@corca-org/ceal-host-linux-arm64 1.0.14 → 1.0.15

package/libexec/ceal-host/control.mjs

@@ -2171,7 +2171,6 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    max_bytes: 4194304,
     envelope_max_bytes: 389
   },
   command_request: {
@@ -2258,8 +2257,7 @@ var client_wire_contract_default = {
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019,
-    absolute_transport_max_bytes: 4194304
+    complete_max_bytes: 66019
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
@@ -2274,6 +2272,9 @@ var client_wire_contract_default = {
       "fetch"
     ],
     ref_flag: "--ref"
+  },
+  encoded_json_document: {
+    max_bytes: 4194304
   }
 };
 
@@ -2283,6 +2284,7 @@ var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
 var commandResolutionAuthority = commandResolution.authority;
 var commandResolutionSemanticOptions = commandResolution.semantic_options;
 var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -2296,7 +2298,7 @@ var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
 var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = artifact.max_bytes;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
 var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
 var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
@@ -2310,7 +2312,6 @@ var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.f
 var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = response.absolute_transport_max_bytes;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
 function vocabulary(words) {
@@ -2601,7 +2602,6 @@ function cut(text) {
 var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
 
 // packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
 var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
 var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
 var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
@@ -2968,7 +2968,7 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "operator_action",
   "recover",
   "reconcile",
-  // Reconciliation of one named occurrence, not of the deployment: a legacy
+  // Reconciliation of one named occurrence, not of the deployment: an
   // occurrence with no admitted input commitment cannot be replayed safely and
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
@@ -3101,7 +3101,7 @@ var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "resp
 var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
 var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
 var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
@@ -3155,6 +3155,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
+  source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
@@ -3526,7 +3527,17 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
 var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
+  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
+  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
+  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+})}
+`).byteLength;
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
 var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
@@ -4022,7 +4033,6 @@ function ownerPrivate2(stats) {
 import { posix as posix4, win32 as win324 } from "node:path";
 import { constants } from "node:fs";
 import { lstat as lstat4, open as open3 } from "node:fs/promises";
-var MAX_CONFIG_BYTES = 32 * 1024;
 var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var HOST_PRODUCER_CONFIG_FLAG = "--ceal-host-config";
 var HostProducerServiceError = class extends Error {
@@ -4033,7 +4043,8 @@ var HostProducerServiceError = class extends Error {
     this.code = code3;
   }
 };
-var HOST_PRODUCER_CONFIG_KEYS = ["schema_version", "host_source_ref", "producer_installation_ref", "producer_epoch", "outbox_dir", "relay_endpoint", "reconcile_interval_ms", "retry_backoff_ms", "ipc_timeout_ms"];
+var HOST_PRODUCER_CONFIG_KEYS = ["schema_version", "host_source_ref", "producer_installation_ref", "producer_epoch", "outbox_dir", "relay_endpoint"];
+var HOST_PRODUCER_TIMING_DEFAULTS = Object.freeze({ reconcile_interval_ms: 250, retry_backoff_ms: 1e3, ipc_timeout_ms: 5e3 });
 function hostProducerExtraPath(extras, key) {
   const value = extras[key];
   if (value === void 0) throw hostProducerError("invalid_config");
@@ -4066,15 +4077,17 @@ async function readProducerConfigText(configPath, platform, error) {
   const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const handle = await openConfigFile(configPath, constants.O_RDONLY | noFollow, error);
   try {
-    validateOpenedFile(await handle.stat(), pathStat, platform, error);
-    return await readBoundedConfig(handle, error);
+    const opened = await handle.stat();
+    validateConfigFile(opened, platform, error);
+    validateOpenedFile(opened, pathStat, platform, error);
+    return await readBoundedConfig(handle, opened.size, error);
   } finally {
     await handle.close();
   }
 }
 function decodeProducerConfigCore(text, options) {
   const value = parseCanonicalJson(text, options.error);
-  if (!isRecord(value) || !hasExactKeys2(value, options.keys) || value.schema_version !== options.schema) throw options.error("invalid_config");
+  if (!isRecord(value) || !hasConfigKeys(value, options.keys) || value.schema_version !== options.schema) throw options.error("invalid_config");
   const hostSourceRef = typeof value.host_source_ref === "string" ? value.host_source_ref : "";
   const installationRef = typeof value.producer_installation_ref === "string" ? value.producer_installation_ref : "";
   const producerEpoch = validateIdentity(hostSourceRef, installationRef, value.producer_epoch, options.error);
@@ -4085,7 +4098,7 @@ function decodeProducerConfigCore(text, options) {
     assertProducerAbsolutePath(value[key], options.platform, "runtime", options.error);
     extraPaths[key] = value[key];
   }
-  const intervals = validateIntervals(value.reconcile_interval_ms, value.retry_backoff_ms, value.ipc_timeout_ms, options.error);
+  const intervals = validateIntervals(value.reconcile_interval_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.reconcile_interval_ms : value.reconcile_interval_ms, value.retry_backoff_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.retry_backoff_ms : value.retry_backoff_ms, value.ipc_timeout_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.ipc_timeout_ms : value.ipc_timeout_ms, options.error);
   return {
     extra_paths: Object.freeze(extraPaths),
     host_source_ref: hostSourceRef,
@@ -4114,7 +4127,7 @@ async function configPathStat(configPath, error) {
 }
 function validateConfigFile(value, platform, error) {
   if (!value.isFile() || value.isSymbolicLink()) throw error("invalid_config", refusalFacts([{ name: "config_is_file", value: value.isFile(), expected: "true" }, { name: "config_is_symlink", value: value.isSymbolicLink(), expected: "false" }]));
-  if (value.size <= 0 || value.size > MAX_CONFIG_BYTES) throw error("invalid_config", refusalFact("config_bytes", value.size, `between 1 and ${MAX_CONFIG_BYTES}`));
+  if (value.size <= 0 || value.size > CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES) throw error("invalid_config", refusalFact("config_bytes", value.size, `between 1 and ${CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES}`));
   if (platform !== "win32" && (value.uid !== process.getuid?.() || (value.mode & 63) !== 0)) throw error("config_not_private", refusalFacts([{ name: "platform", value: platform, expected: "win32 or owner-private" }, { name: "config_uid", value: value.uid, expected: "the current user" }, { name: "config_mode", value: value.mode, expected: "owner-private" }]));
 }
 async function openConfigFile(configPath, flags, error) {
@@ -4128,12 +4141,17 @@ function validateOpenedFile(opened, pathStat, platform, error) {
   if (!opened.isFile()) throw error("config_unavailable", refusalFacts([{ name: "opened_is_file", value: opened.isFile(), expected: "true" }, { name: "opened_mode", value: opened.mode.toString(8), expected: "a regular file mode" }]));
   if (platform !== "win32" && (opened.dev !== pathStat.dev || opened.ino !== pathStat.ino)) throw error("config_unavailable", refusalFacts([{ name: "platform", value: platform, expected: "win32, or the same file the path named" }, { name: "opened_device", value: opened.dev, expected: String(pathStat.dev) }, { name: "opened_inode", value: opened.ino, expected: String(pathStat.ino) }]));
 }
-async function readBoundedConfig(handle, error) {
-  const buffer = Buffer.allocUnsafe(MAX_CONFIG_BYTES + 1);
-  const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, 0);
-  if (bytesRead === 0 || bytesRead > MAX_CONFIG_BYTES) throw error("invalid_config", refusalFact("bytes_read", bytesRead, `between 1 and ${MAX_CONFIG_BYTES}`));
+async function readBoundedConfig(handle, expectedBytes, error) {
+  const buffer = Buffer.allocUnsafe(expectedBytes + 1);
+  let offset = 0;
+  while (offset < buffer.byteLength) {
+    const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, offset);
+    if (bytesRead === 0) break;
+    offset += bytesRead;
+  }
+  if (offset !== expectedBytes) throw error("invalid_config", refusalFact("bytes_read", offset, `the opened file's ${expectedBytes} bytes without growth or truncation`));
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
+    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, offset));
   } catch {
     throw error("invalid_config");
   }
@@ -4161,9 +4179,8 @@ function validateIntervals(reconcile, retry, timeout, error) {
   if (!boundedMilliseconds(reconcile) || !boundedMilliseconds(retry) || !boundedMilliseconds(timeout)) throw error("invalid_config");
   return [reconcile, retry, timeout];
 }
-function hasExactKeys2(value, keys) {
-  const observed = Object.keys(value);
-  return observed.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+function hasConfigKeys(value, required) {
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || Object.hasOwn(HOST_PRODUCER_TIMING_DEFAULTS, key));
 }
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -7712,6 +7729,8 @@ function configurationError(message) {
 }
 
 // host/lifecycle/src/host-bundle-manifest.ts
+var HOST_BUNDLE_MAX_SELECTED_BYTES = 256 * 1024 * 1024;
+var HOST_BUNDLE_MAX_SIGSTORE_BYTES = 16 * 1024 * 1024;
 var HOST_BUNDLE_TARGETS = Object.freeze(["linux-x64", "linux-arm64", "darwin-arm64", "windows-x64"]);
 var HOST_BUNDLE_COMPONENTS = Object.freeze(["lifecycle", "relay", "codex", "claude"]);
 var HOST_BUNDLE_PRODUCERS = Object.freeze(["codex", "claude"]);
@@ -7779,7 +7798,7 @@ function resolveInstalledHostRuntimePaths(prefix, platform = process.platform) {
   };
 }
 function parseHostRuntimeControlRequest(value) {
-  if (!isCealJsonRecord(value) || !hasExactKeys3(value, REQUEST_REQUIRED_KEYS, ["component"])) throw invalid2("invalid_request_fields");
+  if (!isCealJsonRecord(value) || !hasExactKeys2(value, REQUEST_REQUIRED_KEYS, ["component"])) throw invalid2("invalid_request_fields");
   if (value.schema_version !== HOST_RUNTIME_CONTROL_REQUEST_SCHEMA) throw invalid2("invalid_request_schema", [`expected:${HOST_RUNTIME_CONTROL_REQUEST_SCHEMA}`]);
   if (!isOperation2(value.operation)) throw invalid2("invalid_request_schema");
   assertPrefix(value.prefix);
@@ -7936,7 +7955,7 @@ function sameSelection(left, right) {
 function assertPrefix(value) {
   if (!isAbsoluteNormalizedNonRootPath(value) || /[\r\n]/u.test(value)) throw invalid2("invalid_prefix");
 }
-function hasExactKeys3(value, required, optional) {
+function hasExactKeys2(value, required, optional) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   const keys = Object.keys(value);
   return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => allowed.has(key));

package/libexec/ceal-host/relay.mjs

@@ -54,7 +54,6 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    max_bytes: 4194304,
     envelope_max_bytes: 389
   },
   command_request: {
@@ -141,8 +140,7 @@ var client_wire_contract_default = {
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019,
-    absolute_transport_max_bytes: 4194304
+    complete_max_bytes: 66019
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
@@ -157,6 +155,9 @@ var client_wire_contract_default = {
       "fetch"
     ],
     ref_flag: "--ref"
+  },
+  encoded_json_document: {
+    max_bytes: 4194304
   }
 };
 
@@ -166,6 +167,7 @@ var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
 var commandResolutionAuthority = commandResolution.authority;
 var commandResolutionSemanticOptions = commandResolution.semantic_options;
 var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -179,7 +181,7 @@ var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
 var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = artifact.max_bytes;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
 var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
 var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
@@ -193,7 +195,6 @@ var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.f
 var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = response.absolute_transport_max_bytes;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
 function vocabulary(words) {
@@ -484,7 +485,6 @@ function cut(text) {
 var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
 
 // packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
 var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
 var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
 var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
@@ -851,7 +851,7 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "operator_action",
   "recover",
   "reconcile",
-  // Reconciliation of one named occurrence, not of the deployment: a legacy
+  // Reconciliation of one named occurrence, not of the deployment: an
   // occurrence with no admitted input commitment cannot be replayed safely and
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
@@ -981,7 +981,7 @@ var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "resp
 var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
 var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
 var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
@@ -1035,6 +1035,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
+  source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
@@ -1402,8 +1403,15 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
 var CEAL_HOST_INVOCATION_CONTEXT_PATH = "/api/ceal/v2/host-invocation-context";
 var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
-var CEAL_HOST_CLIENT_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-var CEAL_HOST_CONTEXT_TOKEN_PATTERN = /^ceal_context_[A-Za-z0-9_-]{43}$/u;
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
+  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
+  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
+  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+})}
+`).byteLength;
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
   if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corca-org/ceal-host-linux-arm64",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "license": "MIT",
   "repository": {
     "type": "git",

package/share/ceal-host/bundle-manifest.json

@@ -3,12 +3,12 @@
   "product": "ceal-host",
   "version_source": {
     "product": "ceal-host",
-    "version": "1.0.14"
+    "version": "1.0.15"
   },
   "source": {
     "repository": "corca-ai/ceal",
-    "commit": "304e538a883a990d83a407532ac42ac244e1fd08",
-    "tree": "2fd8f7e65727cda4a3c3267da2af3bf00195436a"
+    "commit": "0c54b8b955cfbb75c074f69787e799e0668da6c2",
+    "tree": "491b91d6d97c42a91f4d0c3618322110428bad07"
   },
   "target": "linux-arm64",
   "required_features": [],
@@ -19,7 +19,7 @@
       ],
       "executable": true,
       "path": "bin/ceal-host",
-      "sha256": "27d55acfd76191da04cb11897739190365df4f513e6e44d554b88b4ccd6d251d"
+      "sha256": "029369971771c8c8f0da91ef00b12a95df0057070ac7d9eace0079e6fc74c898"
     },
     {
       "owners": [
@@ -27,7 +27,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-hook.mjs",
-      "sha256": "bb741131f57dd1b07c65d596e0b56593065e433c40a5dcc87a7983f921faf90f"
+      "sha256": "148af7c97276a026c852ef05dc5d855852a69fae969703a04aaed4680c031ba8"
     },
     {
       "owners": [
@@ -35,7 +35,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-invocation-authentication.mjs",
-      "sha256": "b0db46e68327d07ad5a8980746fa70ea531e8c3fafe769e0b542e21d60473904"
+      "sha256": "59f233dca016bd9dd02af0c8ed9eab47cfba988ec7c9ec71e74f4468fe584ec0"
     },
     {
       "owners": [
@@ -43,7 +43,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-producer.mjs",
-      "sha256": "ae7bd9c25ccd7461a120b2523624d7707ba025285e0ece9ff346cd0dd9fc30b7"
+      "sha256": "e2c142a1e713d84ed45fe869c9d457aa345901543c5d0d2918c5e0949f47c566"
     },
     {
       "owners": [
@@ -51,7 +51,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-hook.mjs",
-      "sha256": "b296e73be40e64fcd7e5eb4e3e062466d2e17f6a57dde692e0f6e41cc52aa527"
+      "sha256": "efcae19be26da25815a8cfdf864944c9f7c3fad12cfef7270cd4401fa2b03775"
     },
     {
       "owners": [
@@ -59,7 +59,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-invocation-authentication.mjs",
-      "sha256": "d05081139ad782b35052caef4b874477b05a7106cb4a1ebe6e28b0db6be0e1a7"
+      "sha256": "5548db74d1a7c4300f4b8bac1c833730139ce80fd93de2bda996820f9f6937fe"
     },
     {
       "owners": [
@@ -67,7 +67,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-producer.mjs",
-      "sha256": "d5e088f2a83ff0d8fbdfc214bca4bf9306df1721f61f37ac408ab4d3acf89e90"
+      "sha256": "829a02387d7062a329010ab17ba7a6c292efcef482730d2a089de0ce0a2c2a7f"
     },
     {
       "owners": [
@@ -75,7 +75,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/control.mjs",
-      "sha256": "3ace62297acabd87ba12a92022e22d069125bc395fdba8cefba0134f77717214"
+      "sha256": "86d2db2ec3ec0deb7f8466fbfbc37bc5f0c8191bbafaf1993698811030646f20"
     },
     {
       "owners": [
@@ -91,7 +91,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/relay.mjs",
-      "sha256": "88f04fda742c5ff18c859d692d0e58333da7a67e892ee42bb549584364ec71bd"
+      "sha256": "27c40cc04f720c038d013a15b2afb57dee78f85a307b9a7818e94e3e880d1aa3"
     }
   ]
 }

package/share/ceal-host/bundle-manifest.sigstore.json

@@ -1 +1 @@
-{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHDTCCBpOgAwIBAgIUZDedQj+vPFpqV9aPg6lF1sdQMAowCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTI5MTIxOTE2WhcNMjYwOTI5MTIyOTE2WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEh79hRRa8ATlBaK/vu1XCnhKeoR/zCndLOI8lGyxf7PqdVupWT3jFOJkKnIExUEqAy5UHJsonGbVSuRZQyHb4mKOCBbIwggWuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUw2kl8KNZ/hEdP54CgEz/MvTxfIowHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZgYDVR0RAQH/BFwwWoZYaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS1jYW5kaWRhdGUueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDMwNGU1MzhhODgzYTk5MGQ4M2E0MDc1MzJhYzQyYWMyNDRlMWZkMDgwJAYKKwYBBAGDvzABBAQWQ2VhbCByZWxlYXNlIGNhbmRpZGF0ZTAbBgorBgEEAYO/MAEFBA1jb3JjYS1haS9jZWFsMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20waAYKKwYBBAGDvzABCQRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoMzA0ZTUzOGE4ODNhOTkwZDgzYTQwNzUzMmFjNDJhYzI0NGUxZmQwODAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMAYKKwYBBAGDvzABDAQiDCBodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbDA4BgorBgEEAYO/MAENBCoMKDMwNGU1MzhhODgzYTk5MGQ4M2E0MDc1MzJhYzQyYWMyNDRlMWZkMDgwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGgYKKwYBBAGDvzABDwQMDAoxMTkxNTU0NTkzMCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpMBgGCisGAQQBg78wAREECgwINzI5Nzg4NjAwaAYKKwYBBAGDvzABEgRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoMzA0ZTUzOGE4ODNhOTkwZDgzYTQwNzUzMmFjNDJhYzI0NGUxZmQwODAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMFQGCisGAQQBg78wARUERgxEaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvYWN0aW9ucy9ydW5zLzM2NTY2NDIwMDQzL2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMDYGCisGAQQBg78wARgEKAwmcmVwbzpjb3JjYS1haS9jZWFsOnJlZjpyZWZzL2hlYWRzL21haW4wgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaDtGuEqAAAEAwBHMEUCIGEzaHiipsRCvmAAhK5DNwtDb0Szwm2FPPquSENDfj2nAiEAwPAIpo+FYe9M1xPc4cUwfppLziyBVS3uDeKAuARkkTIwCgYIKoZIzj0EAwMDaAAwZQIwGx3nTsu8riNb2uwempnbbdA5Om2XEXLlvzzmxn0LwqkLmYCvbTNJrc7oKiFJM1oWAjEAoc5apCnTFxSKUyky2b8EbSSLyDwQQqi//zJNFyC3qioNRd9N+nOQf0knOI4GkdYZ"},"tlogEntries":[{"logIndex":"2999399566","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1790684357","inclusionPromise":{"signedEntryTimestamp":"MEUCIDD49VbYnDUGNnDz107Z9AI3t+EPHG75o8puXvJN1pcsAiEAyxTchfengwYcmIJHpA/2Si1KLhfat/lCyRUwAQTrIM0="},"inclusionProof":{"logIndex":"2877495304","rootHash":"UaFRAIU0BuOpLkl7vVDr4j0G9HNWkIwCbC10Rc1uvbA=","treeSize":"2877495323","hashes":["WNdIws4EEonNCYrusbvuSSxzh9U+DGGHsg2FW+RUnl0=","IXqQIbltDCVhhfsS75sN7IARC4lM2KGImS5ScjrMqOM=","zCzn9THbhqZ1BrjNmWeciWjABhgv4CpXeaJ81X3PzQE=","0hbOJb4Gmuxp2RuujTsbxXJRg3jsLrqe0ZgcyiPxnJ8=","zIQ0H3tAIHN+x/SKofH34QUufPkCqbCBQ2J0BDxRQbM=","atK0xhg3wzg3SKcUkJvjzvHV2BJxQYtu6vPMDcv92LU=","QgtRWZdSQUwzVarQVcbPuAw0Kip13UpRAnxA3HogU1E=","gOiAI6fFLC9SKLqBR0qCdp9fSpFrHwYots1ikcQzHTk=","cRC780I5JdUxUdNeX1TJ6EqveD2OzPbfyy8jz065ONk=","nP4mme/pSgAQQ+wHEIHaa7EHSrIS3q7i44yWHy4NsjM=","vcyqiwN1R9e9/ujt8MEwxvaDR6ZwbuJX5H8FcCWPlAE=","B1Y96tQagNknpJ8/ufNODAPKkOjvBLLCKTEJLfbi5rU=","ttpxd0TJprOUtb/8Wf5DeIzwNtUw72Q0YnXE2LFMIZo=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2877495323\nUaFRAIU0BuOpLkl7vVDr4j0G9HNWkIwCbC10Rc1uvbA=\n\n— rekor.sigstore.dev wNI9ajBFAiEA2pwDkhb3PwKgTO1BCIfIDIhCPsTM4Zug/WRPNfaW9UkCIE9oWh2SeVfE4+/rWDuQ7nJvT1ctHK8CJp+xrcTMQKUr\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI5ZDY4MGVhNjVmMDY4MjE0ZTExN2MwODI3N2IzMDM1NDM5MzVmMjAzZjg1NTRkMTMxOTBjM2NiYjhhZjNhN2E2In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUNsUVlkZGVjNUdiTEY2Mm5KY0VvZHdOWldWTEN1WjNPNFBqQWR6Q3ZQcmxnSWhBTjNmNVc2QnEvcVJpRkl4UzZmUjNqclZJNHdqSC9ZN3Vqc1RVWnVEcmYxWCIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaEVWRU5EUW5CUFowRjNTVUpCWjBsVldrUmxaRkZxSzNaUVJuQnhWamxoVUdjMmJFWXhjMlJSVFVGdmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlVU1RWTlZFbDRUMVJGTWxkb1kwNU5hbGwzVDFSSk5VMVVTWGxQVkVVeVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZvTnpsb1VsSmhPRUZVYkVKaFN5OTJkVEZZUTI1b1MyVnZVaTk2UTI1a1RFOUpPR3dLUjNsNFpqZFFjV1JXZFhCWFZETnFSazlLYTB0dVNVVjRWVVZ4UVhrMVZVaEtjMjl1UjJKV1UzVlNXbEY1U0dJMGJVdFBRMEppU1hkbloxZDFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYzTW10c0NqaExUbG92YUVWa1VEVTBRMmRGZWk5TmRsUjRaa2x2ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwbldVUldVakJTUVZGSUwwSkdkM2RYYjFwWllVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKT2RtTnRUbWhNVjBad1RESk9iQXBaVjNkMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyWTIxV2MxcFhSbnBhVXpGcVdWYzFhMkZYVW1oa1IxVjFaVmN4YzFGSVNteGFiazEyQ21GSFZtaGFTRTEyWWxkR2NHSnFRVFZDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa04wYjJSSVVuZGplbTkyVEROU2RtRXlWblZNYlVacVpFZHNkbUp1VFhVS1dqSnNNR0ZJVm1sa1dFNXNZMjFPZG1KdVVteGlibEYxV1RJNWRFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZG1OdGRHMWlSemt6V0RKU2NBcGpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJOZDA1SFZURk5lbWhvVDBSbmVsbFVhelZOUjFFMFRUSkZNRTFFWXpGTmVrcG9DbGw2VVhsWlYwMTVUa1JTYkUxWFdtdE5SR2QzU2tGWlMwdDNXVUpDUVVkRWRucEJRa0pCVVZkUk1sWm9Za05DZVZwWGVHeFpXRTVzU1VkT2FHSnRVbkFLV2tkR01GcFVRV0pDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0V4YW1JelNtcFpVekZvWVZNNWFscFhSbk5OUWpCSFEybHpSMEZSVVVKbk56aDNRVkZaUlFwRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSVUZaVHk5TlFVVkpRa013VFVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMUNsbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRoUVZsTFMzZFpRa0pCUjBSMmVrRkNRMUZTWVVSR2FHOEtaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMldUSTVlVmt5UlhSWlYydDJXVEpXYUdKRE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNd3BqZVRsNVdsZDRiRmxZVG14TVYwNW9ZbTFTY0ZwSFJqQmFVelUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJuUjBOcGMwZEJVVkZDQ21jM09IZEJVVzlGUzJkM2IwMTZRVEJhVkZWNlQwZEZORTlFVG1oUFZHdDNXa1JuZWxsVVVYZE9lbFY2VFcxR2FrNUVTbWhaZWtrd1RrZFZlRnB0VVhjS1QwUkJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVeENRVGhOUkZka2NHUkhhREZaYVRGdllqTk9NRnBYVVhkTlFWbExTM2RaUWtKQlIwUjJla0ZDUkVGUmFRcEVRMEp2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVEk1ZVZreVJYUlpWMnQyV1RKV2FHSkVRVFJDWjI5eVFtZEZSVUZaVHk5TlFVVk9Da0pEYjAxTFJFMTNUa2RWTVUxNmFHaFBSR2Q2V1ZSck5VMUhVVFJOTWtVd1RVUmpNVTE2U21oWmVsRjVXVmROZVU1RVVteE5WMXByVFVSbmQwaDNXVXNLUzNkWlFrSkJSMFIyZWtGQ1JHZFJVa1JCT1hsYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQwZG5XVXRMZDFsQ1FrRkhSSFo2UVVKRWQxRk5SRUZ2ZUFwTlZHdDRUbFJWTUU1VWEzcE5RM05IUTJselIwRlJVVUpuTnpoM1FWSkJSVWhSZDJKaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWs1MkNtTnRUbWhNVjBad1RVSm5SME5wYzBkQlVWRkNaemM0ZDBGU1JVVkRaM2RKVG5wSk5VNTZaelJPYWtGM1lVRlpTMHQzV1VKQ1FVZEVkbnBCUWtWblVtRUtSRVpvYjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGt5T1hsWk1rVjBXVmRyZGxreVZtaGlRemgxV2pKc01HRklWbWxNTTJSMlkyMTBiUXBpUnprelkzazVlVnBYZUd4WldFNXNURmRPYUdKdFVuQmFSMFl3V2xNMU5XSlhlRUZqYlZadFkzazViMXBYUm10amVUbDBXVmRzZFUxRVowZERhWE5IQ2tGUlVVSm5OemgzUVZKTlJVdG5kMjlOZWtFd1dsUlZlazlIUlRSUFJFNW9UMVJyZDFwRVozcFpWRkYzVG5wVmVrMXRSbXBPUkVwb1dYcEpNRTVIVlhnS1dtMVJkMDlFUVdoQ1oyOXlRbWRGUlVGWlR5OU5RVVZWUWtKTlRVVllaSFpqYlhSdFlrYzVNMWd5VW5Cak0wSm9aRWRPYjAxR1VVZERhWE5IUVZGUlFncG5OemgzUVZKVlJWSm5lRVZoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1NazUyWTIxT2FFeFhSbkJNTWs1c1dWZDNkbGxYVGpCaFZ6bDFDbU41T1hsa1Z6VjZUSHBOTWs1VVdUSk9SRWwzVFVSUmVrd3lSakJrUjFaMFkwaFNla3g2UlhkR2QxbExTM2RaUWtKQlIwUjJla0ZDUm1kUlNrUkJaSGNLWTIxc01sbFlVbXhOUkZsSFEybHpSMEZSVVVKbk56aDNRVkpuUlV0QmQyMWpiVlozWW5wd2FtSXpTbXBaVXpGb1lWTTVhbHBYUm5OUGJrcHNXbXB3ZVFwYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQyZFpiMGREYVhOSFFWRlJRakZ1YTBOQ1FVbEZaa0ZTTmtGSVowRmtaMFJrVUZSQ2NYaHpZMUpOYlUxYUNraG9lVnBhZW1ORGIydHdaWFZPTkRoeVppdElhVzVMUVV4NWJuVnFaMEZCUVdGRWRFZDFSWEZCUVVGRlFYZENTRTFGVlVOSlIwVjZZVWhwYVhCelVrTUtkbTFCUVdoTE5VUk9kM1JFWWpCVGVuZHRNa1pRVUhGMVUwVk9SR1pxTW01QmFVVkJkMUJCU1hCdkswWlpaVGxOTVhoUVl6UmpWWGRtY0hCTWVtbDVRZ3BXVXpOMVJHVkxRWFZCVW10clZFbDNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsM1IzZ3pibFJ6ZFRoeWFVNWlNblYzWlcxd2JtSmlaRUUxQ2s5dE1saEZXRXhzZG5wNmJYaHVNRXgzY1d0TWJWbERkbUpVVGtweVl6ZHZTMmxHU2sweGIxZEJha1ZCYjJNMVlYQkRibFJHZUZOTFZYbHJlVEppT0VVS1lsTlRUSGxFZDFGUmNXa3ZMM3BLVGtaNVF6TnhhVzlPVW1RNVRpdHVUMUZtTUd0dVQwazBSMnRrV1ZvS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19"}]},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"nWgOpl8GghThF8CCd7MDVDk18gP4VU0TGQw8u4rzp6Y="},"signature":"MEYCIQClQYddec5GbLF62nJcEodwNZWVLCuZ3O4PjAdzCvPrlgIhAN3f5W6Bq/qRiFIxS6fR3jrVI4wjH/Y7ujsTUZuDrf1X"}}
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHDTCCBpOgAwIBAgIUQuL0lXeTwOD6PbvIta/jRCXhZtEwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTMwMDQzMjIwWhcNMjYwOTMwMDQ0MjIwWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgWafeTGML1k/cvkDu9INDWv651+1cEaci4O6LSjfy/9sGd5QtK8l3qqE21rLQpdF51t4dc8gXdtdpxOesBpGJ6OCBbIwggWuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUZSU7WB35xjHJbSoc8ysxhYKUa54wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZgYDVR0RAQH/BFwwWoZYaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS1jYW5kaWRhdGUueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDBjNTRiOGI5NTVjZmJiNzVjMDc0ZjY5Nzg3ZTc5OWUwNjY4ZGE2YzIwJAYKKwYBBAGDvzABBAQWQ2VhbCByZWxlYXNlIGNhbmRpZGF0ZTAbBgorBgEEAYO/MAEFBA1jb3JjYS1haS9jZWFsMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20waAYKKwYBBAGDvzABCQRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoMGM1NGI4Yjk1NWNmYmI3NWMwNzRmNjk3ODdlNzk5ZTA2NjhkYTZjMjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMAYKKwYBBAGDvzABDAQiDCBodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbDA4BgorBgEEAYO/MAENBCoMKDBjNTRiOGI5NTVjZmJiNzVjMDc0ZjY5Nzg3ZTc5OWUwNjY4ZGE2YzIwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGgYKKwYBBAGDvzABDwQMDAoxMTkxNTU0NTkzMCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpMBgGCisGAQQBg78wAREECgwINzI5Nzg4NjAwaAYKKwYBBAGDvzABEgRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoMGM1NGI4Yjk1NWNmYmI3NWMwNzRmNjk3ODdlNzk5ZTA2NjhkYTZjMjAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMFQGCisGAQQBg78wARUERgxEaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvYWN0aW9ucy9ydW5zLzM2NjY4NjQzNDUwL2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMDYGCisGAQQBg78wARgEKAwmcmVwbzpjb3JjYS1haS9jZWFsOnJlZjpyZWZzL2hlYWRzL21haW4wgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaDwlb3KAAAEAwBHMEUCIQCZkEL3LFnGEJPByT0ANc0v0evRbELXa5eALbXprbrWZgIgfZTpATB5c1921k7jcf9WtHLHFTphnkamQMdGQKX80JAwCgYIKoZIzj0EAwMDaAAwZQIxANXAsZST5IPUOawoBGhtie4xVVtWdgOkCX2qvbCsGQhNfN2JFNKuZ3GO/x7gc2RdNgIwBInMiBxtQ/ywT8WIW6kS1jIh2oOq028RiVdDckpNGdRhB2ukQlYLso4RH87J7ZkS"},"tlogEntries":[{"logIndex":"3011874624","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1790742740","inclusionPromise":{"signedEntryTimestamp":"MEUCIQCWe9M/pa8ZpsWwGCM2FV+SS/7P53W2v85VesBgGU95OQIgNEjtFICmI9CuI2M+5VTTek5eDxa5AbrHnCxuZ4QtJIo="},"inclusionProof":{"logIndex":"2889970362","rootHash":"nxw67QVfMDxMpBpZkf4t78BG89uYWAIPv4ORWlxBM2M=","treeSize":"2889970508","hashes":["LYQU2O2/bTAqKJ98jN3k8UczqxGAdayKrKQadra09lE=","Cw8ecUyj1MHaL+TiClVn0CIPitaCaHlC4FZ2auwDNPQ=","wE+LcdBQhs8o9f9Lvl0loKEYMTc1LuMWBrS51Psk+fY=","tHYrlkMYHvCIb4c5YAmcA2s93aWplWxPMHrX5yT1koU=","KOOM5r/4DmS9TGU9NGE9SlRN/UTkSgW7i9AjhRGKhPI=","PPOEDsOYcxeTiO3UbFk7nrAu7C+vG8K75ZsTBhlyjEo=","fnewpvPCtfKB2849+yEMUGU3wxOu30TEmVzALrG6nVM=","OTbnfeiPcMiotNSCMXcGvWQlX5+xTFOvlabyC0zm2Gk=","1f4HuXfx4HhkSZzyCykYqSuyFLrKzQMwSa33kIsJB1A=","jxW22sZiYZUs+YcQJU6yqCMMvFk5Gm0JZaw96t/J+oY=","ta3660am42ZLs/z14zB+qQaiuhw3/EItsP0rYeHuNqs=","2QfQRJnkVWMZq09fw65BBTYt//DLYR+YlQHCjV+dItY=","J1MuyJ56RuX/C7rMjmx8UzC+/vZNw7cnqFKgEYUEY+Y=","S0F3rKdZXA/JqSkyOrtegIjjIFCJOYs1HnBajhvmywo=","/Tz8vh5sB85CyCunbqF0LbvXs2qKh5ZJbYldt93GyjU=","4lYk7cX8PszZLoyQMWjMDB1BOBn4f7hehtFiHo92e5Y=","ttpxd0TJprOUtb/8Wf5DeIzwNtUw72Q0YnXE2LFMIZo=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2889970508\nnxw67QVfMDxMpBpZkf4t78BG89uYWAIPv4ORWlxBM2M=\n\n— rekor.sigstore.dev wNI9ajBFAiEAq6rlIu7YdYy1TptlIs5jwhRnzueo/1B2J6BMm7q1ZGgCID1vcaA1EVS0VWqLEqnIpmEIUE6s9py/CNFHTDN6MAjt\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIzMTgyMmU3NTlmODU0ZjVjYjc0ZWRkYzk5NWQ3ZmZhYzI4Mzk2ZDU2Zjk2M2Y4NDI3OGIyZGYyYjk3NDVhMTUyIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUN5c1B3Vm92REh3cFZ2cEI0OEt3aHNLeGJCUVRjWEVVVThwR1ZnSlQ3QkNRSWhBT2ZNSzczbTBtNUg4Y1QwaEpEMEt3Q0JzNFFibDBoN05BdEIwRGlpb003aCIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaEVWRU5EUW5CUFowRjNTVUpCWjBsVlVYVk1NR3hZWlZSM1QwUTJVR0oyU1hSaEwycFNRMWhvV25SRmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlVVFhkTlJGRjZUV3BKZDFkb1kwNU5hbGwzVDFSTmQwMUVVVEJOYWtsM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZuVjJGbVpWUkhUVXd4YXk5amRtdEVkVGxKVGtSWGRqWTFNU3N4WTBWaFkyazBUellLVEZOcVpua3ZPWE5IWkRWUmRFczRiRE54Y1VVeU1YSk1VWEJrUmpVeGREUmtZemhuV0dSMFpIQjRUMlZ6UW5CSFNqWlBRMEppU1hkbloxZDFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZhVTFVM0NsZENNelY0YWtoS1lsTnZZemg1YzNob1dVdFZZVFUwZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwbldVUldVakJTUVZGSUwwSkdkM2RYYjFwWllVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKT2RtTnRUbWhNVjBad1RESk9iQXBaVjNkMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyWTIxV2MxcFhSbnBhVXpGcVdWYzFhMkZYVW1oa1IxVjFaVmN4YzFGSVNteGFiazEyQ21GSFZtaGFTRTEyWWxkR2NHSnFRVFZDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa04wYjJSSVVuZGplbTkyVEROU2RtRXlWblZNYlVacVpFZHNkbUp1VFhVS1dqSnNNR0ZJVm1sa1dFNXNZMjFPZG1KdVVteGlibEYxV1RJNWRFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZG1OdGRHMWlSemt6V0RKU2NBcGpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJDYWs1VVVtbFBSMGsxVGxSV2FscHRTbWxPZWxacVRVUmpNRnBxV1RWT2VtY3pDbHBVWXpWUFYxVjNUbXBaTkZwSFJUSlpla2wzU2tGWlMwdDNXVUpDUVVkRWRucEJRa0pCVVZkUk1sWm9Za05DZVZwWGVHeFpXRTVzU1VkT2FHSnRVbkFLV2tkR01GcFVRV0pDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0V4YW1JelNtcFpVekZvWVZNNWFscFhSbk5OUWpCSFEybHpSMEZSVVVKbk56aDNRVkZaUlFwRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSVUZaVHk5TlFVVkpRa013VFVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMUNsbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRoUVZsTFMzZFpRa0pCUjBSMmVrRkNRMUZTWVVSR2FHOEtaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMldUSTVlVmt5UlhSWlYydDJXVEpXYUdKRE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNd3BqZVRsNVdsZDRiRmxZVG14TVYwNW9ZbTFTY0ZwSFJqQmFVelUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJuUjBOcGMwZEJVVkZDQ21jM09IZEJVVzlGUzJkM2IwMUhUVEZPUjBrMFdXcHJNVTVYVG0xWmJVa3pUbGROZDA1NlVtMU9hbXN6VDBSa2JFNTZhelZhVkVFeVRtcG9hMWxVV21vS1RXcEJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVeENRVGhOUkZka2NHUkhhREZaYVRGdllqTk9NRnBYVVhkTlFWbExTM2RaUWtKQlIwUjJla0ZDUkVGUmFRcEVRMEp2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVEk1ZVZreVJYUlpWMnQyV1RKV2FHSkVRVFJDWjI5eVFtZEZSVUZaVHk5TlFVVk9Da0pEYjAxTFJFSnFUbFJTYVU5SFNUVk9WRlpxV20xS2FVNTZWbXBOUkdNd1dtcFpOVTU2WnpOYVZHTTFUMWRWZDA1cVdUUmFSMFV5V1hwSmQwaDNXVXNLUzNkWlFrSkJSMFIyZWtGQ1JHZFJVa1JCT1hsYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQwZG5XVXRMZDFsQ1FrRkhSSFo2UVVKRWQxRk5SRUZ2ZUFwTlZHdDRUbFJWTUU1VWEzcE5RM05IUTJselIwRlJVVUpuTnpoM1FWSkJSVWhSZDJKaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWs1MkNtTnRUbWhNVjBad1RVSm5SME5wYzBkQlVWRkNaemM0ZDBGU1JVVkRaM2RKVG5wSk5VNTZaelJPYWtGM1lVRlpTMHQzV1VKQ1FVZEVkbnBCUWtWblVtRUtSRVpvYjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGt5T1hsWk1rVjBXVmRyZGxreVZtaGlRemgxV2pKc01HRklWbWxNTTJSMlkyMTBiUXBpUnprelkzazVlVnBYZUd4WldFNXNURmRPYUdKdFVuQmFSMFl3V2xNMU5XSlhlRUZqYlZadFkzazViMXBYUm10amVUbDBXVmRzZFUxRVowZERhWE5IQ2tGUlVVSm5OemgzUVZKTlJVdG5kMjlOUjAweFRrZEpORmxxYXpGT1YwNXRXVzFKTTA1WFRYZE9lbEp0VG1wck0wOUVaR3hPZW1zMVdsUkJNazVxYUdzS1dWUmFhazFxUVdoQ1oyOXlRbWRGUlVGWlR5OU5RVVZWUWtKTlRVVllaSFpqYlhSdFlrYzVNMWd5VW5Cak0wSm9aRWRPYjAxR1VVZERhWE5IUVZGUlFncG5OemgzUVZKVlJWSm5lRVZoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1NazUyWTIxT2FFeFhSbkJNTWs1c1dWZDNkbGxYVGpCaFZ6bDFDbU41T1hsa1Z6VjZUSHBOTWs1cVdUUk9hbEY2VGtSVmQwd3lSakJrUjFaMFkwaFNla3g2UlhkR2QxbExTM2RaUWtKQlIwUjJla0ZDUm1kUlNrUkJaSGNLWTIxc01sbFlVbXhOUkZsSFEybHpSMEZSVVVKbk56aDNRVkpuUlV0QmQyMWpiVlozWW5wd2FtSXpTbXBaVXpGb1lWTTVhbHBYUm5OUGJrcHNXbXB3ZVFwYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQyZFpiMGREYVhOSFFWRlJRakZ1YTBOQ1FVbEZaa0ZTTmtGSVowRmtaMFJrVUZSQ2NYaHpZMUpOYlUxYUNraG9lVnBhZW1ORGIydHdaWFZPTkRoeVppdElhVzVMUVV4NWJuVnFaMEZCUVdGRWQyeGlNMHRCUVVGRlFYZENTRTFGVlVOSlVVTmFhMFZNTTB4R2JrY0tSVXBRUW5sVU1FRk9ZekIyTUdWMlVtSkZURmhoTldWQlRHSlljSEppY2xkYVowbG5abHBVY0VGVVFqVmpNVGt5TVdzM2FtTm1PVmQwU0V4SVJsUndhQXB1YTJGdFVVMWtSMUZMV0Rnd1NrRjNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsNFFVNVlRWE5hVTFRMVNWQlZUMkYzYjBKSGFIUnBaVFI0Q2xaV2RGZGtaMDlyUTFneWNYWmlRM05IVVdoT1prNHlTa1pPUzNWYU0wZFBMM2czWjJNeVVtUk9aMGwzUWtsdVRXbENlSFJSTDNsM1ZEaFhTVmMyYTFNS01XcEphREp2VDNFd01qaFNhVlprUkdOcmNFNUhaRkpvUWpKMWExRnNXVXh6YnpSU1NEZzNTamRhYTFNS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19"}]},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"MYIudZ+FT1y3Tt3Jldf/rCg5bVb5Y/hCeLLfK5dFoVI="},"signature":"MEYCIQCysPwVovDHwpVvpB48KwhsKxbBQTcXEUU8pGVgJT7BCQIhAOfMK73m0m5H8cT0hJD0KwCBs4Qbl0h7NAtB0DiioM7h"}}