@gate-forge/core 0.7.1 → 0.9.0

package/dist/policy/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAmErF"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAG5G,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGzG,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAK1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsC5B,CAAC;AAEL,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;kBAM9B,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,sEAAsE;AACtE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAcrC,CAAC;AAEL,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,YAAY,EACtB,SAAS,EAAE;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC3D,GACA,OAAO,CAaT;AAED,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAwErF"}

package/dist/policy/evaluate.js

@@ -209,14 +209,13 @@ export function evaluatePolicies(input) {
                 resourceId: resource.id,
                 name: resource.name,
                 detail: `resource '${resource.id ?? resource.name}' has no effective classification ` +
-                    '(the classifier blocked it definitionally); run ' +
-                    `'gateforge explain ${resource.id ?? resource.name}' for the typed ` +
-                    'reason and its in-code resolution',
+                    '(the classifier blocked it definitionally)',
                 location: resource.location,
+                nextAction: 'gateforge classify --json',
             });
             continue;
         }
-        generateObligations(resource, policyFile.policies, obligations, obligationIds);
+        generateObligations(resource, policyFile.policies, obligations, obligationIds, policyFile.options?.['http.endpoint.requireObservation'] === 'all');
     }
     for (const entry of input.graph.unresolved) {
         blocking.push({
@@ -264,13 +263,13 @@ export function evaluatePolicies(input) {
  * policy's required contract that the lifecycle allows, deduplicated
  * by obligation id (first matching policy owns the id).
  */
-function generateObligations(resource, policies, obligations, obligationIds) {
+function generateObligations(resource, policies, obligations, obligationIds, observationScopeAll) {
     const classification = resource.classification;
     if (classification === null || resource.id === null)
         return;
     const exposure = classification.exposure;
     for (const policy of policies) {
-        if (!policyMatches(policy, resource, exposure))
+        if (!policyMatches(policy, resource, exposure, observationScopeAll))
             continue;
         for (const contract of policy.require) {
             if (contract.startsWith(CRUD_CONTRACT_PREFIX) ||
@@ -301,7 +300,7 @@ function generateObligations(resource, policies, obligations, obligationIds) {
         }
     }
 }
-function policyMatches(policy, resource, exposure) {
+function policyMatches(policy, resource, exposure, observationScopeAll) {
     const when = policy.when;
     if (when.kind !== undefined && when.kind !== resource.kind)
         return false;
@@ -321,14 +320,25 @@ function policyMatches(policy, resource, exposure) {
         }
     }
     if (when.consumed !== undefined) {
+        // Plan Phase 4c (E60): the pinned
+        // `http.endpoint.requireObservation: all` option widens ONLY the
+        // `consumed: true` matcher of an endpoint-scoped policy to the
+        // whole discovered route inventory, so a new route no UI calls
+        // owes the observation contracts too (blocking
+        // TEST_MAPPING_MISSING until mapped or baselined). A `consumed:
+        // false` policy and every non-endpoint resource are untouched —
+        // the option narrows nothing and adds no contract.
+        const observationScopeWidened = observationScopeAll && when.kind === HTTP_ENDPOINT_RESOURCE_KIND && when.consumed === true;
         // Endpoint consumption match: `true` requires the attribute to be
         // EXACTLY true; `false` matches everything else (including absent —
         // non-endpoint resources are "not consumed", never match-excluded).
-        if (when.consumed === true && resource.attributes['frontendConsumed'] !== true) {
-            return false;
-        }
-        if (when.consumed === false && resource.attributes['frontendConsumed'] === true) {
-            return false;
+        if (!observationScopeWidened) {
+            if (when.consumed === true && resource.attributes['frontendConsumed'] !== true) {
+                return false;
+            }
+            if (when.consumed === false && resource.attributes['frontendConsumed'] === true) {
+                return false;
+            }
         }
     }
     return true;

package/dist/policy/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoC,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAgC,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAc,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAA0C,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,+DAA+D;AAC/D,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAExE;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,YAAY,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,cAAc;QACd,gBAAgB;QAChB,YAAY;QACZ,SAAS;QACT,iBAAiB;KAClB,CAAC;IACF,iEAAiE;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,kDAAkD;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC;;;;;OAKG;IACH,KAAK,EAAE,eAAe,CAAC,OAAO,EAAE;IAChC,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CACxC,CAAC,CAAC;AAKL;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAoB;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,YAAY,CAAC;IACZ,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpC,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAKL,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACZ,aAAa,EAAE,kBAAkB;IACjC,wEAAwE;IACxE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACvC,CAAC,CAAC;AAKL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAsB,EACtB,SAMC;IAED,KAAK,MAAM,MAAM,IAAI,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,QAAQ,qCAAqC;gBAC/D,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,SAA6C,CAAC,KAAK,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EACJ,aAAa,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,oCAAoC;oBAC7E,kDAAkD;oBAClD,sBAAsB,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,kBAAkB;oBACpE,mCAAmC;gBACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;YACtD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,UAAU,GAAG;YAC7E,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI;SACvC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE;YAC7E,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEtF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,QAAuB,EACvB,QAAkB,EAClB,WAAyB,EACzB,aAA0B;IAE1B,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;IAC/C,IAAI,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;YAAE,SAAS;QACzD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,IACE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBACzC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAChD,CAAC;gBACD,IAAI,QAAQ,KAAK,UAAU;oBAAE,SAAS,CAAC,2CAA2C;gBAClF,4DAA4D;gBAC5D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,4CAA4C;gBAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAA2B;oBAAE,SAAS;gBAC5D,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;oBAAE,SAAS;YAC7E,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;YACxC,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,EAAE;gBACF,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ;gBACR,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,SAAS,EAAE,cAAc,CAAC,SAAS;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,QAAuB,EACvB,QAAoC;IAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,sEAAsE;QACtE,4DAA4D;QAC5D,gEAAgE;QAChE,iBAAiB;QACjB,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,EAClE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAe,EACf,aAA0B,EAC1B,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7E,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,SAAkB;gBAC1B,MAAM,EAAE,aAAa,UAAU,qGAAqG;aACrI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,SAAkB;gBAC1B,MAAM,EAAE,qBAAqB,KAAK,CAAC,YAAY,6BAA6B;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,WAAyB;IAChD,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,QAAyB;IAC7C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9B,cAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QACtD,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1D,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoC,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAgC,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAc,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAA0C,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC;AAE1D,+DAA+D;AAC/D,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAExE;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,YAAY,CAAC;IACZ;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,cAAc;QACd,gBAAgB;QAChB,YAAY;QACZ,SAAS;QACT,iBAAiB;KAClB,CAAC;IACF,iEAAiE;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,kDAAkD;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC;;;;;OAKG;IACH,KAAK,EAAE,eAAe,CAAC,OAAO,EAAE;IAChC,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;CACxC,CAAC,CAAC;AAKL;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAoB;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,YAAY,CAAC;IACZ,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpC,4DAA4D;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAKL,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACZ,aAAa,EAAE,kBAAkB;IACjC,wEAAwE;IACxE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACvC,CAAC,CAAC;AAKL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAsB,EACtB,SAMC;IAED,KAAK,MAAM,MAAM,IAAI,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,QAAQ,qCAAqC;gBAC/D,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,SAA6C,CAAC,KAAK,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EACJ,aAAa,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,oCAAoC;oBAC7E,4CAA4C;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,2BAA2B;aACxC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,mBAAmB,CACjB,QAAQ,EACR,UAAU,CAAC,QAAQ,EACnB,WAAW,EACX,aAAa,EACb,UAAU,CAAC,OAAO,EAAE,CAAC,kCAAkC,CAAC,KAAK,KAAK,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;YACtD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,UAAU,GAAG;YAC7E,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI;SACvC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE;YAC7E,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEtF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;QAChC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,QAAuB,EACvB,QAAkB,EAClB,WAAyB,EACzB,aAA0B,EAC1B,mBAA4B;IAE5B,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;IAC/C,IAAI,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,CAAC;YAAE,SAAS;QAC9E,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,IACE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBACzC,QAAQ,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAChD,CAAC;gBACD,IAAI,QAAQ,KAAK,UAAU;oBAAE,SAAS,CAAC,2CAA2C;gBAClF,4DAA4D;gBAC5D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,4CAA4C;gBAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,2BAA2B;oBAAE,SAAS;gBAC5D,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;oBAAE,SAAS;YAC7E,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;YACxC,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,EAAE;gBACF,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ;gBACR,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,SAAS,EAAE,cAAc,CAAC,SAAS;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,QAAuB,EACvB,QAAoC,EACpC,mBAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,sEAAsE;QACtE,4DAA4D;QAC5D,gEAAgE;QAChE,iBAAiB;QACjB,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,EAClE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,kCAAkC;QAClC,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,+CAA+C;QAC/C,gEAAgE;QAChE,gEAAgE;QAChE,mDAAmD;QACnD,MAAM,uBAAuB,GAC3B,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,2BAA2B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC7F,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/E,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAe,EACf,aAA0B,EAC1B,SAA0B;IAE1B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC7E,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,SAAkB;gBAC1B,MAAM,EAAE,aAAa,UAAU,qGAAqG;aACrI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,SAAkB;gBAC1B,MAAM,EAAE,qBAAqB,KAAK,CAAC,YAAY,6BAA6B;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,WAAyB;IAChD,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,QAAyB;IAC7C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9B,cAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QACtD,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1D,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/dist/quarantine/index.d.ts

@@ -0,0 +1,82 @@
+import { type Quarantine } from '../schemas/quarantine.js';
+/** Maximum quarantine lifetime in days: a quarantine always expires. */
+export declare const QUARANTINE_MAX_DAYS = 14;
+/** The documented ceiling in milliseconds. */
+export declare const QUARANTINE_MAX_DURATION_MS: number;
+/** Repo-relative quarantine directory. */
+export declare const QUARANTINE_DIR = ".gateforge/quarantine";
+/** One fail-closed quarantine-loading problem (file-scoped, actionable). */
+export interface QuarantineProblem {
+    /** Quarantine file the problem was found in (basename). */
+    file: string;
+    /** Single-cause human explanation. */
+    detail: string;
+}
+/** Error raised for any fail-closed quarantine configuration problem. */
+export declare class GateforgeQuarantineError extends Error {
+    /** Every problem found, file-scoped, in deterministic order. */
+    readonly problems: readonly QuarantineProblem[];
+    constructor(problems: readonly QuarantineProblem[]);
+}
+/** One loaded quarantine with its file and expiry state. */
+export interface LoadedQuarantine {
+    /** Basename of the file the record came from. */
+    file: string;
+    /** The schema-valid quarantine document. */
+    quarantine: Quarantine;
+}
+/** Result of loading a quarantine directory against the injected clock. */
+export interface QuarantineLoadResult {
+    /** Unexpired quarantines — the required set minus these tests. */
+    active: LoadedQuarantine[];
+    /** Quarantines expired at the injected `now` — each one blocks. */
+    expired: LoadedQuarantine[];
+}
+/** Options for {@link loadQuarantines}. */
+export interface QuarantineLoadOptions {
+    /** Injected clock instant (Date or ISO-8601) expiry is judged against. */
+    now: Date | string;
+    /** Maximum allowed lifetime; defaults to the documented 14 days. */
+    maxDurationMs?: number;
+}
+/**
+ * Loads and validates every `*.yml` quarantine file in `dir` (sorted by
+ * filename for determinism). A missing directory yields an empty result
+ * — most repositories have no quarantines. Any problem (unparsable
+ * YAML, missing mandatory field, duplicate test key, over-long duration)
+ * fails closed with {@link GateforgeQuarantineError}.
+ *
+ * Args:
+ *   dir: the quarantine directory (`.gateforge/quarantine`).
+ *   options: injected clock and optional maximum duration.
+ *
+ * Returns:
+ *   QuarantineLoadResult: active and expired partitions, both sorted by
+ *   test key.
+ *
+ * @throws GateforgeQuarantineError when any file fails closed.
+ */
+export declare function loadQuarantines(dir: string, options: QuarantineLoadOptions): QuarantineLoadResult;
+/**
+ * Serializes one quarantine document in the stable on-disk form
+ * (block YAML, trailing newline).
+ *
+ * Args:
+ *   quarantine: the schema-valid document.
+ *
+ * Returns:
+ *   string: the file content.
+ */
+export declare function serializeQuarantine(quarantine: Quarantine): string;
+/**
+ * Writes one quarantine document, creating parent directories as needed.
+ * Fail-closed: a write failure surfaces as a {@link GateforgeQuarantineError}.
+ *
+ * Args:
+ *   path: destination file path.
+ *   quarantine: the schema-valid document to write.
+ *
+ * @throws GateforgeQuarantineError when the file cannot be written.
+ */
+export declare function writeQuarantine(path: string, quarantine: Quarantine): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/quarantine/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/quarantine/index.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG7E,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,QAAmC,CAAC;AAE3E,0CAA0C;AAC1C,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yEAAyE;AACzE,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;gBAEpC,QAAQ,EAAE,SAAS,iBAAiB,EAAE;CAQnD;AAED,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,mEAAmE;IACnE,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,GAAG,EAAE,IAAI,GAAG,MAAM,CAAC;IACnB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,qBAAqB,GAC7B,oBAAoB,CAoEtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAUlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAY1E"}

package/dist/quarantine/index.js

@@ -0,0 +1,194 @@
+/**
+ * Flaky-test quarantine loading.
+ *
+ * Owner-approved, always-expiring files in `.gateforge/quarantine/*.yml`
+ * that remove ONE test from the required set. The same trust pattern as
+ * waivers, with one difference in force: a quarantined test never
+ * FORGIVES anything — it never blocks and its evidence is never used,
+ * so an obligation only it covered stays `missing`.
+ *
+ * Fail-closed rules:
+ * - ALL FOUR attribution fields (testKey, owner, approver, reason) plus
+ *   the expiry are mandatory; a file missing any of them is a
+ *   configuration error, never a partially-applied exception.
+ * - Expiry is judged against the INJECTED clock, never the wall clock
+ *   (invariant 7).
+ * - A maximum duration is enforced: a quarantine may never outlive the
+ *   documented ceiling, so a "temporary" escape hatch cannot become
+ *   permanent by hand-editing the expiry.
+ * - Two quarantines on the same test key are ambiguous → error.
+ *
+ * Loading is synchronous, matching the waivers loader.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { compareStrings } from '../graph/util.js';
+import { QuarantineSchema } from '../schemas/quarantine.js';
+import { parseInstant } from '../verdict/index.js';
+/** Maximum quarantine lifetime in days: a quarantine always expires. */
+export const QUARANTINE_MAX_DAYS = 14;
+/** The documented ceiling in milliseconds. */
+export const QUARANTINE_MAX_DURATION_MS = QUARANTINE_MAX_DAYS * 86_400_000;
+/** Repo-relative quarantine directory. */
+export const QUARANTINE_DIR = '.gateforge/quarantine';
+/** Error raised for any fail-closed quarantine configuration problem. */
+export class GateforgeQuarantineError extends Error {
+    /** Every problem found, file-scoped, in deterministic order. */
+    problems;
+    constructor(problems) {
+        const rendered = problems.map((problem) => `  ${problem.file}: ${problem.detail}`).join('\n');
+        super(`quarantine configuration failed closed with ${problems.length} problem(s):\n${rendered}`);
+        this.name = 'GateforgeQuarantineError';
+        this.problems = problems;
+    }
+}
+/**
+ * Parses one quarantine document (fail-closed: an empty or non-mapping
+ * document is a problem, never an empty quarantine).
+ *
+ * Args:
+ *   text: the raw file content.
+ *
+ * Returns:
+ *   unknown: the parsed YAML mapping.
+ *
+ * @throws Error when the bytes are unparsable or not a mapping.
+ */
+function parseYamlDocument(text) {
+    const parsed = parseYaml(text);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('quarantine document must be a mapping with schemaVersion, testKey, owner, approver, reason, expiresAt');
+    }
+    return parsed;
+}
+/**
+ * Loads and validates every `*.yml` quarantine file in `dir` (sorted by
+ * filename for determinism). A missing directory yields an empty result
+ * — most repositories have no quarantines. Any problem (unparsable
+ * YAML, missing mandatory field, duplicate test key, over-long duration)
+ * fails closed with {@link GateforgeQuarantineError}.
+ *
+ * Args:
+ *   dir: the quarantine directory (`.gateforge/quarantine`).
+ *   options: injected clock and optional maximum duration.
+ *
+ * Returns:
+ *   QuarantineLoadResult: active and expired partitions, both sorted by
+ *   test key.
+ *
+ * @throws GateforgeQuarantineError when any file fails closed.
+ */
+export function loadQuarantines(dir, options) {
+    const now = parseInstant(options.now);
+    const maxDurationMs = options.maxDurationMs ?? QUARANTINE_MAX_DURATION_MS;
+    if (!existsSync(dir))
+        return { active: [], expired: [] };
+    const files = readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.yml'))
+        .map((entry) => entry.name)
+        .sort(compareStrings);
+    const problems = [];
+    const parsed = [];
+    for (const file of files) {
+        let document;
+        try {
+            document = parseYamlDocument(readFileSync(join(dir, file), 'utf8'));
+        }
+        catch (error) {
+            problems.push({
+                file,
+                detail: `not parsable YAML: ${error instanceof Error ? error.message : String(error)}`,
+            });
+            continue;
+        }
+        const result = QuarantineSchema.safeParse(document);
+        if (!result.success) {
+            for (const issue of result.error.issues) {
+                problems.push({ file, detail: `${issue.path.join('.') || '<quarantine>'}: ${issue.message}` });
+            }
+            continue;
+        }
+        const duration = Date.parse(result.data.expiresAt) - now.getTime();
+        if (duration > maxDurationMs) {
+            problems.push({
+                file,
+                detail: `expiresAt '${result.data.expiresAt}' exceeds the maximum quarantine duration ` +
+                    `(${String(Math.round(maxDurationMs / 86_400_000))} days from now)`,
+            });
+            continue;
+        }
+        parsed.push({ file, quarantine: result.data });
+    }
+    const byTestKey = new Map();
+    for (const entry of parsed) {
+        const firstFile = byTestKey.get(entry.quarantine.testKey);
+        if (firstFile !== undefined) {
+            problems.push({
+                file: entry.file,
+                detail: `test key '${entry.quarantine.testKey}' is already quarantined by '${firstFile}' — ` +
+                    'one quarantine per test, never two overlapping exceptions',
+            });
+            continue;
+        }
+        byTestKey.set(entry.quarantine.testKey, entry.file);
+    }
+    if (problems.length > 0)
+        throw new GateforgeQuarantineError(problems);
+    const active = [];
+    const expired = [];
+    for (const entry of parsed) {
+        if (now.getTime() >= Date.parse(entry.quarantine.expiresAt))
+            expired.push(entry);
+        else
+            active.push(entry);
+    }
+    const byTest = (a, b) => compareStrings(a.quarantine.testKey, b.quarantine.testKey);
+    return { active: [...active].sort(byTest), expired: [...expired].sort(byTest) };
+}
+/**
+ * Serializes one quarantine document in the stable on-disk form
+ * (block YAML, trailing newline).
+ *
+ * Args:
+ *   quarantine: the schema-valid document.
+ *
+ * Returns:
+ *   string: the file content.
+ */
+export function serializeQuarantine(quarantine) {
+    const body = stringifyYaml({
+        schemaVersion: quarantine.schemaVersion,
+        testKey: quarantine.testKey,
+        owner: quarantine.owner,
+        approver: quarantine.approver,
+        reason: quarantine.reason,
+        expiresAt: quarantine.expiresAt,
+    });
+    return `${body.endsWith('\n') ? body : `${body}\n`}`;
+}
+/**
+ * Writes one quarantine document, creating parent directories as needed.
+ * Fail-closed: a write failure surfaces as a {@link GateforgeQuarantineError}.
+ *
+ * Args:
+ *   path: destination file path.
+ *   quarantine: the schema-valid document to write.
+ *
+ * @throws GateforgeQuarantineError when the file cannot be written.
+ */
+export function writeQuarantine(path, quarantine) {
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, serializeQuarantine(quarantine), 'utf8');
+    }
+    catch (error) {
+        throw new GateforgeQuarantineError([
+            {
+                file: basename(path),
+                detail: `could not be written: ${error instanceof Error ? error.message : String(error)}`,
+            },
+        ]);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/quarantine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/quarantine/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,UAAU,CAAC;AAE3E,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAUtD,yEAAyE;AACzE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,gEAAgE;IACvD,QAAQ,CAA+B;IAEhD,YAAY,QAAsC;QAChD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,KAAK,CACH,+CAA+C,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,EAAE,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AA0BD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAY,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,OAA8B;IAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,0BAA0B,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,cAAc,CAAC,CAAC;IAExB,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACvF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACnE,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EACJ,cAAc,MAAM,CAAC,IAAI,CAAC,SAAS,4CAA4C;oBAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,UAAU,CAAC,CAAC,iBAAiB;aACtE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EACJ,aAAa,KAAK,CAAC,UAAU,CAAC,OAAO,gCAAgC,SAAS,MAAM;oBACpF,2DAA2D;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,CAAmB,EAAE,EAAE,CAC1D,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsB;IACxD,MAAM,IAAI,GAAG,aAAa,CAAC;QACzB,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,UAAsB;IAClE,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC;YACjC;gBACE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACpB,MAAM,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC1F;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/receipt/index.d.ts

@@ -1,6 +1,8 @@
 import { type JsonValue } from '../canonical-json.js';
-import { type GateReceipt } from '../schemas/gate-receipt.js';
 import { EMPTY_BEHAVIOR_CATALOG_DIGEST } from '../policy/behavior.js';
+import { type GateReceipt } from '../schemas/gate-receipt.js';
+import type { ExecutedOutcome } from '../schemas/execution-result.js';
+import { type RunRecord, type RunRecordBody } from '../schemas/run-record.js';
 /** Domain tag binding receipt MACs to the gate-receipt envelope format. */
 export declare const RECEIPT_DOMAIN = "gateforge.receipt.v2";
 /** The only receipt envelope version this code produces or honors. */
@@ -63,6 +65,68 @@ export { EMPTY_BEHAVIOR_CATALOG_DIGEST };
  *   TypeError: when the verifier key is empty.
  */
 export declare function gateReceiptMac(verifierKey: string, body: GateReceiptBody): string;
+/**
+ * Digest over a run's per-test outcomes, in the sealed order. A run
+ * record binds it so the record can never claim a cleaner run than the
+ * execution result it names, and a consumer recomputes it from that
+ * execution result when it recomputes the re-seal.
+ *
+ * Args:
+ *   outcomes: the sealed execution result's per-test outcomes.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex digest.
+ */
+export declare function testOutcomesDigestOf(outcomes: readonly ExecutedOutcome[]): string;
+/** Domain tag binding run-record MACs to the run-record envelope format. */
+export declare const RUN_RECORD_DOMAIN = "gateforge.run-record.v1";
+/** The only run-record envelope version this code produces or honors. */
+export declare const RUN_RECORD_VERSION = 1;
+/**
+ * Computes the run-record MAC: HMAC-SHA256 over the GF-canonical JSON
+ * of `{domain: 'gateforge.run-record.v1', ...body}` keyed by the same
+ * witness verifier key a receipt uses. The distinct domain tag makes
+ * cross-format acceptance impossible in both directions: a run record
+ * can never verify as a gate receipt, and a receipt MAC can never
+ * verify as a run record.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret (non-empty).
+ *   body: the unsigned run-record body.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex HMAC.
+ *
+ * Throws:
+ *   TypeError: when the verifier key is empty.
+ */
+export declare function runRecordMac(verifierKey: string, body: RunRecordBody): string;
+/** Typed reasons a run-record candidate failed verification (fail closed). */
+export type RunRecordRejection = 'missing' | 'malformed' | 'mac-fail' | 'not-whole-suite';
+/** The verification outcome: a validated run record or a typed rejection. */
+export type RunRecordVerification = {
+    ok: true;
+    record: RunRecord;
+} | {
+    ok: false;
+    rejection: RunRecordRejection;
+    detail: string;
+};
+/**
+ * Verifies a run-record candidate end to end (fail closed): the strict
+ * schema first, then the MAC under the given verifier key. A run record
+ * authenticates EXACTLY this much and no more — it carries no gate
+ * verdict, so there is nothing here to grade, compare against a policy
+ * pin, or accept as proof for a blocked gate.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret the record must carry a MAC for.
+ *   candidate: the parsed run-state document.
+ *
+ * Returns:
+ *   RunRecordVerification: the validated record or the typed rejection.
+ */
+export declare function verifyRunRecord(verifierKey: string, candidate: unknown): RunRecordVerification;
 /** Typed reasons a receipt candidate failed verification (fail closed). */
 export type ReceiptRejection = 'missing' | 'malformed' | 'mac-fail' | 'input-digest-mismatch' | 'policy-digest-mismatch' | 'selection-digest-mismatch' | 'catalog-digest-mismatch' | 'execution-digest-mismatch' | 'attestation-digest-mismatch' | 'tree-mismatch' | 'behavior-digest-mismatch' | 'case-set-mismatch' | 'case-execution-mismatch' | 'engine-bundle-mismatch' | 'boundary-mismatch' | 'artifact-mismatch' | 'not-clean';
 /** The verification outcome: a validated receipt or a typed rejection. */

package/dist/receipt/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/receipt/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,2EAA2E;AAC3E,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD,sEAAsE;AACtE,eAAO,MAAM,eAAe,IAAI,CAAC;AAKjC,6DAA6D;AAC7D,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEvD,gFAAgF;AAChF,eAAO,MAAM,8BAA8B,QAGzC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,QAGtC,CAAC;AAEH,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAUpF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAM/F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,QAAuD,CAAC;AAErG;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM7E;AAED,OAAO,EAAE,6BAA6B,EAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,CAYjF;AAED,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,WAAW,GACX,UAAU,GACV,uBAAuB,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,yBAAyB,GACzB,2BAA2B,GAC3B,6BAA6B,GAC7B,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,mBAAmB,GACnB,mBAAmB,GACnB,WAAW,CAAC;AAEhB,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,OAAO,EAClB,QAAQ,GAAE;IACR,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC1B,GACL,mBAAmB,CAqJrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,+BAA+B;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/receipt/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE/F,2EAA2E;AAC3E,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD,sEAAsE;AACtE,eAAO,MAAM,eAAe,IAAI,CAAC;AAKjC,6DAA6D;AAC7D,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEvD,gFAAgF;AAChF,eAAO,MAAM,8BAA8B,QAGzC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,QAGtC,CAAC;AAEH,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAUpF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMxE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAM/F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,QAAuD,CAAC;AAErG;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM7E;AAED,OAAO,EAAE,6BAA6B,EAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,CAYjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAEjF;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,CAY7E;AAED,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,qBAAqB,CAiD9F;AAED,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,WAAW,GACX,UAAU,GACV,uBAAuB,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,yBAAyB,GACzB,2BAA2B,GAC3B,6BAA6B,GAC7B,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,mBAAmB,GACnB,mBAAmB,GACnB,WAAW,CAAC;AAEhB,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,OAAO,EAClB,QAAQ,GAAE;IACR,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC1B,GACL,mBAAmB,CAqJrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,+BAA+B;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B"}

package/dist/receipt/index.js

@@ -15,8 +15,9 @@
  */
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { canonicalJson, sha256Canonical } from '../canonical-json.js';
-import { GateReceiptSchema } from '../schemas/gate-receipt.js';
 import { EMPTY_BEHAVIOR_CATALOG_DIGEST } from '../policy/behavior.js';
+import { GateReceiptSchema } from '../schemas/gate-receipt.js';
+import { RunRecordSchema } from '../schemas/run-record.js';
 /** Domain tag binding receipt MACs to the gate-receipt envelope format. */
 export const RECEIPT_DOMAIN = 'gateforge.receipt.v2';
 /** The only receipt envelope version this code produces or honors. */
@@ -127,6 +128,119 @@ export function gateReceiptMac(verifierKey, body) {
     }))
         .digest('hex');
 }
+/**
+ * Digest over a run's per-test outcomes, in the sealed order. A run
+ * record binds it so the record can never claim a cleaner run than the
+ * execution result it names, and a consumer recomputes it from that
+ * execution result when it recomputes the re-seal.
+ *
+ * Args:
+ *   outcomes: the sealed execution result's per-test outcomes.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex digest.
+ */
+export function testOutcomesDigestOf(outcomes) {
+    return sha256Canonical(outcomes);
+}
+/** Domain tag binding run-record MACs to the run-record envelope format. */
+export const RUN_RECORD_DOMAIN = 'gateforge.run-record.v1';
+/** The only run-record envelope version this code produces or honors. */
+export const RUN_RECORD_VERSION = 1;
+/**
+ * Computes the run-record MAC: HMAC-SHA256 over the GF-canonical JSON
+ * of `{domain: 'gateforge.run-record.v1', ...body}` keyed by the same
+ * witness verifier key a receipt uses. The distinct domain tag makes
+ * cross-format acceptance impossible in both directions: a run record
+ * can never verify as a gate receipt, and a receipt MAC can never
+ * verify as a run record.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret (non-empty).
+ *   body: the unsigned run-record body.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex HMAC.
+ *
+ * Throws:
+ *   TypeError: when the verifier key is empty.
+ */
+export function runRecordMac(verifierKey, body) {
+    if (typeof verifierKey !== 'string' || verifierKey.length === 0) {
+        throw new TypeError('runRecordMac: verifier key must be a non-empty string');
+    }
+    return createHmac('sha256', verifierKey)
+        .update(canonicalJson({
+        domain: RUN_RECORD_DOMAIN,
+        ...body,
+    }))
+        .digest('hex');
+}
+/**
+ * Verifies a run-record candidate end to end (fail closed): the strict
+ * schema first, then the MAC under the given verifier key. A run record
+ * authenticates EXACTLY this much and no more — it carries no gate
+ * verdict, so there is nothing here to grade, compare against a policy
+ * pin, or accept as proof for a blocked gate.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret the record must carry a MAC for.
+ *   candidate: the parsed run-state document.
+ *
+ * Returns:
+ *   RunRecordVerification: the validated record or the typed rejection.
+ */
+export function verifyRunRecord(verifierKey, candidate) {
+    if (candidate === undefined || candidate === null) {
+        return { ok: false, rejection: 'missing', detail: 'run record is missing' };
+    }
+    const parsed = RunRecordSchema.safeParse(candidate);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        const path = issue === undefined ? '' : ` at '${issue.path.map(String).join('.')}':`;
+        return {
+            ok: false,
+            rejection: 'malformed',
+            detail: `run record is malformed${path} ${issue?.message ?? 'unknown schema error'}`,
+        };
+    }
+    const record = parsed.data;
+    const { mac, ...body } = record;
+    if (typeof verifierKey !== 'string' || verifierKey.length === 0) {
+        return {
+            ok: false,
+            rejection: 'mac-fail',
+            detail: 'run record cannot verify without a verifier key (fail closed)',
+        };
+    }
+    if (!MAC_PATTERN.test(mac)) {
+        return { ok: false, rejection: 'mac-fail', detail: 'run record mac is malformed' };
+    }
+    let expectedMac;
+    let claimedMac;
+    try {
+        expectedMac = Buffer.from(runRecordMac(verifierKey, body), 'hex');
+        claimedMac = Buffer.from(mac, 'hex');
+    }
+    catch {
+        return { ok: false, rejection: 'mac-fail', detail: 'run record mac could not be recomputed' };
+    }
+    if (expectedMac.length !== claimedMac.length || !timingSafeEqual(expectedMac, claimedMac)) {
+        return {
+            ok: false,
+            rejection: 'mac-fail',
+            detail: 'run record signature fails; the record was forged or tampered with (fail closed)',
+        };
+    }
+    if (record.plannedTests === 0) {
+        return {
+            ok: false,
+            rejection: 'not-whole-suite',
+            detail: 'run record holds no planned test, so it proves no whole-suite run',
+        };
+    }
+    return { ok: true, record };
+}
 /**
  * Verifies a receipt candidate end-to-end (fail closed):
  * 1. structural — the value must parse against the strict v1 schema;