@gate-forge/pack-playwright 0.1.0

package/dist/witness/loopback-pins.js

@@ -0,0 +1,244 @@
+/**
+ * Loopback egress binding (GF-10 follow-up): approving a hostname is not
+ * enough — every later connection must STAY on the approved loopback
+ * addresses even if resolution changes mid-run (DNS rebinding). This
+ * module pins operator-attested hostnames to their startup-resolved
+ * loopback IPs and binds all three strict-flow egresses to the pins:
+ *
+ * - the engine Chromium launches with `--host-resolver-rules` mapping
+ *   each attested hostname to its approved IPs (the browser is then
+ *   incapable of leaving loopback for those names);
+ * - witness adapter/probe reads go through `pinnedGet`, which connects
+ *   to the pinned IP while preserving the original Host header (tenant
+ *   routing intact) and port; same-hostname redirects are followed on
+ *   the Location header's actual port with the matching Host header,
+ *   while cross-host and cross-scheme hops reject (never a silent
+ *   re-request of a different destination than the one named);
+ * - the observation-proxy upstream keeps startup resolve-or-reject only
+ *   (that topology is unused by the strict spawned flow; documented).
+ *
+ * Fail-closed throughout: unresolvable/mixed/public resolutions reject
+ * at pin time; https reads against a pinned IP fail on certificate
+ * mismatch (no insecure override exists here); unpinned hostnames keep
+ * the previous plain-fetch behavior.
+ */
+import { lookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+/** Whether one address is loopback (127.0.0.0/8 or ::1). */
+export function isLoopbackAddress(address) {
+    return address === '::1' || /^127(\.\d{1,3}){3}$/.test(address);
+}
+/** Hostname → startup-approved loopback IPs (first resolution wins). */
+const pinnedIps = new Map();
+/** Clears all pins (tests only — production paths pin once and bind). */
+export function clearPinnedLoopbackForTests() {
+    pinnedIps.clear();
+}
+/**
+ * Resolves a hostname and pins ALL-loopback addresses, or rejects.
+ * The first successful pinning wins for the process lifetime: later
+ * resolutions (including hostile mid-run DNS changes) never replace
+ * it — connections bind to the startup-approved set.
+ *
+ * Args:
+ *   hostname: the operator-provided hostname to attest.
+ *   lookupFn: DNS lookup (default: OS resolver, all records).
+ *
+ * Returns:
+ *   The pinned loopback IP list (IPv4 first, then IPv6, stable order).
+ *
+ * Throws:
+ *   Error: on empty/mixed/public/unresolvable answers.
+ */
+export async function pinLoopbackIps(hostname, lookupFn = (host) => lookup(host, { all: true, verbatim: true })) {
+    const existing = pinnedIps.get(hostname);
+    if (existing !== undefined)
+        return [...existing];
+    let records;
+    try {
+        records = await lookupFn(hostname);
+    }
+    catch {
+        throw new Error(`hostname '${hostname}' does not resolve to loopback (lookup failed)`);
+    }
+    if (records.length === 0 || !records.every((record) => isLoopbackAddress(record.address))) {
+        throw new Error(`hostname '${hostname}' does not resolve exclusively to loopback`);
+    }
+    const v4 = records.filter((record) => record.family === 4).map((record) => record.address);
+    const v6 = records.filter((record) => record.family !== 4).map((record) => record.address);
+    const pinned = [...new Set([...v4, ...v6])];
+    pinnedIps.set(hostname, pinned);
+    return [...pinned];
+}
+/**
+ * Snapshot copy of current pins (hostname → approved IPs).
+ *
+ * Returns:
+ *   A detached copy for launch-arg construction.
+ */
+export function pinnedLoopbackIps() {
+    return new Map([...pinnedIps].map(([host, ips]) => [host, [...ips]]));
+}
+/**
+ * Builds the Chromium `--host-resolver-rules` value binding every
+ * pinned hostname to its approved IPs (`MAP host ip`, comma-separated,
+ * deterministic order). IP literals are emitted bare (brackets are URL
+ * syntax and would break rule parsing).
+ *
+ * Args:
+ *   pins: hostname → approved IPs (default: live snapshot).
+ *
+ * Returns:
+ *   The rules string, or null when nothing is pinned (no flag then).
+ */
+export function hostResolverRules(pins = pinnedLoopbackIps()) {
+    const rules = [];
+    for (const host of [...pins.keys()].sort()) {
+        for (const ip of pins.get(host) ?? []) {
+            rules.push(`MAP ${host} ${ip}`);
+        }
+    }
+    return rules.length > 0 ? rules.join(', ') : null;
+}
+/**
+ * GET through the startup pins: when the URL's hostname is pinned, the
+ * TCP connection goes to the pinned IP while the original Host header
+ * (host + non-default port) and path are preserved — tenant routing
+ * intact, destination bound. Unpinned hostnames use plain global fetch
+ * (previous behavior, unchanged).
+ *
+ * Args:
+ *   url: absolute http(s) URL.
+ *   options: timeout, headers, abort signal, redirect budget.
+ *
+ * Returns:
+ *   Status + headers + body readers.
+ *
+ * Throws:
+ *   Error: on transport failure, redirect overflow, or (https) the
+ *   pinned IP failing certificate verification — fail closed, never
+ *   plaintext fallback.
+ */
+export async function pinnedGet(url, options) {
+    const pins = pinnedLoopbackIps();
+    const parsed = new URL(url);
+    const pinned = pins.get(parsed.hostname);
+    if (pinned === undefined || pinned.length === 0) {
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: { accept: 'application/json, text/html', ...options.headers },
+            signal: options.signal,
+            redirect: 'follow',
+        });
+        return {
+            status: response.status,
+            headers: response.headers,
+            json: () => response.json(),
+            text: () => response.text(),
+        };
+    }
+    const ip = preferIpv4(pinned);
+    const port = parsed.port !== '' ? parsed.port : parsed.protocol === 'https:' ? '443' : '80';
+    const hostHeader = isDefaultPort(parsed.protocol, port) ? parsed.hostname : `${parsed.hostname}:${port}`;
+    return requestPinned({
+        protocol: parsed.protocol,
+        ip,
+        port: Number(port),
+        path: `${parsed.pathname}${parsed.search}`,
+        hostHeader,
+        headers: options.headers ?? {},
+        timeoutMs: options.timeoutMs,
+        signal: options.signal,
+        maxRedirects: options.maxRedirects ?? 5,
+    });
+}
+/** Prefers an IPv4 loopback pin, else the first approved IP. */
+function preferIpv4(ips) {
+    return ips.find((ip) => /^127(\.\d{1,3}){3}$/.test(ip)) ?? ips[0];
+}
+/** Whether the port is the protocol default (Host header omits it then). */
+function isDefaultPort(protocol, port) {
+    return (protocol === 'http:' && port === '80') || (protocol === 'https:' && port === '443');
+}
+async function requestPinned(input) {
+    if (input.protocol !== 'http:' && input.protocol !== 'https:') {
+        throw new Error(`pinned egress supports http(s) only (got '${input.protocol}')`);
+    }
+    // eslint-disable-next-line no-await-in-loop -- redirect hops are sequential by construction
+    for (let redirect = 0; redirect <= input.maxRedirects; redirect += 1) {
+        const response = await singleRequest(input);
+        const location = response.headers.get('location');
+        if (response.status >= 300 && response.status < 400 && location !== null) {
+            const next = new URL(location, `${input.protocol}//${input.hostHeader}${input.path}`);
+            // Redirects stay on pinned egress: only same-hostname hops are
+            // followed through the pins; anything else fails closed (the
+            // browser path enforces the same origin rule in captureExchanges).
+            if (next.hostname !== input.hostHeader.split(':')[0]) {
+                throw new Error(`pinned egress refuses cross-host redirect to '${next.hostname}'`);
+            }
+            // Same-host hops follow the Location's ACTUAL origin: protocol,
+            // port, and Host header all update, and the connection stays bound
+            // to the pinned IP. Re-requesting the previous origin (old port)
+            // with the new path — or silently trusting the header while
+            // keeping the old transport — would read a different destination
+            // than the one the service named. A scheme change is rejected
+            // outright: https against the pinned loopback IP can never verify
+            // a certificate here, so it fails closed with the precise cause.
+            if (next.protocol !== input.protocol) {
+                throw new Error(`pinned egress refuses cross-scheme redirect (${input.protocol} → ${next.protocol} '${location}')`);
+            }
+            const port = next.port !== '' ? next.port : next.protocol === 'https:' ? '443' : '80';
+            input = {
+                ...input,
+                port: Number(port),
+                path: `${next.pathname}${next.search}`,
+                hostHeader: isDefaultPort(next.protocol, port) ? next.hostname : `${next.hostname}:${port}`,
+            };
+            continue;
+        }
+        return response;
+    }
+    throw new Error('pinned egress exceeded redirect budget');
+}
+function singleRequest(input) {
+    return new Promise((resolve, reject) => {
+        const requestFn = input.protocol === 'https:' ? httpsRequest : httpRequest;
+        const request = requestFn({
+            hostname: input.ip,
+            port: input.port,
+            path: input.path,
+            method: 'GET',
+            headers: { accept: 'application/json, text/html', ...input.headers, host: input.hostHeader },
+            timeout: input.timeoutMs,
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => chunks.push(chunk));
+            response.on('end', () => {
+                const body = Buffer.concat(chunks);
+                const headers = new Headers();
+                for (const [name, value] of Object.entries(response.headersDistinct ?? {})) {
+                    const values = Array.isArray(value) ? value : [value ?? ''];
+                    for (const item of values)
+                        headers.append(name, item);
+                }
+                resolve({
+                    status: response.statusCode ?? 0,
+                    headers,
+                    json: () => Promise.resolve(JSON.parse(body.toString('utf8'))),
+                    text: () => Promise.resolve(body.toString('utf8')),
+                });
+            });
+        });
+        request.on('timeout', () => request.destroy(new Error('pinned egress timed out')));
+        if (input.signal !== undefined) {
+            if (input.signal.aborted)
+                request.destroy(new Error('pinned egress aborted'));
+            else
+                input.signal.addEventListener('abort', () => request.destroy(new Error('pinned egress aborted')), { once: true });
+        }
+        request.on('error', reject);
+        request.end();
+    });
+}
+//# sourceMappingURL=loopback-pins.js.map

package/dist/witness/loopback-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-pins.js","sourceRoot":"","sources":["../../src/witness/loopback-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAOrD,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,KAAK,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE9C,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,WAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE9E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,IAAI,OAA2D,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,gDAAgD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAuB,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+C,iBAAiB,EAAE;IAClG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAUD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAKC;IAED,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YACtE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAsB;YAC/C,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;IACzG,OAAO,aAAa,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;QAC1C,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAK,GAAG,CAAC,CAAC,CAAY,CAAC;AAChF,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAU5B;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,4FAA4F;IAC5F,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,+DAA+D;YAC/D,6DAA6D;YAC7D,mEAAmE;YACnE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrF,CAAC;YACD,gEAAgE;YAChE,mEAAmE;YACnE,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,8DAA8D;YAC9D,kEAAkE;YAClE,iEAAiE;YACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CACnG,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,KAAK,GAAG;gBACN,GAAG,KAAK;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE;gBACtC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;aAC5F,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,KAStB;IACC,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3E,MAAM,OAAO,GAAG,SAAS,CACvB;YACE,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;YAC5F,OAAO,EAAE,KAAK,CAAC,SAAS;SACzB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC5D,KAAK,MAAM,IAAI,IAAI,MAAM;wBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,CAAC;oBACN,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBAChC,OAAO;oBACP,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;oBACzE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;;gBACzE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/witness/server.d.ts

@@ -0,0 +1,34 @@
+import { recordIdOf } from '@gate-forge/core';
+import type { WitnessHandle, WitnessOptions } from './types.js';
+/** Fail-closed witness configuration/startup error. */
+export declare class WitnessStartupError extends Error {
+    constructor(message: string);
+}
+/**
+ * The service-issued recordId comes from the frozen core primitive
+ * (`recordIdOf`, pin #1/#7): sha256 over GF-canonical JSON of the record
+ * identity. Sharing one implementation with the engine's provenance
+ * verifier guarantees the witness issues exactly what evaluation can
+ * recompute — an entry that never passed through the service has no
+ * matching hash, so shape-level fabrication (a hex string the service
+ * never issued) cannot line up with the ledger the reporter copies.
+ */
+export { recordIdOf };
+/**
+ * Starts the witness service.
+ *
+ * Args:
+ *   options: run identity + token (required), state dir, adapters dir,
+ *     classifications path, target/attestation config, timeout, clock.
+ *
+ * Returns:
+ *   WitnessHandle: {url, stop} once the server listens.
+ *
+ * Throws:
+ *   WitnessStartupError / AdapterRegistryError / AttestationError:
+ *     fail-closed startup problems (GF-10 blocks non-loopback targets
+ *     HERE, before any adapter request can be constructed).
+ */
+export declare function startWitness(options: WitnessOptions): Promise<WitnessHandle>;
+export type { WitnessHandle } from './types.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/witness/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/witness/server.ts"],"names":[],"mappings":"AAoHA,OAAO,EAIL,UAAU,EAIX,MAAM,kBAAkB,CAAC;AA+B1B,OAAO,KAAK,EA0BV,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAgCpB,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAuUD;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,CAAC;AA6BtB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAqJlF;AAo3ED,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}