context for this turn is stale or expired at the
|
|
338
|
+
// Gateway. The Host's next turn rebinds it and the same call then succeeds;
|
|
339
|
+
// nothing in the call changes, so it is not a remedy the scorer may count.
|
|
340
|
+
"refresh_host_invocation_context",
|
|
341
|
+
"repair_or_adopt_session",
|
|
342
|
+
"retry",
|
|
343
|
+
// The owner -- a correlation hook, an approval hook -- is not serving right
|
|
344
|
+
// now. The caller changes nothing and the same call succeeds once the owner
|
|
345
|
+
// is back, so this is not a remedy the scorer may count as guidance.
|
|
346
|
+
"retry_after_owner_recovery",
|
|
347
|
+
"retry_same_receipt_read",
|
|
348
|
+
"run_file_search_again",
|
|
349
|
+
"select_exact_approval"
|
|
350
|
+
];
|
|
351
|
+
var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
|
|
352
|
+
var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
|
|
353
|
+
var RETRY_PROMISE_NEXT_ACTIONS = ["retry", "retry_after"];
|
|
354
|
+
var RETRY_PROMISE = new Set(RETRY_PROMISE_NEXT_ACTIONS);
|
|
355
|
+
var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
|
|
356
|
+
var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
|
|
357
|
+
provider_permission: "ask_admin",
|
|
358
|
+
access_level: "ask_admin",
|
|
359
|
+
personal_authorization_required: "connect_personal_account"
|
|
360
|
+
});
|
|
361
|
+
|
|
362
|
+
// packages/ceal-client-protocol/src/operation-withheld-cause.ts
|
|
363
|
+
var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
|
|
364
|
+
|
|
233
365
|
// packages/ceal-client-protocol/src/operation-contract-types.ts
|
|
234
366
|
var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
|
|
235
367
|
var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
|
|
236
|
-
var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
|
|
237
368
|
var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
|
|
238
369
|
var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
|
|
239
370
|
var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
|
|
@@ -497,6 +628,8 @@ var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
|
|
|
497
628
|
var CEAL_PROVIDER_BOUNDARY_EVIDENCE = vocabulary(["provider_readback", "operator_stated"]);
|
|
498
629
|
var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
|
|
499
630
|
var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
|
|
631
|
+
var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
|
|
632
|
+
var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
|
|
500
633
|
var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
|
|
501
634
|
var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
|
|
502
635
|
var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
|
|
@@ -607,6 +740,7 @@ var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_ve
|
|
|
607
740
|
var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
|
|
608
741
|
var CEAL_OPERATION_RESULT_KEYS = vocabulary(["ok", "operation_id", "operation_receipt", "schema_version", "value"]);
|
|
609
742
|
var CEAL_OPERATION_COMPACT_RESULT_KEYS = vocabulary(["ok", "operation_evidence", "operation_id", "schema_version", "value"]);
|
|
743
|
+
var CEAL_OPERATION_RESULT_OPTIONAL_KEYS = vocabulary(["model_disclosure", "result_complete", "resume"]);
|
|
610
744
|
|
|
611
745
|
// packages/ceal-client-protocol/src/operation-catalog.ts
|
|
612
746
|
var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
|
|
@@ -618,8 +752,8 @@ var CEAL_SCHEMA_LITERALS = [
|
|
|
618
752
|
"ceal.activation_transport.v1",
|
|
619
753
|
CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
|
|
620
754
|
CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
|
|
621
|
-
"ceal.client_refresh_request.
|
|
622
|
-
"ceal.client_refresh_result.
|
|
755
|
+
"ceal.client_refresh_request.v1",
|
|
756
|
+
"ceal.client_refresh_result.v1",
|
|
623
757
|
"ceal.client_revoke_request.v1",
|
|
624
758
|
"ceal.client_revoke_result.v1",
|
|
625
759
|
CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
|
|
@@ -648,7 +782,7 @@ var CEAL_SCHEMA_LITERALS = [
|
|
|
648
782
|
"ceal.gateway_call_result.v1",
|
|
649
783
|
CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
|
|
650
784
|
"ceal.gateway_connector_route_failure.v1",
|
|
651
|
-
"ceal.gateway_discovery.
|
|
785
|
+
"ceal.gateway_discovery.v1",
|
|
652
786
|
"ceal.gateway_handshake.v1",
|
|
653
787
|
"ceal.gateway_installation_activation_code_issue_request.v1",
|
|
654
788
|
"ceal.gateway_installation_activation_code_issue_result.v1",
|
|
@@ -670,10 +804,10 @@ var CEAL_SCHEMA_LITERALS = [
|
|
|
670
804
|
"ceal.host_observation.v1",
|
|
671
805
|
"ceal.host_registration_request.v1",
|
|
672
806
|
"ceal.host_registration_result.v1",
|
|
673
|
-
"ceal.leased-resource-stream.
|
|
674
|
-
"ceal.leased_consumer_attachment_stream_frame.
|
|
675
|
-
"ceal.leased_consumer_attachment_stream_request.
|
|
676
|
-
"ceal.leased_consumer_attachment_stream_transport.
|
|
807
|
+
"ceal.leased-resource-stream.v1",
|
|
808
|
+
"ceal.leased_consumer_attachment_stream_frame.v1",
|
|
809
|
+
"ceal.leased_consumer_attachment_stream_request.v1",
|
|
810
|
+
"ceal.leased_consumer_attachment_stream_transport.v1",
|
|
677
811
|
"ceal.operation_descriptor.v1",
|
|
678
812
|
"ceal.operation_error.v1",
|
|
679
813
|
"ceal.operation_failure.v1",
|
|
@@ -681,7 +815,7 @@ var CEAL_SCHEMA_LITERALS = [
|
|
|
681
815
|
"ceal.operation_receipt.v1",
|
|
682
816
|
"ceal.operation_result.v1",
|
|
683
817
|
"ceal.operation_result.compact.v1",
|
|
684
|
-
"ceal.local_result_materialization.
|
|
818
|
+
"ceal.local_result_materialization.v1",
|
|
685
819
|
"ceal.local_result_root.v1",
|
|
686
820
|
"ceal.owner_bootstrap_exchange_request.v1",
|
|
687
821
|
"ceal.owner_bootstrap_exchange_result.v1",
|
|
@@ -767,117 +901,8 @@ var CEAL_AGENT_SERVICE_SESSION_RECORD_KEYS = vocabulary([
|
|
|
767
901
|
]);
|
|
768
902
|
var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_session_revision", "session_revision"]);
|
|
769
903
|
|
|
770
|
-
// packages/ceal-client-protocol/src/operation-
|
|
771
|
-
var
|
|
772
|
-
var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
|
|
773
|
-
var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
|
|
774
|
-
"select_did_you_mean",
|
|
775
|
-
"choose_new_output_path",
|
|
776
|
-
"choose_new_idempotency_key",
|
|
777
|
-
"restart_search",
|
|
778
|
-
"repeat_original_arguments",
|
|
779
|
-
// The occurrence this call addressed is settled and cannot move again -- a
|
|
780
|
-
// denied effect approval, an expired continuation -- so the caller runs the
|
|
781
|
-
// same call again as a new request. The refusal names the re-request; this
|
|
782
|
-
// word is the re-request.
|
|
783
|
-
CEAL_REPEAT_REQUEST_NEXT_ACTION,
|
|
784
|
-
"choose_new_request_identity",
|
|
785
|
-
// A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
|
|
786
|
-
"correct_argument",
|
|
787
|
-
// A resolver-owned input must move from caller operands into the declared
|
|
788
|
-
// resolver selection field.
|
|
789
|
-
"supply_resolver_selections",
|
|
790
|
-
// The graph names an upstream node whose Operation produces the resolver's
|
|
791
|
-
// occurrence, and it has not produced one yet. The caller runs that node
|
|
792
|
-
// first; the refusal used to share a code with a malformed resolver result,
|
|
793
|
-
// which is not fixable, so neither could carry a remedy.
|
|
794
|
-
"run_resolver_dependency",
|
|
795
|
-
// A replay carries the input the occurrence durably admitted, and this one
|
|
796
|
-
// carries a different one. The caller fixes it by presenting the original
|
|
797
|
-
// invocation, so it is a remedy; the coordinator minted the word at the
|
|
798
|
-
// replay guard and never declared it, which read as unguided to the scorer.
|
|
799
|
-
"use_original_input",
|
|
800
|
-
// The same mismatch on the Request binding rather than the input: the
|
|
801
|
-
// occurrence was admitted under one binding and the replay presents another.
|
|
802
|
-
"use_original_request_binding",
|
|
803
|
-
// The client's own filesystem write was refused -- EACCES, EPERM, or a
|
|
804
|
-
// read-only mount -- which is how an agent sandbox fences writes outside its
|
|
805
|
-
// workspace. The caller reruns the same command with unsandboxed or escalated
|
|
806
|
-
// execution; re-adopting the session cannot help, because the sandbox refuses
|
|
807
|
-
// that write too.
|
|
808
|
-
"rerun_outside_agent_sandbox",
|
|
809
|
-
// The refusal names the one Operation to read next in `describe_command`:
|
|
810
|
-
// an absent Operation id with a sole catalog-ranked candidate, or a known
|
|
811
|
-
// Operation invoked without its input. Describing only reads the verified
|
|
812
|
-
// contract and dispatches nothing, and the caller then retries with the
|
|
813
|
-
// named Operation or input, so it is guidance the scorer counts.
|
|
814
|
-
"describe_operation",
|
|
815
|
-
// The refusal names the caller's own personal connect Operation in
|
|
816
|
-
// `required_action_sequence`: the Operation asked for, or the credential
|
|
817
|
-
// the call ran on, needs a personal connection the caller does not hold
|
|
818
|
-
// (never connected, revoked, or expired). The caller runs that exact
|
|
819
|
-
// Operation, completes the consent it hands back, and retries the same call.
|
|
820
|
-
"connect_personal_account",
|
|
821
|
-
// The provider or Gateway named a bounded wait; the caller waits that long
|
|
822
|
-
// and submits the same read again.
|
|
823
|
-
"retry_after"
|
|
824
|
-
];
|
|
825
|
-
var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
|
|
826
|
-
var NON_REMEDY_NEXT_ACTION_VALUES = [
|
|
827
|
-
// Only an administrator can take the named step -- approving a place for an
|
|
828
|
-
// Operation, granting a withheld capability -- so a non-administrator asks
|
|
829
|
-
// one. The refusal names the administrator step; this word is the ask.
|
|
830
|
-
"ask_admin",
|
|
831
|
-
"await_pending_approval",
|
|
832
|
-
"check_gateway",
|
|
833
|
-
"inspect_context_store",
|
|
834
|
-
"inspect_gateway",
|
|
835
|
-
"inspect_local_cache",
|
|
836
|
-
// The thin client prints these on its own behalf, before or after the wire.
|
|
837
|
-
// They were declared only as `CealClientLocalRemedy` keys and, for two of
|
|
838
|
-
// them, only as Go string literals -- a second and third vocabulary for one
|
|
839
|
-
// thing. `CealClientLocalRemedy` derives from this list now, so the client's
|
|
840
|
-
// remedies cannot drift from the words the protocol knows.
|
|
841
|
-
"inspect_local_client",
|
|
842
|
-
"inspect_local_command",
|
|
843
|
-
"inspect_local_output",
|
|
844
|
-
"inspect_local_route",
|
|
845
|
-
CEAL_INSPECT_RECEIPT_NEXT_ACTION,
|
|
846
|
-
"inspect_request",
|
|
847
|
-
"none",
|
|
848
|
-
// The provider refused because of its own configuration -- an API not
|
|
849
|
-
// enabled, an app scope missing -- which an operator changes in that
|
|
850
|
-
// provider's console. No caller edit and no retry fixes it.
|
|
851
|
-
"operator_action",
|
|
852
|
-
"recover",
|
|
853
|
-
"reconcile",
|
|
854
|
-
// Reconciliation of one named occurrence, not of the deployment: an
|
|
855
|
-
// occurrence with no admitted input commitment cannot be replayed safely and
|
|
856
|
-
// no edit to the call changes that. `reconcile` is the deployment-wide word.
|
|
857
|
-
"reconcile_occurrence",
|
|
858
|
-
"reduce_request_size",
|
|
859
|
-
// The Host's invocation context for this turn is stale or expired at the
|
|
860
|
-
// Gateway. The Host's next turn rebinds it and the same call then succeeds;
|
|
861
|
-
// nothing in the call changes, so it is not a remedy the scorer may count.
|
|
862
|
-
"refresh_host_invocation_context",
|
|
863
|
-
"repair_or_adopt_session",
|
|
864
|
-
"retry",
|
|
865
|
-
// The owner -- a correlation hook, an approval hook -- is not serving right
|
|
866
|
-
// now. The caller changes nothing and the same call succeeds once the owner
|
|
867
|
-
// is back, so this is not a remedy the scorer may count as guidance.
|
|
868
|
-
"retry_after_owner_recovery",
|
|
869
|
-
"retry_same_receipt_read",
|
|
870
|
-
"run_file_search_again",
|
|
871
|
-
"select_exact_approval"
|
|
872
|
-
];
|
|
873
|
-
var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
|
|
874
|
-
var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
|
|
875
|
-
var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
|
|
876
|
-
var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
|
|
877
|
-
provider_permission: "ask_admin",
|
|
878
|
-
access_level: "ask_admin",
|
|
879
|
-
personal_authorization_required: "connect_personal_account"
|
|
880
|
-
});
|
|
904
|
+
// packages/ceal-client-protocol/src/operation-result-completeness.ts
|
|
905
|
+
var CEAL_READ_VALUE_CONTINUATION_KEYS = vocabulary(["continuation", "continuation_ref", "next_cursor"]);
|
|
881
906
|
|
|
882
907
|
// packages/ceal-client-protocol/src/operation-contract-artifact.ts
|
|
883
908
|
var CATALOG_REVISION = new RegExp(CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN, "u");
|
|
@@ -938,7 +963,8 @@ var CEAL_ACTIVITY_GAP_CODES = vocabulary([
|
|
|
938
963
|
"provider_cursor_unavailable",
|
|
939
964
|
"malformed_provider_page",
|
|
940
965
|
"visibility_incomplete",
|
|
941
|
-
"unsupported_event_kind"
|
|
966
|
+
"unsupported_event_kind",
|
|
967
|
+
"direct_messages_excluded"
|
|
942
968
|
]);
|
|
943
969
|
var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
|
|
944
970
|
var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
|
|
@@ -949,6 +975,8 @@ var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
|
|
|
949
975
|
"github.commit.authored",
|
|
950
976
|
"github.issue.opened",
|
|
951
977
|
"github.pull_request.opened",
|
|
978
|
+
"github.issue.edited",
|
|
979
|
+
"github.pull_request.edited",
|
|
952
980
|
"github.review.submitted",
|
|
953
981
|
"github.issue_comment.created",
|
|
954
982
|
"github.review_comment.created",
|
|
@@ -961,6 +989,25 @@ var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
|
|
|
961
989
|
"notion.page.created",
|
|
962
990
|
"notion.page.edited"
|
|
963
991
|
]);
|
|
992
|
+
var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
|
|
993
|
+
"slack.message": "message_created",
|
|
994
|
+
"slack.reply": "message_created",
|
|
995
|
+
"slack.direct_message": "message_created",
|
|
996
|
+
"github.commit.authored": "commit_authored",
|
|
997
|
+
"github.review.submitted": "review_submitted",
|
|
998
|
+
"github.issue_comment.created": "comment_created",
|
|
999
|
+
"github.review_comment.created": "comment_created",
|
|
1000
|
+
"github.issue.opened": "resource_created",
|
|
1001
|
+
"github.pull_request.opened": "resource_created",
|
|
1002
|
+
"github.issue.edited": "resource_modified",
|
|
1003
|
+
"github.pull_request.edited": "resource_modified",
|
|
1004
|
+
"calendar.organized": "resource_created",
|
|
1005
|
+
"drive.file.created": "file_created",
|
|
1006
|
+
"drive.file.modified": "file_modified_by_me",
|
|
1007
|
+
"drive.file.viewed": "file_viewed_by_me",
|
|
1008
|
+
"notion.page.created": "page_created",
|
|
1009
|
+
"notion.page.edited": "page_last_edited"
|
|
1010
|
+
});
|
|
964
1011
|
var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
|
|
965
1012
|
"message_created",
|
|
966
1013
|
"commit_authored",
|
|
@@ -985,7 +1032,8 @@ var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since
|
|
|
985
1032
|
var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
|
|
986
1033
|
var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
|
|
987
1034
|
var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
|
|
988
|
-
var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
|
|
1035
|
+
var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
|
|
1036
|
+
var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
|
|
989
1037
|
var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
|
|
990
1038
|
var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
|
|
991
1039
|
var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
|
|
@@ -1027,6 +1075,9 @@ var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_no
|
|
|
1027
1075
|
var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
|
|
1028
1076
|
|
|
1029
1077
|
// packages/ceal-client-protocol/src/resource-row.ts
|
|
1078
|
+
var CEAL_DATED_NOTE_BASES = vocabulary(["recording", "calendar_event", "created_time"]);
|
|
1079
|
+
var CEAL_DATED_NOTE_TRANSCRIPT_STATES = vocabulary(["present", "absent", "unestablished"]);
|
|
1080
|
+
var CEAL_READ_SEARCH_COST_CLASSES = vocabulary(["native_index", "scan"]);
|
|
1030
1081
|
var RESOURCE_ROW_KEY_RULES = Object.freeze({
|
|
1031
1082
|
schema_version: { required: true, timestamp: false },
|
|
1032
1083
|
ref: { required: true, timestamp: false },
|
|
@@ -1039,6 +1090,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
|
|
|
1039
1090
|
source: { required: true, timestamp: false },
|
|
1040
1091
|
owner: { required: false, timestamp: false },
|
|
1041
1092
|
counterparts: { required: false, timestamp: false },
|
|
1093
|
+
attachments: { required: false, timestamp: false },
|
|
1042
1094
|
created_at: { required: false, timestamp: true },
|
|
1043
1095
|
created_at_local: { required: false, timestamp: true },
|
|
1044
1096
|
modified_at: { required: false, timestamp: true },
|
|
@@ -1049,6 +1101,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
|
|
|
1049
1101
|
end: { required: false, timestamp: false },
|
|
1050
1102
|
status: { required: false, timestamp: false },
|
|
1051
1103
|
snippet: { required: false, timestamp: false },
|
|
1104
|
+
dated_notes: { required: false, timestamp: false },
|
|
1052
1105
|
state: { required: true, timestamp: false },
|
|
1053
1106
|
timestamp_basis: { required: true, timestamp: false }
|
|
1054
1107
|
});
|
|
@@ -1085,6 +1138,27 @@ var CEAL_WRITE_SAFETY_UNCHECKED_REASONS = vocabulary(["authority_unavailable"]);
|
|
|
1085
1138
|
// packages/ceal-client-protocol/src/operation-occurrence.ts
|
|
1086
1139
|
var MAX_RECEIPT_REVISION = Number.MAX_SAFE_INTEGER - 1;
|
|
1087
1140
|
|
|
1141
|
+
// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
|
|
1142
|
+
var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
|
|
1143
|
+
"access_group_ref",
|
|
1144
|
+
"membership_ref",
|
|
1145
|
+
"registration_ref",
|
|
1146
|
+
"client_ref",
|
|
1147
|
+
"subject_ref",
|
|
1148
|
+
"instance_ref"
|
|
1149
|
+
]);
|
|
1150
|
+
var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
|
|
1151
|
+
var CEAL_REFRESH_FAILURE_CODES = vocabulary([
|
|
1152
|
+
"refresh_invalid",
|
|
1153
|
+
"refresh_expired",
|
|
1154
|
+
"refresh_inactive",
|
|
1155
|
+
"refresh_replayed",
|
|
1156
|
+
"refresh_revoked",
|
|
1157
|
+
"authority_replaced",
|
|
1158
|
+
"refresh_recovery_unavailable",
|
|
1159
|
+
"refresh_recovery_expired"
|
|
1160
|
+
]);
|
|
1161
|
+
|
|
1088
1162
|
// packages/ceal-client-protocol/src/leased-artifact-contract.ts
|
|
1089
1163
|
var CEAL_LEASED_CONSUMER_ARTIFACT_CHUNK_MAX_BYTES = 12 * 1024;
|
|
1090
1164
|
|
|
@@ -1180,7 +1254,7 @@ var CEAL_REQUEST_MAX_GRAPH_NODES = 128;
|
|
|
1180
1254
|
|
|
1181
1255
|
// packages/ceal-client-protocol/src/request-run.ts
|
|
1182
1256
|
var CEAL_REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA_VERSION = "ceal.request_node_standing_occurrence.v1";
|
|
1183
|
-
var CEAL_REQUEST_RUN_BATCH_SCHEMA_VERSION = "ceal.request_run_batch.
|
|
1257
|
+
var CEAL_REQUEST_RUN_BATCH_SCHEMA_VERSION = "ceal.request_run_batch.v1";
|
|
1184
1258
|
var REQUEST_ACTION_SAFE_REF_SCHEMA = { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source };
|
|
1185
1259
|
var REQUEST_ACTION_DIGEST_SCHEMA = { type: "string", minLength: 64, maxLength: 64, pattern: "^[a-f0-9]{64}$" };
|
|
1186
1260
|
var REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA = {
|
|
@@ -1429,8 +1503,8 @@ function exactKeys(value, expected) {
|
|
|
1429
1503
|
|
|
1430
1504
|
// packages/ceal-client-protocol/src/client-result-materialization.ts
|
|
1431
1505
|
var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
|
|
1432
|
-
var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id"
|
|
1433
|
-
var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "local_result_root", "continue_argv"]);
|
|
1506
|
+
var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id"]);
|
|
1507
|
+
var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "read_argv", "local_result_root", "continue_argv", "model_disclosure", "item_read_argv"]);
|
|
1434
1508
|
|
|
1435
1509
|
// packages/ceal-client-protocol/src/session-start-affordance.ts
|
|
1436
1510
|
var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
|
|
@@ -1530,27 +1604,6 @@ var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "
|
|
|
1530
1604
|
// packages/ceal-client-protocol/src/actor-kind.ts
|
|
1531
1605
|
var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
|
|
1532
1606
|
|
|
1533
|
-
// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
|
|
1534
|
-
var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
|
|
1535
|
-
"access_group_ref",
|
|
1536
|
-
"membership_ref",
|
|
1537
|
-
"registration_ref",
|
|
1538
|
-
"client_ref",
|
|
1539
|
-
"subject_ref",
|
|
1540
|
-
"instance_ref"
|
|
1541
|
-
]);
|
|
1542
|
-
var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
|
|
1543
|
-
var CEAL_REFRESH_FAILURE_CODES = vocabulary([
|
|
1544
|
-
"refresh_invalid",
|
|
1545
|
-
"refresh_expired",
|
|
1546
|
-
"refresh_inactive",
|
|
1547
|
-
"refresh_replayed",
|
|
1548
|
-
"refresh_revoked",
|
|
1549
|
-
"authority_replaced",
|
|
1550
|
-
"refresh_recovery_unavailable",
|
|
1551
|
-
"refresh_recovery_expired"
|
|
1552
|
-
]);
|
|
1553
|
-
|
|
1554
1607
|
// packages/ceal-client-protocol/src/device-enrollment.ts
|
|
1555
1608
|
var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
|
|
1556
1609
|
var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
|
package/package.json
CHANGED
|
@@ -3,12 +3,12 @@
|
|
|
3
3
|
"product": "ceal-host",
|
|
4
4
|
"version_source": {
|
|
5
5
|
"product": "ceal-host",
|
|
6
|
-
"version": "1.0.
|
|
6
|
+
"version": "1.0.16"
|
|
7
7
|
},
|
|
8
8
|
"source": {
|
|
9
9
|
"repository": "corca-ai/ceal",
|
|
10
|
-
"commit": "
|
|
11
|
-
"tree": "
|
|
10
|
+
"commit": "172fd546e4beee0f9911b6b073f32dd080f84136",
|
|
11
|
+
"tree": "ccdd46d4bebf32f28c6c24f10b57118de6c458f6"
|
|
12
12
|
},
|
|
13
13
|
"target": "darwin-arm64",
|
|
14
14
|
"required_features": [],
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
],
|
|
20
20
|
"executable": true,
|
|
21
21
|
"path": "bin/ceal-host",
|
|
22
|
-
"sha256": "
|
|
22
|
+
"sha256": "a16c6a0c4f1473e40f65194a8e8440aada4157a939340e36bc276ee7e5d1c9b0"
|
|
23
23
|
},
|
|
24
24
|
{
|
|
25
25
|
"owners": [
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
],
|
|
28
28
|
"executable": false,
|
|
29
29
|
"path": "libexec/ceal-host/claude-hook.mjs",
|
|
30
|
-
"sha256": "
|
|
30
|
+
"sha256": "7517e82da18655dbb479535f9aef7cd71a94a58e4497f15b0728c5b25c376915"
|
|
31
31
|
},
|
|
32
32
|
{
|
|
33
33
|
"owners": [
|
|
@@ -35,7 +35,7 @@
|
|
|
35
35
|
],
|
|
36
36
|
"executable": false,
|
|
37
37
|
"path": "libexec/ceal-host/claude-invocation-authentication.mjs",
|
|
38
|
-
"sha256": "
|
|
38
|
+
"sha256": "6fd02ad954861bc661f30a8b691f46e1c24963b8c79fa738db61162cb639105e"
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
41
|
"owners": [
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
],
|
|
44
44
|
"executable": false,
|
|
45
45
|
"path": "libexec/ceal-host/claude-producer.mjs",
|
|
46
|
-
"sha256": "
|
|
46
|
+
"sha256": "50456cb23e1634b0d0f89511de5a99724a23f95598e15a85090b92789c963951"
|
|
47
47
|
},
|
|
48
48
|
{
|
|
49
49
|
"owners": [
|
|
@@ -51,7 +51,7 @@
|
|
|
51
51
|
],
|
|
52
52
|
"executable": false,
|
|
53
53
|
"path": "libexec/ceal-host/codex-hook.mjs",
|
|
54
|
-
"sha256": "
|
|
54
|
+
"sha256": "cef2c32597685c455e5fba38d943305091cc7f5dee68805edcec415e7daf7ac1"
|
|
55
55
|
},
|
|
56
56
|
{
|
|
57
57
|
"owners": [
|
|
@@ -59,7 +59,7 @@
|
|
|
59
59
|
],
|
|
60
60
|
"executable": false,
|
|
61
61
|
"path": "libexec/ceal-host/codex-invocation-authentication.mjs",
|
|
62
|
-
"sha256": "
|
|
62
|
+
"sha256": "e8d78964f783645e37387c4b856c745551ebefed318983f75bca5a4c005415f2"
|
|
63
63
|
},
|
|
64
64
|
{
|
|
65
65
|
"owners": [
|
|
@@ -67,7 +67,7 @@
|
|
|
67
67
|
],
|
|
68
68
|
"executable": false,
|
|
69
69
|
"path": "libexec/ceal-host/codex-producer.mjs",
|
|
70
|
-
"sha256": "
|
|
70
|
+
"sha256": "69c35f9ae7d5c6e0a820c9c312097ac0a191f88207214ff0f259050347391ebc"
|
|
71
71
|
},
|
|
72
72
|
{
|
|
73
73
|
"owners": [
|
|
@@ -75,7 +75,7 @@
|
|
|
75
75
|
],
|
|
76
76
|
"executable": false,
|
|
77
77
|
"path": "libexec/ceal-host/control.mjs",
|
|
78
|
-
"sha256": "
|
|
78
|
+
"sha256": "a6c7408b952176dff6f9ca6618a11f3ba610f7231a254a362fc7953403b17593"
|
|
79
79
|
},
|
|
80
80
|
{
|
|
81
81
|
"owners": [
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
],
|
|
92
92
|
"executable": false,
|
|
93
93
|
"path": "libexec/ceal-host/relay.mjs",
|
|
94
|
-
"sha256": "
|
|
94
|
+
"sha256": "0190e65a5a6fa6861d70e09f99b17c8e286d64fa91e7b52c4eb9401aa95168cb"
|
|
95
95
|
}
|
|
96
96
|
]
|
|
97
97
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"
|
|
1
|
+
{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIG7zCCBnWgAwIBAgIUftURu8yrD2Td9i29jzRqwRkB1EswCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMDA2MDcxNjI0WhcNMjYxMDA2MDcyNjI0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECGayIN1OYxElwIdITPH5pr1BhOdWmG1gBQqqS/RjISQSxJ2m6qrOm2w0tZeL4DhpCkTrXAID7nhCz13WKXjWnKOCBZQwggWQMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBTf0+nPViQRlvmo2OkoVaLGLhhkPzBmBgNVHREBAf8EXDBahlhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoMTcyZmQ1NDZlNGJlZWUwZjk5MTFiNmIwNzNmMzJkZDA4MGY4NDEzNjAkBgorBgEEAYO/MAEEBBZDZWFsIHJlbGVhc2UgY2FuZGlkYXRlMBsGCisGAQQBg78wAQUEDWNvcmNhLWFpL2NlYWwwHQYKKwYBBAGDvzABBgQPcmVmcy9oZWFkcy9tYWluMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTBoBgorBgEEAYO/MAEJBFoMWGh0dHBzOi8vZ2l0aHViLmNvbS9jb3JjYS1haS9jZWFsLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UtY2FuZGlkYXRlLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABCgQqDCgxNzJmZDU0NmU0YmVlZTBmOTkxMWI2YjA3M2YzMmRkMDgwZjg0MTM2MB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDAwBgorBgEEAYO/MAEMBCIMIGh0dHBzOi8vZ2l0aHViLmNvbS9jb3JjYS1haS9jZWFsMDgGCisGAQQBg78wAQ0EKgwoMTcyZmQ1NDZlNGJlZWUwZjk5MTFiNmIwNzNmMzJkZDA4MGY4NDEzNjAfBgorBgEEAYO/MAEOBBEMD3JlZnMvaGVhZHMvbWFpbjAaBgorBgEEAYO/MAEPBAwMCjExOTE1NTQ1OTMwKwYKKwYBBAGDvzABEAQdDBtodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkwGAYKKwYBBAGDvzABEQQKDAg3Mjk3ODg2MDBoBgorBgEEAYO/MAESBFoMWGh0dHBzOi8vZ2l0aHViLmNvbS9jb3JjYS1haS9jZWFsLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UtY2FuZGlkYXRlLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDCgxNzJmZDU0NmU0YmVlZTBmOTkxMWI2YjA3M2YzMmRkMDgwZjg0MTM2MCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwVAYKKwYBBAGDvzABFQRGDERodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC9hY3Rpb25zL3J1bnMvMzc0Mjc3MDc0NTYvYXR0ZW1wdHMvMTAXBgorBgEEAYO/MAEWBAkMB3ByaXZhdGUwNgYKKwYBBAGDvzABGAQoDCZyZXBvOmNvcmNhLWFpL2NlYWw6cmVmOnJlZnMvaGVhZHMvbWFpbjCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoRASGgEAAAQDAEgwRgIhAI3v2Yms5bkc1/xtOiFKtOb1QyEVOhIpwqswvz9o2vpRAiEAu5uR3NbKfLQHqCK04XhKybxpg+7MjNURmOAm9tcyiB0wCgYIKoZIzj0EAwMDaAAwZQIxAKXksQbgElAffSn3jbuppuwOT2Hnq6lDqmIGlV5GOyw9OEn1WZKv5tqNZaEknip42wIwNIlC4VBQ8GPEeGrJ+FBPQBJJr3XxUjiMdQUQJFEKbn26WOYpnypAWCXPAp3Dtt2c"},"tlogEntries":[{"logIndex":"3104362267","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1791270984","inclusionPromise":{"signedEntryTimestamp":"MEQCIARm8XPFa05JY8bj99gyndzFT8lUve/ArJnA99udoPvRAiBVjNTlY7d9AVqXTJPliTK3wxxCt2wyW0xp4WBAoHLigw=="},"inclusionProof":{"logIndex":"2982458005","rootHash":"QDjkRcILDlGpOWIWSA7GiXIbXKpAmbCAAgVqtngJ+2g=","treeSize":"2982458177","hashes":["voUnYECR2rWbrR1nkftRvpFFrGI5wlugWSpjDPCk+R8=","zpP6Oromy2H1nC112TjDBO4DjdzZb9VgsOo/TIAzVoA=","hafKTOHID6Y3rkiByzEMijiiVN1Xd5Vgf++CjQ16kdM=","20BoarzPCAJTuX4skzflAzs8/JezbEZ9S3EwshOT8MY=","b+IUsAe9SZwW18QU//AqTqnMW0xmq68Wk2ayHxVxsuU=","N331xu8FujGwReC6kIybz43XwCONlmc9YoUYuB8WrXk=","pqOLeEstiqutoW5S/Ddh3lJV/8HMnanucL3u7CeODfA=","RgwDvrtEa+vBtfkdypUAH4h4ihDpnpwPUakoF1oCrS0=","BBS25pkamS699Xxze9jpKpdkRp5jJQd3LLvbZGJZhrg=","jK4I0hiVxZV6/PpBPsI5XJP97+G443kjREZ+7X53tDA=","26uZH6bzizkOv4Fb4YwZxwzTrK1FAx1aTw4iA0n4ceM=","KdDhAROUsYcRkglasQHoEauqWljNAJfEFnM9II6kjog=","7vKZxbBvymLzq0zTouigqYVNC74ccNCQC7OYTi9vvPo=","w2nH9N+92RYIaF33CQBH1BHzejgMjN+9NyloBszhYxM=","rvBG0Tm26GIMH3ljqRoWTbSJ27Zt7T2HgZ9NddA8ZpY=","0bsYk/hXJIlxXvrWb0QuCD1O04/aviGg6oFpPda2qbs=","qeYNMieVwcc8ixyheVVlxWji/0cnZo2bd/+umuu5TGM=","NlOclldmKPA1tMKIskqHAwuQDYHp31YwpK+OOMrMccc=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2982458177\nQDjkRcILDlGpOWIWSA7GiXIbXKpAmbCAAgVqtngJ+2g=\n\n— rekor.sigstore.dev wNI9ajBFAiAOw8XlRXQOSruyh+JfYmq0gULGDaSshPp3fI5c7Zn20QIhAI//MeUxbdlUpjE4yq7NBgCqr7LjL3rihXvyZMrRY4LS\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyOTY3ODJiYmQzMmE2ODhjOTJjYzUzYWUxOWE2NjkxODcwZDUxODRmMTJiOWIwOWU4MTQ3MjUyNTUwNDY3YzNkIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUURpN3ZWcUNqL1hjREdOT3NTb09ReDZwZ1UxWXlFcFdGcVY5T2xvMGtNeHN3SWhBUDZScHVTaXUzMGx4N1AxQTRjckcwQngycUUwZnh5S0R6UGNSVnhObEozaCIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVYzNla05EUW01WFowRjNTVUpCWjBsVlpuUlZVblU0ZVhKRU1sUmtPV2t5T1dwNlVuRjNVbXRDTVVWemQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFplRTFFUVRKTlJHTjRUbXBKTUZkb1kwNU5hbGw0VFVSQk1rMUVZM2xPYWtrd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZEUjJGNVNVNHhUMWw0Uld4M1NXUkpWRkJJTlhCeU1VSm9UMlJYYlVjeFowSlJjWEVLVXk5U2FrbFRVVk40U2pKdE5uRnlUMjB5ZHpCMFdtVk1ORVJvY0VOclZISllRVWxFTjI1b1Ezb3hNMWRMV0dwWGJrdFBRMEphVVhkbloxZFJUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXWkNaMDVXU0ZOTlJVZEVRVmRuUWxSbUNqQXJibEJXYVZGU2JIWnRiekpQYTI5V1lVeEhUR2hvYTFCNlFtMUNaMDVXU0ZKRlFrRm1PRVZZUkVKaGFHeG9iMlJJVW5kamVtOTJUREprY0dSSGFERUtXV2sxYW1JeU1IWlpNamw1V1RKRmRGbFhhM1paTWxab1lrTTRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWVWcFhlR3haV0U1c1RGZE9hQXBpYlZKd1drZEdNRnBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2Q2s5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRJZDFsTFMzZFpRa0pCUjBRS2RucEJRa0ZuVVZKa01qbDVZVEphYzJJelpHWmFSMng2WTBkR01Ga3laM2RPWjFsTFMzZFpRa0pCUjBSMmVrRkNRWGRSYjAxVVkzbGFiVkV4VGtSYWJBcE9SMHBzV2xkVmQxcHFhelZOVkVacFRtMUpkMDU2VG0xTmVrcHJXa1JCTkUxSFdUUk9SRVY2VG1wQmEwSm5iM0pDWjBWRlFWbFBMMDFCUlVWQ1FscEVDbHBYUm5OSlNFcHNZa2RXYUdNeVZXZFpNa1oxV2tkc2ExbFlVbXhOUW5OSFEybHpSMEZSVVVKbk56aDNRVkZWUlVSWFRuWmpiVTVvVEZkR2NFd3lUbXdLV1ZkM2QwaFJXVXRMZDFsQ1FrRkhSSFo2UVVKQ1oxRlFZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlFwTVVYZHlZVWhTTUdOSVRUWk1lVGt3WWpKMGJHSnBOV2haTTFKd1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVKdkNrSm5iM0pDWjBWRlFWbFBMMDFCUlVwQ1JtOU5WMGRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhbUl6U21wWlV6Rm9ZVk01YWxwWFJuTUtUSGsxYm1GWVVtOWtWMGwyWkRJNWVXRXlXbk5pTTJSNlRETktiR0pIVm1oak1sVjBXVEpHZFZwSGJHdFpXRkpzVEc1c2RHSkZRbmxhVjFwNlRESm9iQXBaVjFKNlRESXhhR0ZYTkhkUFFWbExTM2RaUWtKQlIwUjJla0ZDUTJkUmNVUkRaM2hPZWtwdFdrUlZNRTV0VlRCWmJWWnNXbFJDYlU5VWEzaE5WMGt5Q2xscVFUTk5NbGw2VFcxU2EwMUVaM2RhYW1jd1RWUk5NazFDTUVkRGFYTkhRVkZSUW1jM09IZEJVWE5GUkhkM1Rsb3liREJoU0ZacFRGZG9kbU16VW13S1drUkJkMEpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMGxOU1Vkb01HUklRbnBQYVRoMldqSnNNR0ZJVm1sTWJVNTJZbE01YW1JelNtcFpVekZvWVZNNWFncGFWMFp6VFVSblIwTnBjMGRCVVZGQ1p6YzRkMEZSTUVWTFozZHZUVlJqZVZwdFVURk9SRnBzVGtkS2JGcFhWWGRhYW1zMVRWUkdhVTV0U1hkT2VrNXRDazE2U210YVJFRTBUVWRaTkU1RVJYcE9ha0ZtUW1kdmNrSm5SVVZCV1U4dlRVRkZUMEpDUlUxRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRV0VLUW1kdmNrSm5SVVZCV1U4dlRVRkZVRUpCZDAxRGFrVjRUMVJGTVU1VVVURlBWRTEzUzNkWlMwdDNXVUpDUVVkRWRucEJRa1ZCVVdSRVFuUnZaRWhTZHdwamVtOTJUREprY0dSSGFERlphVFZxWWpJd2Rsa3lPWGxaTWtWMFdWZHJkMGRCV1V0TGQxbENRa0ZIUkhaNlFVSkZVVkZMUkVGbk0wMXFhek5QUkdjeUNrMUVRbTlDWjI5eVFtZEZSVUZaVHk5TlFVVlRRa1p2VFZkSGFEQmtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1dwaU0wcHFXVk14YUdGVE9Xb0tXbGRHYzB4NU5XNWhXRkp2WkZkSmRtUXlPWGxoTWxwellqTmtla3d6U214aVIxWm9ZekpWZEZreVJuVmFSMnhyV1ZoU2JFeHViSFJpUlVKNVdsZGFlZ3BNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFZG5wQlFrVjNVWEZFUTJkNFRucEtiVnBFVlRCT2JWVXdXVzFXYkZwVVFtMVBWR3Q0Q2sxWFNUSlpha0V6VFRKWmVrMXRVbXROUkdkM1dtcG5NRTFVVFRKTlEwVkhRMmx6UjBGUlVVSm5OemgzUVZKUlJVVjNkMUprTWpsNVlUSmFjMkl6WkdZS1drZHNlbU5IUmpCWk1tZDNWa0ZaUzB0M1dVSkNRVWRFZG5wQlFrWlJVa2RFUlZKdlpFaFNkMk42YjNaTU1tUndaRWRvTVZscE5XcGlNakIyV1RJNWVRcFpNa1YwV1ZkcmRsa3lWbWhpUXpsb1dUTlNjR0l5TlhwTU0wb3hZbTVOZGsxNll6Qk5hbU16VFVSak1FNVVXWFpaV0ZJd1dsY3hkMlJJVFhaTlZFRllDa0puYjNKQ1owVkZRVmxQTDAxQlJWZENRV3ROUWpOQ2VXRllXbWhrUjFWM1RtZFpTMHQzV1VKQ1FVZEVkbnBCUWtkQlVXOUVRMXA1V2xoQ2RrOXRUbllLWTIxT2FFeFhSbkJNTWs1c1dWZDNObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRMEpwZDFsTFMzZFpRa0pCU0ZkbFVVbEZRV2RTT1FwQ1NITkJaVkZDTTBGT01EbE5SM0pIZUhoRmVWbDRhMlZJU214dVRuZExhVk5zTmpRemFubDBMelJsUzJOdlFYWkxaVFpQUVVGQlFtOVNRVk5IWjBWQkNrRkJVVVJCUldkM1VtZEphRUZKTTNZeVdXMXpOV0pyWXpFdmVIUlBhVVpMZEU5aU1WRjVSVlpQYUVsd2QzRnpkM1o2T1c4eWRuQlNRV2xGUVhVMWRWSUtNMDVpUzJaTVVVaHhRMHN3TkZob1MzbGllSEJuS3pkTmFrNVZVbTFQUVcwNWRHTjVhVUl3ZDBObldVbExiMXBKZW1vd1JVRjNUVVJoUVVGM1dsRkplQXBCUzFocmMxRmlaMFZzUVdabVUyNHphbUoxY0hCMWQwOVVNa2h1Y1Rac1JIRnRTVWRzVmpWSFQzbDNPVTlGYmpGWFdrdDJOWFJ4VGxwaFJXdHVhWEEwQ2pKM1NYZE9TV3hETkZaQ1VUaEhVRVZsUjNKS0swWkNVRkZDU2tweU0xaDRWV3BwVFdSUlZWRktSa1ZMWW00eU5sZFBXWEJ1ZVhCQlYwTllVRUZ3TTBRS2RIUXlZd290TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0="}]},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"KWeCu9MqaIySzFOuGaZpGHDVGE8SubCegUclJVBGfD0="},"signature":"MEYCIQDi7vVqCj/XcDGNOsSoOQx6pgU1YyEpWFqV9Olo0kMxswIhAP6RpuSiu30lx7P1A4crG0Bx2qE0fxyKDzPcRVxNlJ3h"}}
|