@gate-forge/core 0.9.0 → 0.10.0

package/dist/schemas/classification-policy.d.ts

@@ -72,6 +72,39 @@ export declare const LifecycleRulesSchema: z.ZodArray<z.ZodObject<{
 }, z.core.$strict>>;
 /** Deterministic rule ordering for authority minting and explanations. */
 export declare function sortLifecycleRules(rules: readonly LifecycleRule[]): LifecycleRule[];
+/**
+ * How removal manifests for the resources an owner rule matches. Only
+ * these two exist: the engine never invents a third, and never picks
+ * between them on its own.
+ */
+export declare const DeleteSemanticsSchema: z.ZodEnum<{
+    hard: "hard";
+    archive: "archive";
+}>;
+/** Inferred delete-semantics union. */
+export type DeleteSemantics = z.infer<typeof DeleteSemanticsSchema>;
+/** One owner-declared delete-semantics rule over a source glob. */
+export declare const DeleteRuleSchema: z.ZodObject<{
+    match: z.ZodString;
+    semantics: z.ZodEnum<{
+        hard: "hard";
+        archive: "archive";
+    }>;
+    archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+/** Inferred delete-rule shape. */
+export type DeleteRule = z.infer<typeof DeleteRuleSchema>;
+/** Delete rules with duplicate match patterns rejected as ambiguous. */
+export declare const DeleteRulesSchema: z.ZodArray<z.ZodObject<{
+    match: z.ZodString;
+    semantics: z.ZodEnum<{
+        hard: "hard";
+        archive: "archive";
+    }>;
+    archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    reason: z.ZodString;
+}, z.core.$strict>>;
 /**
  * One coverage requirement (red-team round 3): the named detector must
  * report examining every applicable file for a scan to count as COMPLETE.
@@ -122,6 +155,15 @@ export declare const ClassificationPolicySchema: z.ZodObject<{
         }>>;
         reason: z.ZodString;
     }, z.core.$strict>>>;
+    deleteRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        match: z.ZodString;
+        semantics: z.ZodEnum<{
+            hard: "hard";
+            archive: "archive";
+        }>;
+        archiveFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        reason: z.ZodString;
+    }, z.core.$strict>>>;
     coverage: z.ZodOptional<z.ZodArray<z.ZodObject<{
         capability: z.ZodString;
         detector: z.ZodString;

package/dist/schemas/classification-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification-policy.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,wEAAwE;AACxE,eAAO,MAAM,gCAAgC;;;;kBAmBlC,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;kBAUhC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB;;;;;;kBAOpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,iDAAkD,CAAC;AAEpF,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAiBvE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB;;kBAK1B,CAAC;AAEZ,2CAA2C;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,kFAAkF;AAClF,eAAO,MAAM,mBAAmB;;;;;;;;;;;kBAkCrB,CAAC;AAEZ,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;mBAoB7B,CAAC;AAEL,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAQnF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAyBpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqC5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
+{"version":3,"file":"classification-policy.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,wEAAwE;AACxE,eAAO,MAAM,gCAAgC;;;;kBAmBlC,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;kBAUhC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB;;;;;;kBAOpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,iDAAkD,CAAC;AAEpF,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAiBvE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB;;kBAK1B,CAAC;AAEZ,2CAA2C;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,kFAAkF;AAClF,eAAO,MAAM,mBAAmB;;;;;;;;;;;kBAkCrB,CAAC;AAEZ,qCAAqC;AACrC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;mBAoB7B,CAAC;AAEL,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAQnF;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;EAA8B,CAAC;AAEjE,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AA6BpE,mEAAmE;AACnE,eAAO,MAAM,gBAAgB;;;;;;;;kBA4CzB,CAAC;AAEL,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,wEAAwE;AACxE,eAAO,MAAM,iBAAiB;;;;;;;;mBAoB1B,CAAC;AAEL;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAyBpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4C5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/classification-policy.js

@@ -141,6 +141,104 @@ export function sortLifecycleRules(rules) {
     }))
         .sort((a, b) => compareStrings(a.match.resourceId, b.match.resourceId));
 }
+/**
+ * How removal manifests for the resources an owner rule matches. Only
+ * these two exist: the engine never invents a third, and never picks
+ * between them on its own.
+ */
+export const DeleteSemanticsSchema = z.enum(['hard', 'archive']);
+/**
+ * A repo-root-relative glob over the SOURCE FILE of the resources the
+ * rule declares semantics for. A glob (not one exact id) is safe here
+ * because declaring semantics is an evidence CONTRACT, never a
+ * suppression: it can only resolve DELETE_SEMANTICS_UNRESOLVED, never
+ * remove an obligation on its own (contradicting detector evidence still
+ * blocks).
+ */
+const DeleteRuleMatchSchema = z
+    .string()
+    .min(1, 'match must not be empty')
+    .refine((value) => value === value.trim(), {
+    message: 'match must not have leading or trailing whitespace',
+})
+    .refine((value) => !value.includes('\\'), {
+    message: 'match must use posix "/" separators',
+})
+    .refine((value) => !value.startsWith('/'), {
+    message: 'match must be repo-relative, never absolute',
+})
+    .refine((value) => !value.split('/').includes('..'), {
+    message: 'match must not escape the repository',
+});
+/** The owner-owned archived field values an archive rule declares. */
+const ArchiveFieldsSchema = z.record(z.string().min(1), z.union([z.string(), z.number(), z.boolean()]));
+/** One owner-declared delete-semantics rule over a source glob. */
+export const DeleteRuleSchema = z
+    .object({
+    /** Repo-root-relative glob over the matched resources' source file. */
+    match: DeleteRuleMatchSchema,
+    /** How removal manifests for every resource this rule matches. */
+    semantics: DeleteSemanticsSchema,
+    /**
+     * Required, and never empty, when `semantics` is `archive`: the
+     * owner-owned archived state (e.g. `{status: archived}`) the engine
+     * grades removal against. `hard` removal has no archived state and
+     * must not carry the key.
+     */
+    archiveFields: ArchiveFieldsSchema.optional(),
+    /** Owner explanation rendered in classifier traces and diagnostics. */
+    reason: z
+        .string()
+        .min(1, 'reason must not be empty')
+        .refine((value) => value === value.trim(), {
+        message: 'reason must not have leading or trailing whitespace',
+    })
+        .refine((value) => !/[\u0000-\u001f\u007f]/.test(value), {
+        message: 'reason must not contain control characters',
+    }),
+})
+    .strict()
+    .superRefine((rule, ctx) => {
+    if (rule.semantics === 'archive' && Object.keys(rule.archiveFields ?? {}).length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['archiveFields'],
+            message: "delete rule semantics is 'archive': 'archiveFields' must declare the owner-owned " +
+                'archived state (e.g. {status: archived}); removal is never guessed',
+        });
+    }
+    if (rule.semantics === 'hard' && rule.archiveFields !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['archiveFields'],
+            message: "delete rule semantics is 'hard': a permanent removal has no archived state, so " +
+                "'archiveFields' must be absent",
+        });
+    }
+});
+/** Delete rules with duplicate match patterns rejected as ambiguous. */
+export const DeleteRulesSchema = z
+    .array(DeleteRuleSchema)
+    .superRefine((rules, ctx) => {
+    const seen = new Map();
+    for (let index = 0; index < rules.length; index += 1) {
+        const match = rules[index]?.match;
+        if (match === undefined)
+            continue;
+        const first = seen.get(match);
+        if (first !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [index, 'match'],
+                message: `duplicate delete rule for '${match}' (already declared at index ${first}); ` +
+                    'one source pattern must have one unambiguous semantics',
+            });
+        }
+        else {
+            seen.set(match, index);
+        }
+    }
+});
 /**
  * One coverage requirement (red-team round 3): the named detector must
  * report examining every applicable file for a scan to count as COMPLETE.
@@ -198,6 +296,13 @@ export const ClassificationPolicySchema = z
     internalRules: z.array(InternalRuleSchema),
     /** Exact owner lifecycle disables; suppressive effects require scan proof. */
     lifecycleRules: LifecycleRulesSchema.optional(),
+    /**
+     * Owner-declared delete semantics (hard|archive) per source glob.
+     * Declaring semantics ADDS an evidence contract — it can resolve
+     * DELETE_SEMANTICS_UNRESOLVED, never remove an obligation: detector
+     * evidence that disagrees still blocks as a contradiction.
+     */
+    deleteRules: DeleteRulesSchema.optional(),
     /**
      * Coverage requirements for COMPLETE-scan proofs (ADR 0003 D4). A
      * closed-world attestation holds only when every rule's detector is

package/dist/schemas/classification-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAKpF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;KACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,yDAAyD;CACnE,CAAC;KACD,KAAK,CACJ,yCAAyC,EACzC,mGAAmG,CACpG;KACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,wDAAwD;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,yEAAyE;IACzE,UAAU,EAAE,qBAAqB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,oDAAoD;IACpD,KAAK,EAAE,wBAAwB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,EAAE,oDAAoD,CAAC;SAC5D,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C,SAAS,GAAG;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACJ,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,KAAK,CAAC,mBAAmB,CAAC;KAC1B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;gBACpC,OAAO,EACL,iCAAiC,UAAU,gCAAgC,KAAK,KAAK;oBACrF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA+B;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAiB,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAKpF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;KACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,yDAAyD;CACnE,CAAC;KACD,KAAK,CACJ,yCAAyC,EACzC,mGAAmG,CACpG;KACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,wDAAwD;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,yEAAyE;IACzE,UAAU,EAAE,qBAAqB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,oDAAoD;IACpD,KAAK,EAAE,wBAAwB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,EAAE,oDAAoD,CAAC;SAC5D,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C,SAAS,GAAG;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACJ,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,KAAK,CAAC,mBAAmB,CAAC;KAC1B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;gBACpC,OAAO,EACL,iCAAiC,UAAU,gCAAgC,KAAK,KAAK;oBACrF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA+B;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAiB,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAKjE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;KACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,oDAAoD;CAC9D,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IACxC,OAAO,EAAE,qCAAqC;CAC/C,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IACzC,OAAO,EAAE,6CAA6C;CACvD,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IACnD,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAExG,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,uEAAuE;IACvE,KAAK,EAAE,qBAAqB;IAC5B,kEAAkE;IAClE,SAAS,EAAE,qBAAqB;IAChC;;;;;OAKG;IACH,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,mFAAmF;gBACnF,oEAAoE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,iFAAiF;gBACjF,gCAAgC;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,gBAAgB,CAAC;KACvB,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;gBACtB,OAAO,EACL,8BAA8B,KAAK,gCAAgC,KAAK,KAAK;oBAC7E,wDAAwD;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C;;;;;OAKG;IACH,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/verdict/pack-verifiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-verifiers.d.ts","sourceRoot":"","sources":["../../src/verdict/pack-verifiers.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQxE,OAAO,EASL,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAiKvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB5D;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,kBAAkB,EAAE,EACzC,oBAAoB,EAAE,MAAM,GAE1B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoD3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAgCrF;AAsfD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAKxF;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,IAAI,CAS5C"}
+{"version":3,"file":"pack-verifiers.d.ts","sourceRoot":"","sources":["../../src/verdict/pack-verifiers.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQxE,OAAO,EASL,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAiLvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB5D;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,SAAS,kBAAkB,EAAE,EACzC,oBAAoB,EAAE,MAAM,GAE1B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoD3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAgCrF;AAksBD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAKxF;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,IAAI,IAAI,CAS5C"}

package/dist/verdict/pack-verifiers.js

@@ -28,6 +28,20 @@
  * exchange proves only that the witness observed an HTTP exchange —
  * test attribution is suite-claimed, never independently verified.
  *
+ * Both transport contracts accept a SECOND channel (plan 0.9.2 item D):
+ * the OBSERVE channel. ONLY when the engine-browser anchor path comes
+ * back `missing` is a witnessed `http.observed` record stamped
+ * `channel: 'observe'` consulted — carrying the exchanges the witness
+ * proxied for THIS session, minted only for claims the supervisor
+ * registered `observed-e2e`. It grades through the SAME
+ * {@link gradeObservedExchange} matcher, so a normal suite-driven test
+ * mapped `observed-e2e` can discharge the obligation without any second
+ * endpoint resolver. An anchor-path `invalid` is final (I6): an
+ * engine-found error is never masked by a second channel's match.
+ * Admission is trust- AND channel-gated exactly as for persistence
+ * (I3), and `http:frontend-request-observed` still grades blocking
+ * before any of this runs (I1).
+ *
  * Domain namespaces (`auth:*`, `task:*`, `validation:*`, `webhook:*`,
  * `workflow:*`): their approved contract vocabularies are available only
  * through the required-case aggregation. A genuine engine-issued,
@@ -50,6 +64,20 @@ import { registerContractCapabilities, setContractAvailability, registerContract
 /** Record kinds the witness and suites exchange. */
 const UI_ACTION_KIND = 'ui.action';
 const HTTP_REQUEST_KIND = 'http.request';
+/**
+ * Observe-channel transport kind: issued ONLY by the witness's
+ * observe finalize (the declaring session's own proxied exchanges).
+ * Mirrors `HTTP_OBSERVED_KIND` in `@gate-forge/pack-playwright`'s
+ * constants.ts — keep the two in lockstep, exactly as
+ * `OBSERVED_RECORD_KIND` mirrors the witness's `OBSERVED_KIND`.
+ */
+const HTTP_OBSERVED_KIND = 'http.observed';
+/**
+ * Payload discriminant the witness stamps on every observe-finalized
+ * record. Mirrors `OBSERVE_CHANNEL` in `@gate-forge/pack-playwright`
+ * (and `evaluate.ts`'s local constant) — keep the three in lockstep.
+ */
+const OBSERVE_CHANNEL = 'observe';
 /**
  * The only HTTP contracts the verifier knows (plan §7): a namespace
  * registration never implies every operation in it. Any other `http:*`
@@ -470,59 +498,46 @@ function transportInventoryBlock(input) {
     return null;
 }
 /**
- * Grades ONE `http.request` record independently for origin, trust,
- * provenance, payload, route identity, and required status (plan §10
- * step 3). Never returns from the outer verifier; the caller
- * aggregates every grade. All reason wordings are verbatim from the
- * single-record grader.
+ * Grades ONE observed HTTP exchange against the obligation's endpoint
+ * (plan §9/§10): the observed path must be interpretable, the COMPLETE
+ * route inventory must attribute it to EXACTLY the obligation's own
+ * endpoint, and `http:response-status-ok` additionally requires a 2xx.
+ * The single matcher for both the engine-browser (`http.request`) and
+ * the Observe channel (`http.observed`).
  *
  * Args:
- *   record: the lenient record view to grade.
- *   trust: the engine-derived trust tier for the record.
+ *   facts: the exchange's method, url and observed status.
  *   input: the claim plus its obligation (for ids/contract/status rule).
+ *   subject: how the exchange's source is named in reasons — e.g.
+ *     ``witnessed 'http.request' record 'r-1'`` on the anchor path, and
+ *     ``observe-channel exchange in witnessed 'http.observed' record
+ *     'r-1'`` on the Observe path.
  *   inventoryBlock: the precomputed inventory reason, or null when usable.
  *   candidates: the usable route inventory (ignored when inventoryBlock
  *     is set).
  *
  * Returns:
- *   TransportRecordGrade: the independent grade for this record.
+ *   ExchangeGrade: ok only for a uniquely attributed exchange (plus a
+ *   2xx for the status contract).
  */
-function gradeTransportRecord(record, trust, input, inventoryBlock, candidates) {
-    const label = String(record.recordId);
-    if (record.origin !== 'engine-observed') {
-        return {
-            status: 'invalid',
-            reason: `'${input.obligation.id}': suite-submitted network record ` +
-                `'${label}' cannot satisfy an HTTP runtime contract ` +
-                `(${HTTP_OBSERVATION_UNTRUSTED}); only a witness-observed HTTP exchange proves ` +
-                'transport, and test attribution is suite-claimed',
-        };
-    }
-    if (trust !== 'witnessed' || !isProvenancedRecord(record)) {
-        return {
-            status: 'missing',
-            reason: `'${input.obligation.id}': observed requests exist but none carries witnessed ` +
-                'provenance bound to this run',
-        };
-    }
-    const payload = payloadOf(record);
-    if (payload === null || typeof payload['method'] !== 'string' || typeof payload['url'] !== 'string') {
+function gradeObservedExchange(facts, input, subject, inventoryBlock, candidates) {
+    if (typeof facts.method !== 'string' || typeof facts.url !== 'string') {
         return {
+            ok: false,
             status: 'invalid',
-            reason: `'${input.obligation.id}': witnessed '${HTTP_REQUEST_KIND}' record ` +
-                `'${label}' carries no method/url pair`,
+            reason: `'${input.obligation.id}': ${subject} carries no method/url pair`,
         };
     }
     if (inventoryBlock !== null) {
-        return { status: 'missing', reason: inventoryBlock };
+        return { ok: false, status: 'missing', reason: inventoryBlock };
     }
-    const observedMethod = payload['method'];
-    const interpreted = interpretObservedPath(payload['url']);
+    const observedMethod = facts.method;
+    const interpreted = interpretObservedPath(facts.url);
     if (interpreted.ok === false) {
         return {
+            ok: false,
             status: 'invalid',
-            reason: `'${input.obligation.id}': witnessed '${HTTP_REQUEST_KIND}' record ` +
-                `'${label}' carries a noncanonical observed path: ` +
+            reason: `'${input.obligation.id}': ${subject} carries a noncanonical observed path: ` +
                 `${interpreted.reason}`,
         };
     }
@@ -535,19 +550,21 @@ function gradeTransportRecord(record, trust, input, inventoryBlock, candidates)
     const resolution = resolveHttpRoute(observedMethod, interpreted.path, candidates, input.obligation.resourceId);
     if (resolution.status === 'incomplete') {
         return {
+            ok: false,
             status: 'missing',
             reason: `'${input.obligation.id}': ${resolution.reason}`,
         };
     }
     if (resolution.status === 'nomatch') {
         return {
+            ok: false,
             status: 'invalid',
-            reason: `'${input.obligation.id}': witnessed '${HTTP_REQUEST_KIND}' record ` +
-                `'${label}' ${resolution.reason}`,
+            reason: `'${input.obligation.id}': ${subject} ${resolution.reason}`,
         };
     }
     if (resolution.status === 'ambiguous') {
         return {
+            ok: false,
             status: 'invalid',
             reason: `'${input.obligation.id}': ambiguous route attribution: observed ` +
                 `${observedMethod.toUpperCase()} ${interpreted.path} matches ${resolution.candidates.length} ` +
@@ -558,42 +575,87 @@ function gradeTransportRecord(record, trust, input, inventoryBlock, candidates)
     }
     if (resolution.status === 'mismatch') {
         return {
+            ok: false,
             status: 'invalid',
-            reason: `'${input.obligation.id}': witnessed '${HTTP_REQUEST_KIND}' record ` +
-                `'${label}' observed ${observedMethod.toUpperCase()} ` +
+            reason: `'${input.obligation.id}': ${subject} observed ${observedMethod.toUpperCase()} ` +
                 `${interpreted.path} uniquely matches route ${candidateIdentityText(resolution.matched)} ` +
                 `but the obligation requires endpoint '${input.obligation.resourceId}'; evidence from ` +
                 'a different endpoint can never satisfy it',
         };
     }
     if (input.obligation.contract === 'http:response-status-ok') {
-        const status = payload['status'];
+        const status = facts.status;
         if (typeof status !== 'number' || !Number.isInteger(status) || status < 200 || status > 299) {
             return {
+                ok: false,
                 status: 'invalid',
                 reason: `'${input.obligation.id}': observed status ` +
                     `'${String(status)}' is not a 2xx response`,
             };
         }
     }
-    return { status: 'satisfied', recordId: label };
+    return { ok: true };
 }
 /**
- * Grades the explicit transport contracts (`http:request-observed`,
- * `http:response-status-ok`): one shared path, no divergent verifier.
- * Proves only that the witness observed an HTTP exchange in the bound
- * run; test attribution is suite-claimed.
+ * Grades ONE `http.request` record independently for origin, trust,
+ * provenance and payload (plan §10 step 3), then hands its
+ * method/url/status to the shared {@link gradeObservedExchange}. Never
+ * returns from the outer verifier; the caller aggregates every grade.
+ * All reason wordings are verbatim from the single-exchange grader.
  *
- * Deterministic aggregation (plan §10 steps 1-8): the exact contract
- * and the suite anchor are validated once (codepoint-smallest anchor
- * when several qualify); the route inventory is scanned once; then
- * EVERY `http.request` record is graded independently with NO early
- * return on the first bad record. `satisfied > invalid > missing`
- * decides; ≥1 satisfying record selects the codepoint-smallest
- * record id joined with the anchor — identical for every input
- * permutation. Otherwise the codepoint-smallest invalid reason wins,
- * else the smallest missing reason. Untrusted records never satisfy;
- * status-ok still means ≥1 eligible 2xx (no new success rule).
+ * Args:
+ *   record: the lenient record view to grade.
+ *   trust: the engine-derived trust tier for the record.
+ *   input: the claim plus its obligation (for ids/contract/status rule).
+ *   inventoryBlock: the precomputed inventory reason, or null when usable.
+ *   candidates: the usable route inventory (ignored when inventoryBlock
+ *     is set).
+ *
+ * Returns:
+ *   TransportRecordGrade: the independent grade for this record.
+ */
+function gradeTransportRecord(record, trust, input, inventoryBlock, candidates) {
+    const label = String(record.recordId);
+    if (record.origin !== 'engine-observed') {
+        return {
+            status: 'invalid',
+            reason: `'${input.obligation.id}': suite-submitted network record ` +
+                `'${label}' cannot satisfy an HTTP runtime contract ` +
+                `(${HTTP_OBSERVATION_UNTRUSTED}); only a witness-observed HTTP exchange proves ` +
+                'transport, and test attribution is suite-claimed',
+        };
+    }
+    if (trust !== 'witnessed' || !isProvenancedRecord(record)) {
+        return {
+            status: 'missing',
+            reason: `'${input.obligation.id}': observed requests exist but none carries witnessed ` +
+                'provenance bound to this run',
+        };
+    }
+    const payload = payloadOf(record);
+    const subject = `witnessed '${HTTP_REQUEST_KIND}' record '${label}'`;
+    if (payload === null) {
+        return {
+            status: 'invalid',
+            reason: `'${input.obligation.id}': ${subject} carries no method/url pair`,
+        };
+    }
+    const exchange = gradeObservedExchange({ method: payload['method'], url: payload['url'], status: payload['status'] }, input, subject, inventoryBlock, candidates);
+    if (exchange.ok)
+        return { status: 'satisfied', recordId: label };
+    return exchange;
+}
+/**
+ * The ANCHOR channel of the transport grader: the historical rule,
+ * byte-identical. The suite anchor is validated once (codepoint-smallest
+ * anchor when several qualify); the route inventory is scanned once;
+ * then EVERY `http.request` record is graded independently with NO
+ * early return on the first bad record. `satisfied > invalid > missing`
+ * decides; ≥1 satisfying record selects the codepoint-smallest record
+ * id joined with the anchor — identical for every input permutation.
+ * Otherwise the codepoint-smallest invalid reason wins, else the
+ * smallest missing reason. Untrusted records never satisfy; status-ok
+ * still means ≥1 eligible 2xx (no new success rule).
  *
  * Args:
  *   input: the claim plus its attributed evidence and obligation.
@@ -602,7 +664,7 @@ function gradeTransportRecord(record, trust, input, inventoryBlock, candidates)
  *   ClaimOutcome: satisfied only for a witnessed engine-observed
  *   exchange matching the endpoint shape (plus 2xx for status-ok).
  */
-function gradeTransportObservation(input) {
+function gradeAnchoredTransport(input) {
     const anchor = selectTransportAnchor(input);
     if (anchor.ok === false)
         return anchor.outcome;
@@ -643,6 +705,145 @@ function gradeTransportObservation(input) {
     const reason = missingReasons.sort(compareStrings)[0];
     return { status: 'missing', reason };
 }
+/**
+ * The OBSERVE channel of the transport grader: the exchanges the
+ * witness proxied for THIS test session, stamped into one witnessed
+ * `http.observed` record by the observe finalize. Admission mirrors the
+ * persistence Observe channel exactly: `trust === 'witnessed'` AND the
+ * `channel: 'observe'` stamp (both witness-issued, both covered by the
+ * ledger MAC) — a suite-asserted or untrusted `http.observed` record is
+ * admissible NOWHERE. Only obligations the supervisor registered
+ * `observed-e2e` ever carry such a record, so the gate lives in the
+ * witness's declarations, not here.
+ *
+ * Returns null — the channel says NOTHING, so the anchor outcome stands
+ * verbatim — when no record qualifies (the persistence channel's
+ * `observeFailure === null` rule: an absent channel never rewords an
+ * absent anchor).
+ *
+ * Args:
+ *   input: the claim plus its attributed evidence and obligation.
+ *
+ * Returns:
+ *   ClaimOutcome | null: satisfied with the record id carrying a
+ *   matching exchange, the sharpest typed reason otherwise, or null
+ *   when no witnessed Observe-channel record is present at all.
+ */
+function gradeObservedTransport(input) {
+    const records = input.evidence.filter((entry) => entry.trust === 'witnessed' &&
+        typeof entry.record.kind === 'string' &&
+        entry.record.kind === HTTP_OBSERVED_KIND &&
+        payloadOf(entry.record)?.['channel'] === OBSERVE_CHANNEL);
+    if (records.length === 0)
+        return null;
+    const inventoryBlock = transportInventoryBlock(input);
+    const candidates = (input.httpRoutes ?? []);
+    const satisfied = [];
+    const invalidReasons = [];
+    const missingReasons = [];
+    for (const entry of records) {
+        const label = String(entry.record.recordId);
+        const subject = `observe-channel exchange in witnessed '${HTTP_OBSERVED_KIND}' record '${label}'`;
+        const payload = payloadOf(entry.record);
+        const exchanges = payload?.['exchanges'];
+        if (!Array.isArray(exchanges)) {
+            invalidReasons.push(`'${input.obligation.id}': ${subject} carries no exchanges list — the witness records ` +
+                "only the session's own proxied exchanges, and this one names none");
+            continue;
+        }
+        if (exchanges.length === 0) {
+            invalidReasons.push(`'${input.obligation.id}': ${subject} carries an EMPTY exchanges list; a session that ` +
+                'proxied no HTTP exchange gets a typed missing-traffic note instead of a record');
+            continue;
+        }
+        let invalid = null;
+        let missing = null;
+        let matchedHere = false;
+        for (const raw of exchanges) {
+            const facts = typeof raw === 'object' && raw !== null && !Array.isArray(raw)
+                ? { method: raw['method'], url: raw['url'], status: raw['status'] }
+                : { method: undefined, url: undefined, status: undefined };
+            const grade = gradeObservedExchange(facts, input, subject, inventoryBlock, candidates);
+            if (grade.ok) {
+                matchedHere = true;
+                break;
+            }
+            if (grade.status === 'invalid') {
+                if (invalid === null)
+                    invalid = grade.reason;
+            }
+            else if (missing === null) {
+                missing = grade.reason;
+            }
+        }
+        if (matchedHere)
+            satisfied.push(label);
+        else if (invalid !== null)
+            invalidReasons.push(invalid);
+        else if (missing !== null)
+            missingReasons.push(missing);
+    }
+    if (satisfied.length > 0) {
+        // ONE selected id, codepoint-smallest exactly as the anchor path
+        // does: the result never depends on the input order.
+        return {
+            status: 'satisfied',
+            recordIds: [sortedUniqueIds(satisfied)[0]],
+        };
+    }
+    if (invalidReasons.length > 0) {
+        return { status: 'invalid', reason: invalidReasons.sort(compareStrings)[0] };
+    }
+    return { status: 'missing', reason: missingReasons.sort(compareStrings)[0] };
+}
+/**
+ * Grades the explicit transport contracts (`http:request-observed`,
+ * `http:response-status-ok`): ONE matcher, two evidence channels, no
+ * divergent verifier. Proves only that the witness observed an HTTP
+ * exchange in the bound run; test attribution is suite-claimed on both.
+ *
+ * Channel order (plan 0.9.2 item D, invariants I4/I6): the engine
+ * browser anchor path grades FIRST and decides everything:
+ * - satisfied → returned verbatim, with the same record ids;
+ * - invalid → returned verbatim too. An engine-found ERROR (a
+ *   witnessed exchange of a different endpoint, a non-2xx response) is
+ *   FINAL: a second channel's match never masks it. When the engine
+ *   observed the traffic and it was wrong, no other evidence may make
+ *   the claim pass.
+ * - missing → and only then is the Observe channel consulted, which is
+ *   what lets a normal suite-driven test mapped `observed-e2e` discharge
+ *   the same obligation without weakening what the engine path proves.
+ *
+ * When the anchor path is missing and the Observe channel does not
+ * satisfy either, the sharpest reason wins — `invalid > missing`, then
+ * codepoint-smallest — so a witnessed exchange of the wrong endpoint is
+ * never reported as an absent anchor. With no admissible Observe
+ * record the anchor outcome is returned BYTE-IDENTICAL: the channel
+ * that said nothing cannot reword the channel that did.
+ *
+ * Args:
+ *   input: the claim plus its attributed evidence and obligation.
+ *
+ * Returns:
+ *   ClaimOutcome: satisfied only for a witnessed exchange matching the
+ *   endpoint shape (plus 2xx for status-ok), on either channel.
+ */
+function gradeTransportObservation(input) {
+    const anchored = gradeAnchoredTransport(input);
+    if (anchored.status !== 'missing')
+        return anchored;
+    const observed = gradeObservedTransport(input);
+    if (observed === null)
+        return anchored;
+    if (observed.status === 'satisfied')
+        return observed;
+    if (observed.status === 'invalid')
+        return observed;
+    return {
+        status: 'missing',
+        reason: [anchored.reason, observed.reason].sort(compareStrings)[0],
+    };
+}
 /** Grades the HTTP namespace: exact dispatch, frontend fail-closed, shared transport path. */
 function httpVerifier(input) {
     // Exact contract dispatch first (plan §7): an unknown `http:*` name is