@gate-forge/pack-playwright 0.7.1 → 0.8.0

package/dist/witness/fixture-provider.js

@@ -1,109 +1,10 @@
 /**
- * Trusted fixture/actor provider (plan 2026-09-19 §4.5): the ONLY source
- * of fixture namespaces, authoritative subject identities, and actor
- * credentials for strong behavior cases. Loaded ONLY from the approved
- * engine-owned bundle — never from suite-supplied callbacks, never from
- * `AdapterContext.get` or `probeServer`.
+ * Compatibility re-export: `witness/fixture-provider` now lives in the runner-neutral
+ * `@gate-forge/witness` package (plan 2026-09-25 phase 1).
  *
- * - `prepare` mints a fresh isolated lease per case (unique namespace);
- *   sequence steps share only their own case lease.
- * - Actor material resolves privately inside the controller/engine
- *   request driver. Cookie/header bytes never appear in suite-visible
- *   results, signed public reports, argv, or logs — the lease carries a
- *   `credentialRef` (an engine-side handle), never token bytes.
- * - `release` cleans the lease namespace; cleanup runs on errors without
- *   flipping the case verdict to success.
+ * The move is physical, not behavioural: this module forwards every
+ * export unchanged so `@gate-forge/pack-playwright`'s published import
+ * paths — which consumers pin — keep resolving to the same values.
  */
-import { randomUUID } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-/**
- * Loads the approved fixture provider from the engine-owned bundle
- * directory (a `fixture-provider.mjs` default export implementing the
- * interface). Returns null when the bundle provides none — strong cases
- * then block with a missing-provider cause instead of falling back to
- * suite-supplied fixtures.
- *
- * Args:
- *   bundleDir: absolute engine-owned bundle directory, or null.
- *
- * Returns:
- *   Promise<FixtureProvider | null>: the approved provider or null.
- *
- * Throws:
- *   Error: when the module exists but does not implement the interface
- *   (fail closed — a half-shaped provider is never used).
- */
-export async function loadFixtureProvider(bundleDir) {
-    if (bundleDir === null)
-        return null;
-    const entry = join(bundleDir, 'fixture-provider.mjs');
-    if (!existsSync(entry))
-        return null;
-    const module = (await import(pathToFileURL(entry).href));
-    const provider = module.default;
-    if (provider === undefined ||
-        typeof provider.prepare !== 'function' ||
-        typeof provider.release !== 'function') {
-        throw new Error('approved fixture provider is malformed: default export must implement {prepare, release} (fail closed)');
-    }
-    return provider;
-}
-/** In-memory provider for witness tests (engine-side only, never a worker API). */
-export function createMemoryFixtureProvider(options = {}) {
-    const live = new Map();
-    let counter = 0;
-    const actors = options.actors ?? {};
-    const credentials = options.credentials ?? {};
-    const subjects = options.subjects ?? {};
-    const credentialFor = (credentialRef) => {
-        const match = /^credref:([^:]+):(.+)$/.exec(credentialRef);
-        if (match === null)
-            return null;
-        const profile = match[2];
-        if (!live.has(match[1]))
-            return null;
-        const headers = credentials[profile];
-        if (headers === undefined)
-            return null;
-        return { headers: { ...headers } };
-    };
-    return {
-        prepare(input) {
-            counter += 1;
-            const leaseId = randomUUID();
-            const namespace = `fixture-${input.runId}-${input.caseId}-${String(counter)}`
-                .toLowerCase()
-                .replace(/[^a-z0-9-]/g, '-');
-            const leasedActors = {};
-            for (const [name, template] of Object.entries(actors)) {
-                leasedActors[name] = {
-                    principalId: template.principalId,
-                    tenantId: template.tenantId,
-                    roles: [...template.roles],
-                    credentialRef: `credref:${leaseId}:${name}`,
-                };
-            }
-            const recipeSubjects = subjects[input.recipe];
-            const lease = {
-                leaseId,
-                namespace,
-                subjects: recipeSubjects === undefined ? {} : JSON.parse(JSON.stringify(recipeSubjects)),
-                actors: leasedActors,
-            };
-            live.set(leaseId, lease);
-            return lease;
-        },
-        release(leaseId) {
-            live.delete(leaseId);
-        },
-        resolveCredential(credentialRef) {
-            return credentialFor(credentialRef);
-        },
-        leases() {
-            return [...live.values()];
-        },
-    };
-}
+export * from '@gate-forge/witness/witness/fixture-provider';
 //# sourceMappingURL=fixture-provider.js.map

package/dist/witness/fixture-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"fixture-provider.js","sourceRoot":"","sources":["../../src/witness/fixture-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA2DzC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAwB;IAChE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAA0B,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAA+C,CAAC;IACxE,IACE,QAAQ,KAAK,SAAS;QACtB,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;QACtC,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,QAA2B,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,UAOxC,EAAE;IACJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,aAAqB,EAA6B,EAAE;QACzE,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IACrC,CAAC,CAAC;IACF,OAAO;QACL,OAAO,CAAC,KAA0B;YAChC,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,WAAW,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE;iBAC1E,WAAW,EAAE;iBACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAC/B,MAAM,YAAY,GAA+B,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,YAAY,CAAC,IAAI,CAAC,GAAG;oBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;oBAC1B,aAAa,EAAE,WAAW,OAAO,IAAI,IAAI,EAAE;iBAC5C,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAiB;gBAC1B,OAAO;gBACP,SAAS;gBACT,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAA4B;gBACnH,MAAM,EAAE,YAAY;aACrB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,OAAe;YACrB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,iBAAiB,CAAC,aAAqB;YACrC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QACD,MAAM;YACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fixture-provider.js","sourceRoot":"","sources":["../../src/witness/fixture-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,8CAA8C,CAAC"}

package/dist/witness/loopback-pins.d.ts

@@ -1,79 +1,10 @@
-/** DNS lookup signature (injectable for tests; default: OS resolver). */
-export type PinDnsLookup = (host: string) => Promise<ReadonlyArray<{
-    address: string;
-    family: number;
-}>>;
-/** Whether one address is loopback (127.0.0.0/8 or ::1). */
-export declare function isLoopbackAddress(address: string): boolean;
-/** Clears all pins (tests only — production paths pin once and bind). */
-export declare function clearPinnedLoopbackForTests(): void;
 /**
- * Resolves a hostname and pins ALL-loopback addresses, or rejects.
- * The first successful pinning wins for the process lifetime: later
- * resolutions (including hostile mid-run DNS changes) never replace
- * it — connections bind to the startup-approved set.
+ * Compatibility re-export: `witness/loopback-pins` now lives in the runner-neutral
+ * `@gate-forge/witness` package (plan 2026-09-25 phase 1).
  *
- * Args:
- *   hostname: the operator-provided hostname to attest.
- *   lookupFn: DNS lookup (default: OS resolver, all records).
- *
- * Returns:
- *   The pinned loopback IP list (IPv4 first, then IPv6, stable order).
- *
- * Throws:
- *   Error: on empty/mixed/public/unresolvable answers.
- */
-export declare function pinLoopbackIps(hostname: string, lookupFn?: PinDnsLookup): Promise<string[]>;
-/**
- * Snapshot copy of current pins (hostname → approved IPs).
- *
- * Returns:
- *   A detached copy for launch-arg construction.
- */
-export declare function pinnedLoopbackIps(): Map<string, string[]>;
-/**
- * Builds the Chromium `--host-resolver-rules` value binding every
- * pinned hostname to its approved IPs (`MAP host ip`, comma-separated,
- * deterministic order). IP literals are emitted bare (brackets are URL
- * syntax and would break rule parsing).
- *
- * Args:
- *   pins: hostname → approved IPs (default: live snapshot).
- *
- * Returns:
- *   The rules string, or null when nothing is pinned (no flag then).
- */
-export declare function hostResolverRules(pins?: ReadonlyMap<string, readonly string[]>): string | null;
-/** Pinned GET result (fetch-compatible subset used by adapter/probe reads). */
-export interface PinnedGetResult {
-    status: number;
-    headers: Headers;
-    json(): Promise<unknown>;
-    text(): Promise<string>;
-}
-/**
- * GET through the startup pins: when the URL's hostname is pinned, the
- * TCP connection goes to the pinned IP while the original Host header
- * (host + non-default port) and path are preserved — tenant routing
- * intact, destination bound. Unpinned hostnames use plain global fetch
- * (previous behavior, unchanged).
- *
- * Args:
- *   url: absolute http(s) URL.
- *   options: timeout, headers, abort signal, redirect budget.
- *
- * Returns:
- *   Status + headers + body readers.
- *
- * Throws:
- *   Error: on transport failure, redirect overflow, or (https) the
- *   pinned IP failing certificate verification — fail closed, never
- *   plaintext fallback.
+ * The move is physical, not behavioural: this module forwards every
+ * export unchanged so `@gate-forge/pack-playwright`'s published import
+ * paths — which consumers pin — keep resolving to the same values.
  */
-export declare function pinnedGet(url: string, options: {
-    timeoutMs: number;
-    headers?: Record<string, string>;
-    signal?: AbortSignal;
-    maxRedirects?: number;
-}): Promise<PinnedGetResult>;
+export * from '@gate-forge/witness/witness/loopback-pins';
 //# sourceMappingURL=loopback-pins.d.ts.map

package/dist/witness/loopback-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-pins.d.ts","sourceRoot":"","sources":["../../src/witness/loopback-pins.ts"],"names":[],"mappings":"AA4BA,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAEjE,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAKD,yEAAyE;AACzE,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,YAAoE,GAC7E,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAEzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAuB,GAAG,MAAM,GAAG,IAAI,CAQnH;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,eAAe,CAAC,CAgC1B"}
+{"version":3,"file":"loopback-pins.d.ts","sourceRoot":"","sources":["../../src/witness/loopback-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,2CAA2C,CAAC"}

package/dist/witness/loopback-pins.js

@@ -1,244 +1,10 @@
 /**
- * Loopback egress binding (GF-10 follow-up): approving a hostname is not
- * enough — every later connection must STAY on the approved loopback
- * addresses even if resolution changes mid-run (DNS rebinding). This
- * module pins operator-attested hostnames to their startup-resolved
- * loopback IPs and binds all three strict-flow egresses to the pins:
+ * Compatibility re-export: `witness/loopback-pins` now lives in the runner-neutral
+ * `@gate-forge/witness` package (plan 2026-09-25 phase 1).
  *
- * - the engine Chromium launches with `--host-resolver-rules` mapping
- *   each attested hostname to its approved IPs (the browser is then
- *   incapable of leaving loopback for those names);
- * - witness adapter/probe reads go through `pinnedGet`, which connects
- *   to the pinned IP while preserving the original Host header (tenant
- *   routing intact) and port; same-hostname redirects are followed on
- *   the Location header's actual port with the matching Host header,
- *   while cross-host and cross-scheme hops reject (never a silent
- *   re-request of a different destination than the one named);
- * - the observation-proxy upstream keeps startup resolve-or-reject only
- *   (that topology is unused by the strict spawned flow; documented).
- *
- * Fail-closed throughout: unresolvable/mixed/public resolutions reject
- * at pin time; https reads against a pinned IP fail on certificate
- * mismatch (no insecure override exists here); unpinned hostnames keep
- * the previous plain-fetch behavior.
- */
-import { lookup } from 'node:dns/promises';
-import { request as httpRequest } from 'node:http';
-import { request as httpsRequest } from 'node:https';
-/** Whether one address is loopback (127.0.0.0/8 or ::1). */
-export function isLoopbackAddress(address) {
-    return address === '::1' || /^127(\.\d{1,3}){3}$/.test(address);
-}
-/** Hostname → startup-approved loopback IPs (first resolution wins). */
-const pinnedIps = new Map();
-/** Clears all pins (tests only — production paths pin once and bind). */
-export function clearPinnedLoopbackForTests() {
-    pinnedIps.clear();
-}
-/**
- * Resolves a hostname and pins ALL-loopback addresses, or rejects.
- * The first successful pinning wins for the process lifetime: later
- * resolutions (including hostile mid-run DNS changes) never replace
- * it — connections bind to the startup-approved set.
- *
- * Args:
- *   hostname: the operator-provided hostname to attest.
- *   lookupFn: DNS lookup (default: OS resolver, all records).
- *
- * Returns:
- *   The pinned loopback IP list (IPv4 first, then IPv6, stable order).
- *
- * Throws:
- *   Error: on empty/mixed/public/unresolvable answers.
- */
-export async function pinLoopbackIps(hostname, lookupFn = (host) => lookup(host, { all: true, verbatim: true })) {
-    const existing = pinnedIps.get(hostname);
-    if (existing !== undefined)
-        return [...existing];
-    let records;
-    try {
-        records = await lookupFn(hostname);
-    }
-    catch {
-        throw new Error(`hostname '${hostname}' does not resolve to loopback (lookup failed)`);
-    }
-    if (records.length === 0 || !records.every((record) => isLoopbackAddress(record.address))) {
-        throw new Error(`hostname '${hostname}' does not resolve exclusively to loopback`);
-    }
-    const v4 = records.filter((record) => record.family === 4).map((record) => record.address);
-    const v6 = records.filter((record) => record.family !== 4).map((record) => record.address);
-    const pinned = [...new Set([...v4, ...v6])];
-    pinnedIps.set(hostname, pinned);
-    return [...pinned];
-}
-/**
- * Snapshot copy of current pins (hostname → approved IPs).
- *
- * Returns:
- *   A detached copy for launch-arg construction.
- */
-export function pinnedLoopbackIps() {
-    return new Map([...pinnedIps].map(([host, ips]) => [host, [...ips]]));
-}
-/**
- * Builds the Chromium `--host-resolver-rules` value binding every
- * pinned hostname to its approved IPs (`MAP host ip`, comma-separated,
- * deterministic order). IP literals are emitted bare (brackets are URL
- * syntax and would break rule parsing).
- *
- * Args:
- *   pins: hostname → approved IPs (default: live snapshot).
- *
- * Returns:
- *   The rules string, or null when nothing is pinned (no flag then).
- */
-export function hostResolverRules(pins = pinnedLoopbackIps()) {
-    const rules = [];
-    for (const host of [...pins.keys()].sort()) {
-        for (const ip of pins.get(host) ?? []) {
-            rules.push(`MAP ${host} ${ip}`);
-        }
-    }
-    return rules.length > 0 ? rules.join(', ') : null;
-}
-/**
- * GET through the startup pins: when the URL's hostname is pinned, the
- * TCP connection goes to the pinned IP while the original Host header
- * (host + non-default port) and path are preserved — tenant routing
- * intact, destination bound. Unpinned hostnames use plain global fetch
- * (previous behavior, unchanged).
- *
- * Args:
- *   url: absolute http(s) URL.
- *   options: timeout, headers, abort signal, redirect budget.
- *
- * Returns:
- *   Status + headers + body readers.
- *
- * Throws:
- *   Error: on transport failure, redirect overflow, or (https) the
- *   pinned IP failing certificate verification — fail closed, never
- *   plaintext fallback.
+ * The move is physical, not behavioural: this module forwards every
+ * export unchanged so `@gate-forge/pack-playwright`'s published import
+ * paths — which consumers pin — keep resolving to the same values.
  */
-export async function pinnedGet(url, options) {
-    const pins = pinnedLoopbackIps();
-    const parsed = new URL(url);
-    const pinned = pins.get(parsed.hostname);
-    if (pinned === undefined || pinned.length === 0) {
-        const response = await fetch(url, {
-            method: 'GET',
-            headers: { accept: 'application/json, text/html', ...options.headers },
-            signal: options.signal,
-            redirect: 'follow',
-        });
-        return {
-            status: response.status,
-            headers: response.headers,
-            json: () => response.json(),
-            text: () => response.text(),
-        };
-    }
-    const ip = preferIpv4(pinned);
-    const port = parsed.port !== '' ? parsed.port : parsed.protocol === 'https:' ? '443' : '80';
-    const hostHeader = isDefaultPort(parsed.protocol, port) ? parsed.hostname : `${parsed.hostname}:${port}`;
-    return requestPinned({
-        protocol: parsed.protocol,
-        ip,
-        port: Number(port),
-        path: `${parsed.pathname}${parsed.search}`,
-        hostHeader,
-        headers: options.headers ?? {},
-        timeoutMs: options.timeoutMs,
-        signal: options.signal,
-        maxRedirects: options.maxRedirects ?? 5,
-    });
-}
-/** Prefers an IPv4 loopback pin, else the first approved IP. */
-function preferIpv4(ips) {
-    return ips.find((ip) => /^127(\.\d{1,3}){3}$/.test(ip)) ?? ips[0];
-}
-/** Whether the port is the protocol default (Host header omits it then). */
-function isDefaultPort(protocol, port) {
-    return (protocol === 'http:' && port === '80') || (protocol === 'https:' && port === '443');
-}
-async function requestPinned(input) {
-    if (input.protocol !== 'http:' && input.protocol !== 'https:') {
-        throw new Error(`pinned egress supports http(s) only (got '${input.protocol}')`);
-    }
-    // eslint-disable-next-line no-await-in-loop -- redirect hops are sequential by construction
-    for (let redirect = 0; redirect <= input.maxRedirects; redirect += 1) {
-        const response = await singleRequest(input);
-        const location = response.headers.get('location');
-        if (response.status >= 300 && response.status < 400 && location !== null) {
-            const next = new URL(location, `${input.protocol}//${input.hostHeader}${input.path}`);
-            // Redirects stay on pinned egress: only same-hostname hops are
-            // followed through the pins; anything else fails closed (the
-            // browser path enforces the same origin rule in captureExchanges).
-            if (next.hostname !== input.hostHeader.split(':')[0]) {
-                throw new Error(`pinned egress refuses cross-host redirect to '${next.hostname}'`);
-            }
-            // Same-host hops follow the Location's ACTUAL origin: protocol,
-            // port, and Host header all update, and the connection stays bound
-            // to the pinned IP. Re-requesting the previous origin (old port)
-            // with the new path — or silently trusting the header while
-            // keeping the old transport — would read a different destination
-            // than the one the service named. A scheme change is rejected
-            // outright: https against the pinned loopback IP can never verify
-            // a certificate here, so it fails closed with the precise cause.
-            if (next.protocol !== input.protocol) {
-                throw new Error(`pinned egress refuses cross-scheme redirect (${input.protocol} → ${next.protocol} '${location}')`);
-            }
-            const port = next.port !== '' ? next.port : next.protocol === 'https:' ? '443' : '80';
-            input = {
-                ...input,
-                port: Number(port),
-                path: `${next.pathname}${next.search}`,
-                hostHeader: isDefaultPort(next.protocol, port) ? next.hostname : `${next.hostname}:${port}`,
-            };
-            continue;
-        }
-        return response;
-    }
-    throw new Error('pinned egress exceeded redirect budget');
-}
-function singleRequest(input) {
-    return new Promise((resolve, reject) => {
-        const requestFn = input.protocol === 'https:' ? httpsRequest : httpRequest;
-        const request = requestFn({
-            hostname: input.ip,
-            port: input.port,
-            path: input.path,
-            method: 'GET',
-            headers: { accept: 'application/json, text/html', ...input.headers, host: input.hostHeader },
-            timeout: input.timeoutMs,
-        }, (response) => {
-            const chunks = [];
-            response.on('data', (chunk) => chunks.push(chunk));
-            response.on('end', () => {
-                const body = Buffer.concat(chunks);
-                const headers = new Headers();
-                for (const [name, value] of Object.entries(response.headersDistinct ?? {})) {
-                    const values = Array.isArray(value) ? value : [value ?? ''];
-                    for (const item of values)
-                        headers.append(name, item);
-                }
-                resolve({
-                    status: response.statusCode ?? 0,
-                    headers,
-                    json: () => Promise.resolve(JSON.parse(body.toString('utf8'))),
-                    text: () => Promise.resolve(body.toString('utf8')),
-                });
-            });
-        });
-        request.on('timeout', () => request.destroy(new Error('pinned egress timed out')));
-        if (input.signal !== undefined) {
-            if (input.signal.aborted)
-                request.destroy(new Error('pinned egress aborted'));
-            else
-                input.signal.addEventListener('abort', () => request.destroy(new Error('pinned egress aborted')), { once: true });
-        }
-        request.on('error', reject);
-        request.end();
-    });
-}
+export * from '@gate-forge/witness/witness/loopback-pins';
 //# sourceMappingURL=loopback-pins.js.map

package/dist/witness/loopback-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-pins.js","sourceRoot":"","sources":["../../src/witness/loopback-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAOrD,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,KAAK,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE9C,yEAAyE;AACzE,MAAM,UAAU,2BAA2B;IACzC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,WAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE9E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,IAAI,OAA2D,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,gDAAgD,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAuB,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+C,iBAAiB,EAAE;IAClG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAUD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAKC;IAED,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YACtE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAsB;YAC/C,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;IACzG,OAAO,aAAa,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE;QACF,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;QAC1C,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAK,GAAG,CAAC,CAAC,CAAY,CAAC;AAChF,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAU5B;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,4FAA4F;IAC5F,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,+DAA+D;YAC/D,6DAA6D;YAC7D,mEAAmE;YACnE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrF,CAAC;YACD,gEAAgE;YAChE,mEAAmE;YACnE,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,8DAA8D;YAC9D,kEAAkE;YAClE,iEAAiE;YACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CACnG,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,KAAK,GAAG;gBACN,GAAG,KAAK;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE;gBACtC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;aAC5F,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,KAStB;IACC,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3E,MAAM,OAAO,GAAG,SAAS,CACvB;YACE,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;YAC5F,OAAO,EAAE,KAAK,CAAC,SAAS;SACzB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBAC5D,KAAK,MAAM,IAAI,IAAI,MAAM;wBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,CAAC;oBACN,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBAChC,OAAO;oBACP,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;oBACzE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBACnD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;;gBACzE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"loopback-pins.js","sourceRoot":"","sources":["../../src/witness/loopback-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,2CAA2C,CAAC"}

package/dist/witness/server.d.ts

@@ -1,34 +1,16 @@
-import { recordIdOf } from '@gate-forge/core';
-import type { WitnessHandle, WitnessOptions } from './types.js';
-/** Fail-closed witness configuration/startup error. */
-export declare class WitnessStartupError extends Error {
-    constructor(message: string);
-}
+import { type WitnessHandle } from '@gate-forge/witness/witness/server';
+import type { WitnessOptions } from '@gate-forge/witness/witness/types';
+export * from '@gate-forge/witness/witness/server';
 /**
- * The service-issued recordId comes from the frozen core primitive
- * (`recordIdOf`, pin #1/#7): sha256 over GF-canonical JSON of the record
- * identity. Sharing one implementation with the engine's provenance
- * verifier guarantees the witness issues exactly what evaluation can
- * recompute — an entry that never passed through the service has no
- * matching hash, so shape-level fabrication (a hex string the service
- * never issued) cannot line up with the ledger the reporter copies.
- */
-export { recordIdOf };
-/**
- * Starts the witness service.
+ * Starts the loopback witness with the engine browser defaulted to
+ * pinned Chromium.
  *
  * Args:
- *   options: run identity + token (required), state dir, adapters dir,
- *     classifications path, target/attestation config, timeout, clock.
+ *   options: witness options; `engineBrowserLauncher` defaults to
+ *     Playwright's `chromium` when absent.
  *
  * Returns:
- *   WitnessHandle: {url, stop} once the server listens.
- *
- * Throws:
- *   WitnessStartupError / AdapterRegistryError / AttestationError:
- *     fail-closed startup problems (GF-10 blocks non-loopback targets
- *     HERE, before any adapter request can be constructed).
+ *   Promise<WitnessHandle>: the running witness handle.
  */
 export declare function startWitness(options: WitnessOptions): Promise<WitnessHandle>;
-export type { WitnessHandle } from './types.js';
 //# sourceMappingURL=server.d.ts.map

package/dist/witness/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/witness/server.ts"],"names":[],"mappings":"AA+HA,OAAO,EASL,UAAU,EAOX,MAAM,kBAAkB,CAAC;AAgC1B,OAAO,KAAK,EAuCV,aAAa,EACb,cAAc,EACf,MAAM,YAAY,CAAC;AAyDpB,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA6aD;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,CAAC;AA6BtB;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyJlF;AAwuHD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/witness/server.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,cAAc,oCAAoC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAK5E"}