@corca-org/ceal-host-win32-x64 1.0.13 → 1.0.15

package/libexec/ceal-host/control.mjs

@@ -2171,7 +2171,6 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    max_bytes: 4194304,
     envelope_max_bytes: 389
   },
   command_request: {
@@ -2258,8 +2257,7 @@ var client_wire_contract_default = {
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019,
-    absolute_transport_max_bytes: 4194304
+    complete_max_bytes: 66019
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
@@ -2274,6 +2272,9 @@ var client_wire_contract_default = {
       "fetch"
     ],
     ref_flag: "--ref"
+  },
+  encoded_json_document: {
+    max_bytes: 4194304
   }
 };
 
@@ -2283,6 +2284,7 @@ var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
 var commandResolutionAuthority = commandResolution.authority;
 var commandResolutionSemanticOptions = commandResolution.semantic_options;
 var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -2296,7 +2298,7 @@ var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
 var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = artifact.max_bytes;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
 var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
 var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
@@ -2310,7 +2312,6 @@ var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.f
 var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = response.absolute_transport_max_bytes;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
 function vocabulary(words) {
@@ -2601,7 +2602,6 @@ function cut(text) {
 var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
 
 // packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
 var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
 var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
 var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
@@ -2968,7 +2968,7 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "operator_action",
   "recover",
   "reconcile",
-  // Reconciliation of one named occurrence, not of the deployment: a legacy
+  // Reconciliation of one named occurrence, not of the deployment: an
   // occurrence with no admitted input commitment cannot be replayed safely and
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
@@ -3101,7 +3101,7 @@ var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "resp
 var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "kinds", "container_ref", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
 var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
 var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
@@ -3155,6 +3155,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
+  source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
@@ -3526,7 +3527,17 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
 var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
+  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
+  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
+  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+})}
+`).byteLength;
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
 var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
@@ -4022,7 +4033,6 @@ function ownerPrivate2(stats) {
 import { posix as posix4, win32 as win324 } from "node:path";
 import { constants } from "node:fs";
 import { lstat as lstat4, open as open3 } from "node:fs/promises";
-var MAX_CONFIG_BYTES = 32 * 1024;
 var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var HOST_PRODUCER_CONFIG_FLAG = "--ceal-host-config";
 var HostProducerServiceError = class extends Error {
@@ -4033,7 +4043,8 @@ var HostProducerServiceError = class extends Error {
     this.code = code3;
   }
 };
-var HOST_PRODUCER_CONFIG_KEYS = ["schema_version", "host_source_ref", "producer_installation_ref", "producer_epoch", "outbox_dir", "relay_endpoint", "reconcile_interval_ms", "retry_backoff_ms", "ipc_timeout_ms"];
+var HOST_PRODUCER_CONFIG_KEYS = ["schema_version", "host_source_ref", "producer_installation_ref", "producer_epoch", "outbox_dir", "relay_endpoint"];
+var HOST_PRODUCER_TIMING_DEFAULTS = Object.freeze({ reconcile_interval_ms: 250, retry_backoff_ms: 1e3, ipc_timeout_ms: 5e3 });
 function hostProducerExtraPath(extras, key) {
   const value = extras[key];
   if (value === void 0) throw hostProducerError("invalid_config");
@@ -4066,15 +4077,17 @@ async function readProducerConfigText(configPath, platform, error) {
   const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const handle = await openConfigFile(configPath, constants.O_RDONLY | noFollow, error);
   try {
-    validateOpenedFile(await handle.stat(), pathStat, platform, error);
-    return await readBoundedConfig(handle, error);
+    const opened = await handle.stat();
+    validateConfigFile(opened, platform, error);
+    validateOpenedFile(opened, pathStat, platform, error);
+    return await readBoundedConfig(handle, opened.size, error);
   } finally {
     await handle.close();
   }
 }
 function decodeProducerConfigCore(text, options) {
   const value = parseCanonicalJson(text, options.error);
-  if (!isRecord(value) || !hasExactKeys2(value, options.keys) || value.schema_version !== options.schema) throw options.error("invalid_config");
+  if (!isRecord(value) || !hasConfigKeys(value, options.keys) || value.schema_version !== options.schema) throw options.error("invalid_config");
   const hostSourceRef = typeof value.host_source_ref === "string" ? value.host_source_ref : "";
   const installationRef = typeof value.producer_installation_ref === "string" ? value.producer_installation_ref : "";
   const producerEpoch = validateIdentity(hostSourceRef, installationRef, value.producer_epoch, options.error);
@@ -4085,7 +4098,7 @@ function decodeProducerConfigCore(text, options) {
     assertProducerAbsolutePath(value[key], options.platform, "runtime", options.error);
     extraPaths[key] = value[key];
   }
-  const intervals = validateIntervals(value.reconcile_interval_ms, value.retry_backoff_ms, value.ipc_timeout_ms, options.error);
+  const intervals = validateIntervals(value.reconcile_interval_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.reconcile_interval_ms : value.reconcile_interval_ms, value.retry_backoff_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.retry_backoff_ms : value.retry_backoff_ms, value.ipc_timeout_ms === void 0 ? HOST_PRODUCER_TIMING_DEFAULTS.ipc_timeout_ms : value.ipc_timeout_ms, options.error);
   return {
     extra_paths: Object.freeze(extraPaths),
     host_source_ref: hostSourceRef,
@@ -4114,7 +4127,7 @@ async function configPathStat(configPath, error) {
 }
 function validateConfigFile(value, platform, error) {
   if (!value.isFile() || value.isSymbolicLink()) throw error("invalid_config", refusalFacts([{ name: "config_is_file", value: value.isFile(), expected: "true" }, { name: "config_is_symlink", value: value.isSymbolicLink(), expected: "false" }]));
-  if (value.size <= 0 || value.size > MAX_CONFIG_BYTES) throw error("invalid_config", refusalFact("config_bytes", value.size, `between 1 and ${MAX_CONFIG_BYTES}`));
+  if (value.size <= 0 || value.size > CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES) throw error("invalid_config", refusalFact("config_bytes", value.size, `between 1 and ${CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES}`));
   if (platform !== "win32" && (value.uid !== process.getuid?.() || (value.mode & 63) !== 0)) throw error("config_not_private", refusalFacts([{ name: "platform", value: platform, expected: "win32 or owner-private" }, { name: "config_uid", value: value.uid, expected: "the current user" }, { name: "config_mode", value: value.mode, expected: "owner-private" }]));
 }
 async function openConfigFile(configPath, flags, error) {
@@ -4128,12 +4141,17 @@ function validateOpenedFile(opened, pathStat, platform, error) {
   if (!opened.isFile()) throw error("config_unavailable", refusalFacts([{ name: "opened_is_file", value: opened.isFile(), expected: "true" }, { name: "opened_mode", value: opened.mode.toString(8), expected: "a regular file mode" }]));
   if (platform !== "win32" && (opened.dev !== pathStat.dev || opened.ino !== pathStat.ino)) throw error("config_unavailable", refusalFacts([{ name: "platform", value: platform, expected: "win32, or the same file the path named" }, { name: "opened_device", value: opened.dev, expected: String(pathStat.dev) }, { name: "opened_inode", value: opened.ino, expected: String(pathStat.ino) }]));
 }
-async function readBoundedConfig(handle, error) {
-  const buffer = Buffer.allocUnsafe(MAX_CONFIG_BYTES + 1);
-  const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, 0);
-  if (bytesRead === 0 || bytesRead > MAX_CONFIG_BYTES) throw error("invalid_config", refusalFact("bytes_read", bytesRead, `between 1 and ${MAX_CONFIG_BYTES}`));
+async function readBoundedConfig(handle, expectedBytes, error) {
+  const buffer = Buffer.allocUnsafe(expectedBytes + 1);
+  let offset = 0;
+  while (offset < buffer.byteLength) {
+    const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, offset);
+    if (bytesRead === 0) break;
+    offset += bytesRead;
+  }
+  if (offset !== expectedBytes) throw error("invalid_config", refusalFact("bytes_read", offset, `the opened file's ${expectedBytes} bytes without growth or truncation`));
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
+    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, offset));
   } catch {
     throw error("invalid_config");
   }
@@ -4161,9 +4179,8 @@ function validateIntervals(reconcile, retry, timeout, error) {
   if (!boundedMilliseconds(reconcile) || !boundedMilliseconds(retry) || !boundedMilliseconds(timeout)) throw error("invalid_config");
   return [reconcile, retry, timeout];
 }
-function hasExactKeys2(value, keys) {
-  const observed = Object.keys(value);
-  return observed.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+function hasConfigKeys(value, required) {
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || Object.hasOwn(HOST_PRODUCER_TIMING_DEFAULTS, key));
 }
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -7712,6 +7729,8 @@ function configurationError(message) {
 }
 
 // host/lifecycle/src/host-bundle-manifest.ts
+var HOST_BUNDLE_MAX_SELECTED_BYTES = 256 * 1024 * 1024;
+var HOST_BUNDLE_MAX_SIGSTORE_BYTES = 16 * 1024 * 1024;
 var HOST_BUNDLE_TARGETS = Object.freeze(["linux-x64", "linux-arm64", "darwin-arm64", "windows-x64"]);
 var HOST_BUNDLE_COMPONENTS = Object.freeze(["lifecycle", "relay", "codex", "claude"]);
 var HOST_BUNDLE_PRODUCERS = Object.freeze(["codex", "claude"]);
@@ -7779,7 +7798,7 @@ function resolveInstalledHostRuntimePaths(prefix, platform = process.platform) {
   };
 }
 function parseHostRuntimeControlRequest(value) {
-  if (!isCealJsonRecord(value) || !hasExactKeys3(value, REQUEST_REQUIRED_KEYS, ["component"])) throw invalid2("invalid_request_fields");
+  if (!isCealJsonRecord(value) || !hasExactKeys2(value, REQUEST_REQUIRED_KEYS, ["component"])) throw invalid2("invalid_request_fields");
   if (value.schema_version !== HOST_RUNTIME_CONTROL_REQUEST_SCHEMA) throw invalid2("invalid_request_schema", [`expected:${HOST_RUNTIME_CONTROL_REQUEST_SCHEMA}`]);
   if (!isOperation2(value.operation)) throw invalid2("invalid_request_schema");
   assertPrefix(value.prefix);
@@ -7936,7 +7955,7 @@ function sameSelection(left, right) {
 function assertPrefix(value) {
   if (!isAbsoluteNormalizedNonRootPath(value) || /[\r\n]/u.test(value)) throw invalid2("invalid_prefix");
 }
-function hasExactKeys3(value, required, optional) {
+function hasExactKeys2(value, required, optional) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   const keys = Object.keys(value);
   return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => allowed.has(key));

package/libexec/ceal-host/relay.mjs

@@ -54,7 +54,6 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    max_bytes: 4194304,
     envelope_max_bytes: 389
   },
   command_request: {
@@ -141,8 +140,7 @@ var client_wire_contract_default = {
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019,
-    absolute_transport_max_bytes: 4194304
+    complete_max_bytes: 66019
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
@@ -157,6 +155,9 @@ var client_wire_contract_default = {
       "fetch"
     ],
     ref_flag: "--ref"
+  },
+  encoded_json_document: {
+    max_bytes: 4194304
   }
 };
 
@@ -166,6 +167,7 @@ var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
 var commandResolutionAuthority = commandResolution.authority;
 var commandResolutionSemanticOptions = commandResolution.semantic_options;
 var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -179,7 +181,7 @@ var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
 var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
 var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = artifact.max_bytes;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
 var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
 var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
@@ -193,7 +195,6 @@ var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.f
 var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = response.absolute_transport_max_bytes;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
 function vocabulary(words) {
@@ -484,7 +485,6 @@ function cut(text) {
 var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
 
 // packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
 var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
 var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
 var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
@@ -851,7 +851,7 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "operator_action",
   "recover",
   "reconcile",
-  // Reconciliation of one named occurrence, not of the deployment: a legacy
+  // Reconciliation of one named occurrence, not of the deployment: an
   // occurrence with no admitted input commitment cannot be replayed safely and
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
@@ -981,7 +981,7 @@ var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "resp
 var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "kinds", "container_ref", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
 var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
 var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
 var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
@@ -1035,6 +1035,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
+  source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
@@ -1402,8 +1403,15 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
 var CEAL_HOST_INVOCATION_CONTEXT_PATH = "/api/ceal/v2/host-invocation-context";
 var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
-var CEAL_HOST_CLIENT_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-var CEAL_HOST_CONTEXT_TOKEN_PATTERN = /^ceal_context_[A-Za-z0-9_-]{43}$/u;
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
+  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
+  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
+  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+})}
+`).byteLength;
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
   if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corca-org/ceal-host-win32-x64",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "license": "MIT",
   "repository": {
     "type": "git",

package/share/ceal-host/bundle-manifest.json

@@ -3,12 +3,12 @@
   "product": "ceal-host",
   "version_source": {
     "product": "ceal-host",
-    "version": "1.0.13"
+    "version": "1.0.15"
   },
   "source": {
     "repository": "corca-ai/ceal",
-    "commit": "732cf464711e3ab992146175b0a9b34126374109",
-    "tree": "ef5174496b0db4e4791a168cbfc6dc3cb1efd994"
+    "commit": "0c54b8b955cfbb75c074f69787e799e0668da6c2",
+    "tree": "491b91d6d97c42a91f4d0c3618322110428bad07"
   },
   "target": "windows-x64",
   "required_features": [],
@@ -19,7 +19,7 @@
       ],
       "executable": true,
       "path": "bin/ceal-host.exe",
-      "sha256": "52906bc608d8e769d4cf75253fb0417da0173dc6a59e195f6b3827b768c45292"
+      "sha256": "788866fc72c10a3ee104b52fdcadbfd6a3f79bf92158a2c56aebaa3b12bfa77b"
     },
     {
       "owners": [
@@ -27,7 +27,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-hook.mjs",
-      "sha256": "46c535a25bd169b584053c7e9a26a907651a84b9482246ee228df59cabd78d86"
+      "sha256": "148af7c97276a026c852ef05dc5d855852a69fae969703a04aaed4680c031ba8"
     },
     {
       "owners": [
@@ -35,7 +35,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-invocation-authentication.mjs",
-      "sha256": "21333ba0d8b888968d34bd5fea40f8f364bc9beed2c057014c20c62f3bb0a2df"
+      "sha256": "59f233dca016bd9dd02af0c8ed9eab47cfba988ec7c9ec71e74f4468fe584ec0"
     },
     {
       "owners": [
@@ -43,7 +43,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/claude-producer.mjs",
-      "sha256": "6a5af274158bf79a37b460776b0458b23f4cbe35dab5de286bf66a00ef3ec0b8"
+      "sha256": "e2c142a1e713d84ed45fe869c9d457aa345901543c5d0d2918c5e0949f47c566"
     },
     {
       "owners": [
@@ -51,7 +51,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-hook.mjs",
-      "sha256": "2720509774d28f0abd694195a468bef9f17b9085b11045b296405c6a0ed5b10e"
+      "sha256": "efcae19be26da25815a8cfdf864944c9f7c3fad12cfef7270cd4401fa2b03775"
     },
     {
       "owners": [
@@ -59,7 +59,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-invocation-authentication.mjs",
-      "sha256": "10379bbae5e99fefa1b92123859dcbbf6c8034bec2139841792c0f20afacfbe4"
+      "sha256": "5548db74d1a7c4300f4b8bac1c833730139ce80fd93de2bda996820f9f6937fe"
     },
     {
       "owners": [
@@ -67,7 +67,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/codex-producer.mjs",
-      "sha256": "7cb0515a96d64ed4a694f1d3b6ccd025f09ce79440df721b7bba8af3f8e90675"
+      "sha256": "829a02387d7062a329010ab17ba7a6c292efcef482730d2a089de0ce0a2c2a7f"
     },
     {
       "owners": [
@@ -75,7 +75,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/control.mjs",
-      "sha256": "742839f25bed3db60e4be66b359da91799bcc2f4cc984646f95a39df4bb8f344"
+      "sha256": "86d2db2ec3ec0deb7f8466fbfbc37bc5f0c8191bbafaf1993698811030646f20"
     },
     {
       "owners": [
@@ -91,7 +91,7 @@
       ],
       "executable": false,
       "path": "libexec/ceal-host/relay.mjs",
-      "sha256": "60abc3d35a84285357ce524d490a3732a767c625e851dd8e952b46ec3930be60"
+      "sha256": "27c40cc04f720c038d013a15b2afb57dee78f85a307b9a7818e94e3e880d1aa3"
     }
   ]
 }

package/share/ceal-host/bundle-manifest.sigstore.json

@@ -1 +1 @@
-{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHDDCCBpOgAwIBAgIUdQo6grpZ/zzhWgzdiJEn5fRPgcswCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTI5MDMxOTM1WhcNMjYwOTI5MDMyOTM1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESxe1K+b3OpCPIKLkheKzbvrHQG0v0EPifbmQYAeDqEf1CPIKYmjQE1WoRrDZ8GJesxpJgW1EEkj+wlk+X9eKu6OCBbIwggWuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUxFumTcq54rg0tynku9xsTQQ21q8wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZgYDVR0RAQH/BFwwWoZYaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS1jYW5kaWRhdGUueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDczMmNmNDY0NzExZTNhYjk5MjE0NjE3NWIwYTliMzQxMjYzNzQxMDkwJAYKKwYBBAGDvzABBAQWQ2VhbCByZWxlYXNlIGNhbmRpZGF0ZTAbBgorBgEEAYO/MAEFBA1jb3JjYS1haS9jZWFsMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20waAYKKwYBBAGDvzABCQRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoNzMyY2Y0NjQ3MTFlM2FiOTkyMTQ2MTc1YjBhOWIzNDEyNjM3NDEwOTAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMAYKKwYBBAGDvzABDAQiDCBodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbDA4BgorBgEEAYO/MAENBCoMKDczMmNmNDY0NzExZTNhYjk5MjE0NjE3NWIwYTliMzQxMjYzNzQxMDkwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGgYKKwYBBAGDvzABDwQMDAoxMTkxNTU0NTkzMCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpMBgGCisGAQQBg78wAREECgwINzI5Nzg4NjAwaAYKKwYBBAGDvzABEgRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoNzMyY2Y0NjQ3MTFlM2FiOTkyMTQ2MTc1YjBhOWIzNDEyNjM3NDEwOTAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMFQGCisGAQQBg78wARUERgxEaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvYWN0aW9ucy9ydW5zLzM2NTE1OTgxNzI0L2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMDYGCisGAQQBg78wARgEKAwmcmVwbzpjb3JjYS1haS9jZWFsOnJlZjpyZWZzL2hlYWRzL21haW4wgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaDrLMXzAAAEAwBHMEUCIQCFKZUelMmjFr2c/ZIGYQuSrboTYYwVVJyT6xjGWvKEXwIgRAI+1OUeGVaC9p8BiaJoJh7mIGH3kthYbLboJ96wMr0wCgYIKoZIzj0EAwMDZwAwZAIwdzSQCzGHQYZGmHhg6gDK5E8YiJQF9v5xtkae8LHEs5R9jSKocU2Rr96Ow95XMtBsAjB3WOw3EYyBwvd7gtkdRlv3yOS+rG8XTuV8Cd8VmZugImGvHGkUvZGc2RpddURxvIA="},"tlogEntries":[{"logIndex":"2992574516","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1790651975","inclusionPromise":{"signedEntryTimestamp":"MEUCIQDMLSrfjQO1MCqoyOBBFOehlobizjO4oOtJbJwRIMjbHwIgfKdbpNbMSyBHoL0ELFC3pkknYtrCYhZm09c7PALfh9k="},"inclusionProof":{"logIndex":"2870670254","rootHash":"VEhIvsmc6ggDX6QPKM1n32KjkzkGPZ+SX0wQq9rK2FU=","treeSize":"2870670570","hashes":["c5/KNquX0ECX74NTp60SxXzLbB9qrvlBEaHEjdpyEAk=","5JxY5Ug+LQz7cFQJPKkTb+mDVoZApXOEOFbmktk9e3g=","Cfc4OGQDYlkmmKS/gcjwCF/sGX2ZGQzbiJ3eI0vjPVE=","AipDmNKaiM+KwE65irJcyvOaVoiM5nQV1jdbTGHDgcU=","sxOsQhFfAblRoRahvk/8ZMsGf2WuCrFygSKvVqL6yqY=","M6j8zHW51Omeq5ZeyOJiYSGo9kEpw/7/jhtegGLeUig=","5cxtE8fr55my8FBqILWjTs7gaq70A8p5gnEoYZs4xzs=","EK/fZ4cIkvurXxwQQEIsundZQig8FKk6cCsopymCyrg=","2WN4/8nGDkBTHzgo7ZJDiC/CvopyevIxI4KlEBXbUgw=","KufeOFYOyPFdOjCLChzHEv010fqfP24TlktskfahPPA=","iBjWlx61+axV6luelbn4MwVBVmDVf1jFGz7kJsGT2sY=","fkHlEFWuI9hz0cJZ2oRdZHy/H/noOxfkpoAdRWk7W1M=","XyOljDcLBP9uXRGe5yiR914lsLfey4mgjssi/5K1dAc=","dSoYdQ3tP9fPwxIdkBb/4k6f2aiBfkPdUbmZu+vjlvo=","BSkJHyyiXXUGgDYzovBhYkX4zCULrK6ijkVhR55B2Ww=","aegW1hJKQKr2OyW/zIz0UM/+kn6p6P/7Lrst0mDFkis=","Ssc23htZrUjaxYoKLcqEaUS97GSlGzQnTGGRpq+5UtU=","Sp+ICPp0CTN68mS3IfgY0X/aMqm4kaaPoJZ3lxXGL00=","vcyqiwN1R9e9/ujt8MEwxvaDR6ZwbuJX5H8FcCWPlAE=","B1Y96tQagNknpJ8/ufNODAPKkOjvBLLCKTEJLfbi5rU=","ttpxd0TJprOUtb/8Wf5DeIzwNtUw72Q0YnXE2LFMIZo=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2870670570\nVEhIvsmc6ggDX6QPKM1n32KjkzkGPZ+SX0wQq9rK2FU=\n\n— rekor.sigstore.dev wNI9ajBEAiBsZdMRypMsOQeTMBGUKxpJGNCg2kJFFR7SllfxoLS8twIgJ0xFpM3B0DPCAR5TkHD45pJvAkugF8Adik3xCt0Y3eg=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiMjM3MTFmZTJmYzBhNWY5ODU4MzkyMWJhZTFmOTUyMmU4Y2Y0MmRjNTU1NWJiNTk1ZmNlOGEyOWFlYTM0NWEwIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUNVSjZsNEwxUERjbHVZOXZ4amdvdmhhR0NiL2FBaVhKT0VUdkplTWNjc1FBSWhBUElnRWNaOGZyY0xkNWJ0SHV4aHkvMGczMGdHUHBwV245TDk4Yy9yTmFtOCIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaEVSRU5EUW5CUFowRjNTVUpCWjBsVlpGRnZObWR5Y0ZvdmVucG9WMmQ2WkdsS1JXNDFabEpRWjJOemQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlVU1RWTlJFMTRUMVJOTVZkb1kwNU5hbGwzVDFSSk5VMUVUWGxQVkUweFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZUZUdVeFN5dGlNMDl3UTFCSlMweHJhR1ZMZW1KMmNraFJSekIyTUVWUWFXWmliVkVLV1VGbFJIRkZaakZEVUVsTFdXMXFVVVV4VjI5U2NrUmFPRWRLWlhONGNFcG5WekZGUld0cUszZHNheXRZT1dWTGRUWlBRMEppU1hkbloxZDFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlY0Um5WdENsUmpjVFUwY21jd2RIbHVhM1U1ZUhOVVVWRXlNWEU0ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwbldVUldVakJTUVZGSUwwSkdkM2RYYjFwWllVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKT2RtTnRUbWhNVjBad1RESk9iQXBaVjNkMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyWTIxV2MxcFhSbnBhVXpGcVdWYzFhMkZYVW1oa1IxVjFaVmN4YzFGSVNteGFiazEyQ21GSFZtaGFTRTEyWWxkR2NHSnFRVFZDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa04wYjJSSVVuZGplbTkyVEROU2RtRXlWblZNYlVacVpFZHNkbUp1VFhVS1dqSnNNR0ZJVm1sa1dFNXNZMjFPZG1KdVVteGlibEYxV1RJNWRFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZG1OdGRHMWlSemt6V0RKU2NBcGpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJqZWsxdFRtMU9SRmt3VG5wRmVGcFVUbWhaYW1zMVRXcEZNRTVxUlROT1YwbDNDbGxVYkdsTmVsRjRUV3BaZWs1NlVYaE5SR3QzU2tGWlMwdDNXVUpDUVVkRWRucEJRa0pCVVZkUk1sWm9Za05DZVZwWGVHeFpXRTVzU1VkT2FHSnRVbkFLV2tkR01GcFVRV0pDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0V4YW1JelNtcFpVekZvWVZNNWFscFhSbk5OUWpCSFEybHpSMEZSVVVKbk56aDNRVkZaUlFwRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSVUZaVHk5TlFVVkpRa013VFVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMUNsbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRoUVZsTFMzZFpRa0pCUjBSMmVrRkNRMUZTWVVSR2FHOEtaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMldUSTVlVmt5UlhSWlYydDJXVEpXYUdKRE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNd3BqZVRsNVdsZDRiRmxZVG14TVYwNW9ZbTFTY0ZwSFJqQmFVelUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJuUjBOcGMwZEJVVkZDQ21jM09IZEJVVzlGUzJkM2IwNTZUWGxaTWxrd1RtcFJNMDFVUm14Tk1rWnBUMVJyZVUxVVVUSk5WR014V1dwQ2FFOVhTWHBPUkVWNVRtcE5NMDVFUlhjS1QxUkJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVeENRVGhOUkZka2NHUkhhREZaYVRGdllqTk9NRnBYVVhkTlFWbExTM2RaUWtKQlIwUjJla0ZDUkVGUmFRcEVRMEp2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVEk1ZVZreVJYUlpWMnQyV1RKV2FHSkVRVFJDWjI5eVFtZEZSVUZaVHk5TlFVVk9Da0pEYjAxTFJHTjZUVzFPYlU1RVdUQk9la1Y0V2xST2FGbHFhelZOYWtVd1RtcEZNMDVYU1hkWlZHeHBUWHBSZUUxcVdYcE9lbEY0VFVScmQwaDNXVXNLUzNkWlFrSkJSMFIyZWtGQ1JHZFJVa1JCT1hsYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQwZG5XVXRMZDFsQ1FrRkhSSFo2UVVKRWQxRk5SRUZ2ZUFwTlZHdDRUbFJWTUU1VWEzcE5RM05IUTJselIwRlJVVUpuTnpoM1FWSkJSVWhSZDJKaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWs1MkNtTnRUbWhNVjBad1RVSm5SME5wYzBkQlVWRkNaemM0ZDBGU1JVVkRaM2RKVG5wSk5VNTZaelJPYWtGM1lVRlpTMHQzV1VKQ1FVZEVkbnBCUWtWblVtRUtSRVpvYjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGt5T1hsWk1rVjBXVmRyZGxreVZtaGlRemgxV2pKc01HRklWbWxNTTJSMlkyMTBiUXBpUnprelkzazVlVnBYZUd4WldFNXNURmRPYUdKdFVuQmFSMFl3V2xNMU5XSlhlRUZqYlZadFkzazViMXBYUm10amVUbDBXVmRzZFUxRVowZERhWE5IQ2tGUlVVSm5OemgzUVZKTlJVdG5kMjlPZWsxNVdUSlpNRTVxVVROTlZFWnNUVEpHYVU5VWEzbE5WRkV5VFZSak1WbHFRbWhQVjBsNlRrUkZlVTVxVFRNS1RrUkZkMDlVUVdoQ1oyOXlRbWRGUlVGWlR5OU5RVVZWUWtKTlRVVllaSFpqYlhSdFlrYzVNMWd5VW5Cak0wSm9aRWRPYjAxR1VVZERhWE5IUVZGUlFncG5OemgzUVZKVlJWSm5lRVZoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1NazUyWTIxT2FFeFhSbkJNTWs1c1dWZDNkbGxYVGpCaFZ6bDFDbU41T1hsa1Z6VjZUSHBOTWs1VVJURlBWR2Q0VG5wSk1Fd3lSakJrUjFaMFkwaFNla3g2UlhkR2QxbExTM2RaUWtKQlIwUjJla0ZDUm1kUlNrUkJaSGNLWTIxc01sbFlVbXhOUkZsSFEybHpSMEZSVVVKbk56aDNRVkpuUlV0QmQyMWpiVlozWW5wd2FtSXpTbXBaVXpGb1lWTTVhbHBYUm5OUGJrcHNXbXB3ZVFwYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQyZFpiMGREYVhOSFFWRlJRakZ1YTBOQ1FVbEZaa0ZTTmtGSVowRmtaMFJrVUZSQ2NYaHpZMUpOYlUxYUNraG9lVnBhZW1ORGIydHdaWFZPTkRoeVppdElhVzVMUVV4NWJuVnFaMEZCUVdGRWNreE5XSHBCUVVGRlFYZENTRTFGVlVOSlVVTkdTMXBWWld4TmJXb0tSbkl5WXk5YVNVZFpVWFZUY21KdlZGbFpkMVpXU25sVU5uaHFSMWQyUzBWWWQwbG5Va0ZKS3pGUFZXVkhWbUZET1hBNFFtbGhTbTlLYURkdFNVZElNd3ByZEdoWllreGliMG81Tm5kTmNqQjNRMmRaU1V0dldrbDZhakJGUVhkTlJGcDNRWGRhUVVsM1pIcFRVVU42UjBoUldWcEhiVWhvWnpablJFczFSVGhaQ21sS1VVWTVkalY0ZEd0aFpUaE1TRVZ6TlZJNWFsTkxiMk5WTWxKeU9UWlBkemsxV0UxMFFuTkJha0l6VjA5M00wVlplVUozZG1RM1ozUnJaRkpzZGpNS2VVOVRLM0pIT0ZoVWRWWTRRMlE0Vm0xYWRXZEpiVWQyU0VkclZYWmFSMk15VW5Ca1pGVlNlSFpKUVQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19"}]},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"sjcR/i/ApfmFg5Ibrh+VIujPQtxVVbtZX86KKa6jRaA="},"signature":"MEYCIQCUJ6l4L1PDcluY9vxjgovhaGCb/aAiXJOETvJeMccsQAIhAPIgEcZ8frcLd5btHuxhy/0g30gGPppWn9L98c/rNam8"}}
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHDTCCBpOgAwIBAgIUaJmprwm/b+vc/OtsYCJXuTdISRswCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTMwMDQzMjM3WhcNMjYwOTMwMDQ0MjM3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6fEcR4so34xgMkj1TdpslB33nhhHClWH3HoadmAFnVh0UU2k80mLL4VwU/MTHi9xL7GXO+cOWsM0thtbLk0qM6OCBbIwggWuMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUigiAU08oEzL3K395Vg2bVREyRPQwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZgYDVR0RAQH/BFwwWoZYaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS1jYW5kaWRhdGUueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDBjNTRiOGI5NTVjZmJiNzVjMDc0ZjY5Nzg3ZTc5OWUwNjY4ZGE2YzIwJAYKKwYBBAGDvzABBAQWQ2VhbCByZWxlYXNlIGNhbmRpZGF0ZTAbBgorBgEEAYO/MAEFBA1jb3JjYS1haS9jZWFsMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20waAYKKwYBBAGDvzABCQRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoMGM1NGI4Yjk1NWNmYmI3NWMwNzRmNjk3ODdlNzk5ZTA2NjhkYTZjMjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwMAYKKwYBBAGDvzABDAQiDCBodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbDA4BgorBgEEAYO/MAENBCoMKDBjNTRiOGI5NTVjZmJiNzVjMDc0ZjY5Nzg3ZTc5OWUwNjY4ZGE2YzIwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGgYKKwYBBAGDvzABDwQMDAoxMTkxNTU0NTkzMCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpMBgGCisGAQQBg78wAREECgwINzI5Nzg4NjAwaAYKKwYBBAGDvzABEgRaDFhodHRwczovL2dpdGh1Yi5jb20vY29yY2EtYWkvY2VhbC8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLWNhbmRpZGF0ZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoMGM1NGI4Yjk1NWNmYmI3NWMwNzRmNjk3ODdlNzk5ZTA2NjhkYTZjMjAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMFQGCisGAQQBg78wARUERgxEaHR0cHM6Ly9naXRodWIuY29tL2NvcmNhLWFpL2NlYWwvYWN0aW9ucy9ydW5zLzM2NjY4NjQzNDUwL2F0dGVtcHRzLzEwFwYKKwYBBAGDvzABFgQJDAdwcml2YXRlMDYGCisGAQQBg78wARgEKAwmcmVwbzpjb3JjYS1haS9jZWFsOnJlZjpyZWZzL2hlYWRzL21haW4wgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaDwlgJXAAAEAwBHMEUCIQD5YlCtLvndWjoOUS89Gdi7PVYr2wXne7jUzstvdDNJcwIgB1LsdkvmR22vDucsKUzPTe4ZH7gr5I8bV7vp9v2mIJEwCgYIKoZIzj0EAwMDaAAwZQIxAIzRYH7yfRxZn4E6eERI2zcIcm0sIXyEp9FptVdlp60RUyHYpemfNkz8mYfu6WPqPgIwNLPvamV4O9C0tEVrBIHYC3++nsrW7gf7uIJZK2eeumBr+Hr7j9YuQualTPs7HXBy"},"tlogEntries":[{"logIndex":"3011879914","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1790742758","inclusionPromise":{"signedEntryTimestamp":"MEYCIQDjTQOKpOyWXS+YeLu017nnSvI0WS/XsM0j08KYkKXH0gIhAPsvJhuZj7+PRTmgCKYWWfHNTM+6f8x2eXlx+LS9gQp3"},"inclusionProof":{"logIndex":"2889975652","rootHash":"3+4boixF1G5EYQRzohPD2TVxgrrclhWTN4NeQvsMwpc=","treeSize":"2889976090","hashes":["4nXilzny8HLJ+ItBQfdURoytslKlGh9odRaXrlYVBXs=","FNiG0RLBGozDW6vcd7owvCBAfRsxgQEqua21FHqbV58=","TUNGmtZ2bMnPKTEaO51Yyacm7o5/CDPhINA5JW31KK4=","bHN1edomfS1nNOa5CX5C4N7Z4Gibx/rBzubc3jMQMaw=","actiOdAMbm+TyI81iAjKCfqrdsdpgllIsxHBV8KAPag=","4plCyNWokw6HcZafd4367Zo7KuwlQVXTStUEf498is8=","jfHbTu9Hn2ZiRTf5xkGNuEx/ht2+cUaSGaXt+iQGoI0=","t2hJ2f+CHt1x+18YW5kBQNMVGZgQkrW4sSiLRTmBFFA=","ufbi6PlYmP8wyG20t2bvp6hKF9rWwViAv/O6Dg9vxSE=","f5jYTPysJsRYDdPE4aRGkZ5BEw2U0rtkQpSPqRIU3lo=","osL6zeyDPJK0p32a9qw8941kZzdJprRs0U7UXfIkRVY=","il+aUw1fjU/3lNdvIll4Dn3CnQxIBnZMYKl/a22TuQo=","/ypiyDFuTCzVxDzLi3dwoeo5JFSyAmpukspZgaeKvSA=","S0F3rKdZXA/JqSkyOrtegIjjIFCJOYs1HnBajhvmywo=","/Tz8vh5sB85CyCunbqF0LbvXs2qKh5ZJbYldt93GyjU=","4lYk7cX8PszZLoyQMWjMDB1BOBn4f7hehtFiHo92e5Y=","ttpxd0TJprOUtb/8Wf5DeIzwNtUw72Q0YnXE2LFMIZo=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2889976090\n3+4boixF1G5EYQRzohPD2TVxgrrclhWTN4NeQvsMwpc=\n\n— rekor.sigstore.dev wNI9ajBEAiBwe4wqAz9+DJONEcipd9nQce4V6Ab9gce2jAApv112YQIgYOpaXvOnRVnTgycRzTOKjNuDCzGfA5vh31dasHSxzsE=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkNTY2NzEwNTc0NmVhOWI5NTcwNGZlNDYyNTA4ZGM5ZTgyZTMwNWM1NmVlMmJkZTQwZTdkYTdhMDQwZThjOWRhIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRkdUcUgvUHpqU0VKa3pHUEZESmZ1WWE0dHd6bGZmS2l2eE9henBVTE8xTkFpQjd4ditZTzBnUWdiamJFRlVVUnFNSnY5c3hucDNoYnZja3FjOW0zR1ZFTXc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVaEVWRU5EUW5CUFowRjNTVUpCWjBsVllVcHRjSEozYlM5aUszWmpMMDkwYzFsRFNsaDFWR1JKVTFKemQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlVVFhkTlJGRjZUV3BOTTFkb1kwNU5hbGwzVDFSTmQwMUVVVEJOYWswelYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVUyWmtWalVqUnpiek0wZUdkTmEyb3hWR1J3YzJ4Q016TnVhR2hJUTJ4WFNETkliMkVLWkcxQlJtNVdhREJWVlRKck9EQnRURXcwVm5kVkwwMVVTR2s1ZUV3M1IxaFBLMk5QVjNOTk1IUm9kR0pNYXpCeFRUWlBRMEppU1hkbloxZDFUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZwWjJsQkNsVXdPRzlGZWt3elN6TTVOVlpuTW1KV1VrVjVVbEJSZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwbldVUldVakJTUVZGSUwwSkdkM2RYYjFwWllVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKT2RtTnRUbWhNVjBad1RESk9iQXBaVjNkMlRHMWtjR1JIYURGWmFUa3pZak5LY2xwdGVIWmtNMDEyWTIxV2MxcFhSbnBhVXpGcVdWYzFhMkZYVW1oa1IxVjFaVmN4YzFGSVNteGFiazEyQ21GSFZtaGFTRTEyWWxkR2NHSnFRVFZDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa04wYjJSSVVuZGplbTkyVEROU2RtRXlWblZNYlVacVpFZHNkbUp1VFhVS1dqSnNNR0ZJVm1sa1dFNXNZMjFPZG1KdVVteGlibEYxV1RJNWRFMUNPRWREYVhOSFFWRlJRbWMzT0hkQlVVbEZSVmhrZG1OdGRHMWlSemt6V0RKU2NBcGpNMEpvWkVkT2IwMUVXVWREYVhOSFFWRlJRbWMzT0hkQlVVMUZTMFJDYWs1VVVtbFBSMGsxVGxSV2FscHRTbWxPZWxacVRVUmpNRnBxV1RWT2VtY3pDbHBVWXpWUFYxVjNUbXBaTkZwSFJUSlpla2wzU2tGWlMwdDNXVUpDUVVkRWRucEJRa0pCVVZkUk1sWm9Za05DZVZwWGVHeFpXRTVzU1VkT2FHSnRVbkFLV2tkR01GcFVRV0pDWjI5eVFtZEZSVUZaVHk5TlFVVkdRa0V4YW1JelNtcFpVekZvWVZNNWFscFhSbk5OUWpCSFEybHpSMEZSVVVKbk56aDNRVkZaUlFwRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSVUZaVHk5TlFVVkpRa013VFVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMUNsbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRoUVZsTFMzZFpRa0pCUjBSMmVrRkNRMUZTWVVSR2FHOEtaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMldUSTVlVmt5UlhSWlYydDJXVEpXYUdKRE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNd3BqZVRsNVdsZDRiRmxZVG14TVYwNW9ZbTFTY0ZwSFJqQmFVelUxWWxkNFFXTnRWbTFqZVRsdldsZEdhMk41T1hSWlYyeDFUVVJuUjBOcGMwZEJVVkZDQ21jM09IZEJVVzlGUzJkM2IwMUhUVEZPUjBrMFdXcHJNVTVYVG0xWmJVa3pUbGROZDA1NlVtMU9hbXN6VDBSa2JFNTZhelZhVkVFeVRtcG9hMWxVV21vS1RXcEJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVeENRVGhOUkZka2NHUkhhREZaYVRGdllqTk9NRnBYVVhkTlFWbExTM2RaUWtKQlIwUjJla0ZDUkVGUmFRcEVRMEp2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVEk1ZVZreVJYUlpWMnQyV1RKV2FHSkVRVFJDWjI5eVFtZEZSVUZaVHk5TlFVVk9Da0pEYjAxTFJFSnFUbFJTYVU5SFNUVk9WRlpxV20xS2FVNTZWbXBOUkdNd1dtcFpOVTU2WnpOYVZHTTFUMWRWZDA1cVdUUmFSMFV5V1hwSmQwaDNXVXNLUzNkWlFrSkJSMFIyZWtGQ1JHZFJVa1JCT1hsYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQwZG5XVXRMZDFsQ1FrRkhSSFo2UVVKRWQxRk5SRUZ2ZUFwTlZHdDRUbFJWTUU1VWEzcE5RM05IUTJselIwRlJVVUpuTnpoM1FWSkJSVWhSZDJKaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWs1MkNtTnRUbWhNVjBad1RVSm5SME5wYzBkQlVWRkNaemM0ZDBGU1JVVkRaM2RKVG5wSk5VNTZaelJPYWtGM1lVRlpTMHQzV1VKQ1FVZEVkbnBCUWtWblVtRUtSRVpvYjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGt5T1hsWk1rVjBXVmRyZGxreVZtaGlRemgxV2pKc01HRklWbWxNTTJSMlkyMTBiUXBpUnprelkzazVlVnBYZUd4WldFNXNURmRPYUdKdFVuQmFSMFl3V2xNMU5XSlhlRUZqYlZadFkzazViMXBYUm10amVUbDBXVmRzZFUxRVowZERhWE5IQ2tGUlVVSm5OemgzUVZKTlJVdG5kMjlOUjAweFRrZEpORmxxYXpGT1YwNXRXVzFKTTA1WFRYZE9lbEp0VG1wck0wOUVaR3hPZW1zMVdsUkJNazVxYUdzS1dWUmFhazFxUVdoQ1oyOXlRbWRGUlVGWlR5OU5RVVZWUWtKTlRVVllaSFpqYlhSdFlrYzVNMWd5VW5Cak0wSm9aRWRPYjAxR1VVZERhWE5IUVZGUlFncG5OemgzUVZKVlJWSm5lRVZoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1NazUyWTIxT2FFeFhSbkJNTWs1c1dWZDNkbGxYVGpCaFZ6bDFDbU41T1hsa1Z6VjZUSHBOTWs1cVdUUk9hbEY2VGtSVmQwd3lSakJrUjFaMFkwaFNla3g2UlhkR2QxbExTM2RaUWtKQlIwUjJla0ZDUm1kUlNrUkJaSGNLWTIxc01sbFlVbXhOUkZsSFEybHpSMEZSVVVKbk56aDNRVkpuUlV0QmQyMWpiVlozWW5wd2FtSXpTbXBaVXpGb1lWTTVhbHBYUm5OUGJrcHNXbXB3ZVFwYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQyZFpiMGREYVhOSFFWRlJRakZ1YTBOQ1FVbEZaa0ZTTmtGSVowRmtaMFJrVUZSQ2NYaHpZMUpOYlUxYUNraG9lVnBhZW1ORGIydHdaWFZPTkRoeVppdElhVzVMUVV4NWJuVnFaMEZCUVdGRWQyeG5TbGhCUVVGRlFYZENTRTFGVlVOSlVVUTFXV3hEZEV4MmJtUUtWMnB2VDFWVE9EbEhaR2szVUZaWmNqSjNXRzVsTjJwVmVuTjBkbVJFVGtwamQwbG5RakZNYzJScmRtMVNNakoyUkhWamMwdFZlbEJVWlRSYVNEZG5jZ28xU1RoaVZqZDJjRGwyTW0xSlNrVjNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsNFFVbDZVbGxJTjNsbVVuaGFialJGTm1WRlVra3llbU5KQ21OdE1ITkpXSGxGY0RsR2NIUldaR3h3TmpCU1ZYbElXWEJsYldaT2EzbzRiVmxtZFRaWFVIRlFaMGwzVGt4UWRtRnRWalJQT1VNd2RFVldja0pKU0ZrS1F6TXJLMjV6Y2xjM1oyWTNkVWxLV2tzeVpXVjFiVUp5SzBoeU4ybzVXWFZSZFdGc1ZGQnpOMGhZUW5rS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19"}]},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"1WZxBXRuqblXBP5GJQjcnoLjBcVu4r3kDn2noEDoydo="},"signature":"MEQCIFGTqH/PzjSEJkzGPFDJfuYa4twzlffKivxOazpULO1NAiB7xv+YO0gQgbjbEFUURqMJv9sxnp3hbvckqc9m3GVEMw=="}}