@groundnuty/macf-core 0.2.54 → 0.2.56

package/dist/certs/ca.d.ts

@@ -100,4 +100,19 @@ export declare function isLikelyPemPrivateKey(text: string): boolean;
  * Load CA cert and key from disk.
  */
 export declare function loadCA(certPath: string, keyPath: string): CaKeyPair;
+/**
+ * SHA-256 fingerprint (lowercase hex) of a PEM-encoded certificate's DER
+ * bytes. Deterministic + parse-free (no x509 library round-trip needed) —
+ * good enough to answer "is this the SAME CA cert" without asserting
+ * anything about the cert's structure.
+ *
+ * Purpose-built for macf#800 (DR-010 amendment / silent-fallback-hazards.md
+ * Instance 16): a CA rotation orphans out-of-band artifacts (e.g. the
+ * routing-client cert deployed as a GitHub Actions secret) that this tool
+ * cannot reach to re-sign. Recording this fingerprint at mint time and
+ * diffing it against the CURRENT CA's fingerprint later (`macf routing
+ * doctor`) detects the orphan without ever reading the write-only deployed
+ * secret itself.
+ */
+export declare function caCertFingerprint(certPem: string): string;
 //# sourceMappingURL=ca.d.ts.map

package/dist/certs/ca.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/certs/ca.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,qBAAa,OAAQ,SAAQ,SAAS;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAsBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC,GAAG,OAAO,CAAC,SAAS,CAAC,CA6CrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAMD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,eAAe,SAAS,CAAC;AACtC,eAAO,MAAM,eAAe,QAAQ,CAAC;AAoFrC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAyBvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAYnE"}
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/certs/ca.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,qBAAa,OAAQ,SAAQ,SAAS;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAsBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC,GAAG,OAAO,CAAC,SAAS,CAAC,CA6CrB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAMD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,eAAe,SAAS,CAAC;AACtC,eAAO,MAAM,eAAe,QAAQ,CAAC;AAoFrC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAyBvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAYnE;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/certs/ca.js

@@ -1,4 +1,4 @@
-import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, pbkdf2Sync, } from 'node:crypto';
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { x509, webcrypto, RSA_ALGORITHM, CA_CERT_VALIDITY_YEARS, } from './crypto-provider.js';
@@ -303,4 +303,34 @@ export function loadCA(certPath, keyPath) {
         keyPem: readFileSync(keyPath, 'utf-8'),
     };
 }
+/**
+ * Strip PEM armor + whitespace and base64-decode to the raw DER bytes.
+ * Shared by {@link caCertFingerprint}; hashing the DER (not the PEM text)
+ * means cosmetic differences — line wrapping, trailing newline, CRLF vs
+ * LF — never produce a false fingerprint mismatch.
+ */
+function pemToDer(pem) {
+    const body = pem
+        .replace(/-----BEGIN CERTIFICATE-----/g, '')
+        .replace(/-----END CERTIFICATE-----/g, '')
+        .replace(/\s+/g, '');
+    return Buffer.from(body, 'base64');
+}
+/**
+ * SHA-256 fingerprint (lowercase hex) of a PEM-encoded certificate's DER
+ * bytes. Deterministic + parse-free (no x509 library round-trip needed) —
+ * good enough to answer "is this the SAME CA cert" without asserting
+ * anything about the cert's structure.
+ *
+ * Purpose-built for macf#800 (DR-010 amendment / silent-fallback-hazards.md
+ * Instance 16): a CA rotation orphans out-of-band artifacts (e.g. the
+ * routing-client cert deployed as a GitHub Actions secret) that this tool
+ * cannot reach to re-sign. Recording this fingerprint at mint time and
+ * diffing it against the CURRENT CA's fingerprint later (`macf routing
+ * doctor`) detects the orphan without ever reading the write-only deployed
+ * secret itself.
+ */
+export function caCertFingerprint(certPem) {
+    return createHash('sha256').update(pemToDer(certPem)).digest('hex');
+}
 //# sourceMappingURL=ca.js.map

package/dist/certs/ca.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/certs/ca.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,GAC1D,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,GACvD,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,SAAS;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF;AAOD,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,QAAqB;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAK9B;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAC7C,aAAa,EACb,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,sBAAsB,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC;QAChE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,MAAM,OAAO,KAAK;QACxB,SAAS;QACT,QAAQ;QACR,gBAAgB,EAAE,aAAa;QAC/B,IAAI;QACJ,UAAU,EAAE;YACV,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC;YACjD,IAAI,IAAI,CAAC,kBAAkB,CACzB,IAAI,CAAC,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAC3D,IAAI,CACL;SACF;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,eAAe;IACf,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,6CAA6C;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAKjC;IACC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACxE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAKlC;IACC,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE1D,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,mEAAmE;AACnE,uEAAuE;AACvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,8DAA8D;AAC9D,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,iEAAiE;AACjE,gEAAgE;AAChE,8BAA8B;AAC9B,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAQrC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAAqB,EAAE,UAAkB,EAAE,KAAa;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAElD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,qDAAqD;QACrD,MAAM,IAAI,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,IAAI,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,UAAkB;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,IAAI;QACJ,SAAS;KACV,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAe;QAC3B,CAAC,EAAE,mBAAwB;QAC3B,IAAI,EAAE,eAAe;QACrB,OAAO;KACR,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,YAAY,CAAC,cAAsB,EAAE,UAAkB;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,WAAW;IACX,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,OAAO,CACf,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,kEAAkE;IAClE,OAAO,iBAAiB,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,IAAI;QACJ,SAAS;KACV,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC/D,IAAI,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,OAAe;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;QACxC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/certs/ca.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,GACtE,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,GACvD,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,SAAS;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF;AAOD,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,QAAqB;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAK9B;IACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAC7C,aAAa,EACb,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,sBAAsB,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,CAAC;QAChE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,MAAM,OAAO,KAAK;QACxB,SAAS;QACT,QAAQ;QACR,gBAAgB,EAAE,aAAa;QAC/B,IAAI;QACJ,UAAU,EAAE;YACV,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC;YACjD,IAAI,IAAI,CAAC,kBAAkB,CACzB,IAAI,CAAC,aAAa,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAC3D,IAAI,CACL;SACF;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAExC,eAAe;IACf,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,6CAA6C;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAKjC;IACC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACxE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAKlC;IACC,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE1D,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,mEAAmE;AACnE,uEAAuE;AACvE,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,8DAA8D;AAC9D,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,iEAAiE;AACjE,gEAAgE;AAChE,8BAA8B;AAC9B,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAQrC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,aAAqB,EAAE,UAAkB,EAAE,KAAa;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAElD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAErC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,qDAAqD;QACrD,MAAM,IAAI,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,IAAI,OAAO,CAAC,8DAA8D,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,UAAkB;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,IAAI;QACJ,SAAS;KACV,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAe;QAC3B,CAAC,EAAE,mBAAwB;QAC3B,IAAI,EAAE,eAAe;QACrB,OAAO;KACR,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,YAAY,CAAC,cAAsB,EAAE,UAAkB;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,WAAW;IACX,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,OAAO,CACf,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,kEAAkE;IAClE,OAAO,iBAAiB,CAAC,cAAc,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC9B,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,IAAI;QACJ,SAAS;KACV,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC/D,IAAI,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,OAAe;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;QACxC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC;SAC3C,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/certs/index.d.ts

@@ -1,4 +1,4 @@
-export { createCA, backupCAKey, recoverCAKey, encryptCAKey, encryptCAKeyV1Legacy, decryptCAKey, loadCA, CaError } from './ca.js';
+export { createCA, backupCAKey, recoverCAKey, encryptCAKey, encryptCAKeyV1Legacy, decryptCAKey, loadCA, caCertFingerprint, CaError } from './ca.js';
 export type { CaKeyPair } from './ca.js';
 export { generateAgentCert, generateClientCert, generateCSR, signCSR, importPrivateKey, AgentCertError } from './agent-cert.js';
 export type { AgentCertResult } from './agent-cert.js';

package/dist/certs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/certs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACjI,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChI,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/certs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACpJ,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChI,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/certs/index.js

@@ -1,4 +1,4 @@
-export { createCA, backupCAKey, recoverCAKey, encryptCAKey, encryptCAKeyV1Legacy, decryptCAKey, loadCA, CaError } from './ca.js';
+export { createCA, backupCAKey, recoverCAKey, encryptCAKey, encryptCAKeyV1Legacy, decryptCAKey, loadCA, caCertFingerprint, CaError } from './ca.js';
 export { generateAgentCert, generateClientCert, generateCSR, signCSR, importPrivateKey, AgentCertError } from './agent-cert.js';
 export { createChallenge, verifyAndConsumeChallenge, ChallengeError } from './challenge.js';
 export { RSA_ALGORITHM, CA_CERT_VALIDITY_YEARS, AGENT_CERT_VALIDITY_YEARS } from './crypto-provider.js';

package/dist/certs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/certs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEjI,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhI,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/certs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpJ,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhI,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/guest.d.ts

@@ -23,6 +23,7 @@
  */
 import { z } from 'zod';
 import { MacfError } from './errors.js';
+import type { AgentInfo } from './registry/types.js';
 /**
  * How the consumer reaches the guest (DR-036 §two enabler paths, Amendment A):
  *  - `route`          — the guest is App-scoped + GitHub-@mention-routable
@@ -98,4 +99,76 @@ export declare function parseGuestAgentRef(agent: string): {
     readonly homeProject: string;
     readonly name: string;
 };
+/**
+ * DR-041 Amendment A (cross-fleet guest ADDRESSING, groundnuty/macf#786):
+ * resolve a guest's `<home-project>/<name>` registry slot to its `AgentInfo`.
+ * Mirrors `fleet-guests.ts`'s `GuestResolveFn` shape exactly — kept as an
+ * independent type here (rather than the reverse) so the outbound MESSAGING
+ * clients (`macf-channel-server`'s `notify_peer` + outbound A2A dispatch,
+ * `macf`'s `macf-ping` CLI) can depend on macf-core WITHOUT depending on the
+ * `macf` package's `fleet-guests.ts` (the STATUS-layer module, DR-036,
+ * which lives one package over and pulls in CLI-only concerns).
+ */
+export type CrossProjectAgentResolver = (homeProject: string, name: string) => Promise<AgentInfo | null>;
+/**
+ * Outcome of resolving a `to` address string against DR-041 Amendment A's
+ * 4-rung cross-fleet guest resolution ladder (groundnuty/macf#786):
+ *
+ *   1. `to` parses as `<project>/<name>` + the home project is federated +
+ *      the registry slot resolves → `resolved` — attempt delivery.
+ *   2. `to` parses but the home project is NOT in `federatedCas` →
+ *      `not-federated` — clear DR-041 error, never a silent no-op.
+ *   3. `to` parses + home project federated, but the registry slot is
+ *      missing/unresolvable → `not-found` — clear error.
+ *   4. `to` does NOT parse as a `<project>/<name>` slug at all →
+ *      `not-a-guest-ref` — the caller falls through to its OWN, UNCHANGED
+ *      own-project resolution. Deliberately NOT folded into this ladder:
+ *      each call site's own-project lookup mechanics differ (a direct
+ *      `registry.get(name)` in `notify-peer.ts` vs. a sanitized-name
+ *      `list()`-then-`find()` in `macf-ping`), so unifying THAT part would
+ *      require reshaping call sites that aren't broken, for no shared
+ *      benefit — only the GUEST ladder (parse + trust-gate + cross-project
+ *      resolve + error text) is common enough to be worth one shared
+ *      implementation.
+ */
+export type GuestAddressResolution = {
+    readonly kind: 'not-a-guest-ref';
+} | {
+    readonly kind: 'not-federated';
+    readonly homeProject: string;
+    readonly name: string;
+    readonly error: string;
+} | {
+    readonly kind: 'not-found';
+    readonly homeProject: string;
+    readonly name: string;
+    readonly error: string;
+} | {
+    readonly kind: 'resolved';
+    readonly homeProject: string;
+    readonly name: string;
+    readonly info: AgentInfo;
+};
+/**
+ * DR-041 Amendment A's unified cross-fleet guest resolution ladder
+ * (groundnuty/macf#786) — the SINGLE implementation `notify_peer` (outbound
+ * `/notify` + outbound A2A `message/send`, both dispatch through the SAME
+ * resolved peer in `notify-peer.ts`) and `macf-ping` reuse, so the addressing
+ * gate + its exact error text can never drift between call sites.
+ *
+ * Gated on `federatedCas` ALONE (DR-041 Amendment A decision 1) — NEVER on a
+ * `guests` binding. Rationale (science-ratified on macf#786): trust (the
+ * per-fleet-CA mTLS bundle, #785) is the SOLE admission gate for cross-fleet
+ * addressing — once a fleet's CA is federated, every agent that CA has
+ * signed is mTLS-reachable, so gating addressing on that SAME set keeps
+ * "can I address it" and "can I mTLS it" consistent. The `guests` binding
+ * (`.github/macf-fleet.json` `guests[]`) remains a relationship/metadata
+ * layer (DR-036) — consulted for scope-awareness in a FUTURE amendment
+ * (`scope_out`/`capabilities`, #779), never a second hard addressing gate.
+ *
+ * A malformed / non-slug `to` (rung 4) is NOT an error here — it returns
+ * `{ kind: 'not-a-guest-ref' }` so the caller falls through to its own
+ * unchanged own-project resolution, byte-identical to pre-#786 behavior.
+ */
+export declare function resolveGuestAddress(to: string, federatedCas: readonly string[], resolve: CrossProjectAgentResolver): Promise<GuestAddressResolution>;
 //# sourceMappingURL=guest.d.ts.map

package/dist/guest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guest.d.ts","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,sCAAuC,CAAC;AACvE,eAAO,MAAM,sBAAsB;;;EAA6B,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAUtE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAgB7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAuBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,yEAAyE;AACzE,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CASlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAQA"}
+{"version":3,"file":"guest.d.ts","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,sCAAuC,CAAC;AACvE,eAAO,MAAM,sBAAsB;;;EAA6B,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAUtE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;iBAgB7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAuBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,yEAAyE;AACzE,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CASlE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAQA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC,CA+BjC"}

package/dist/guest.js

@@ -131,4 +131,54 @@ export function parseGuestAgentRef(agent) {
     }
     return { homeProject: agent.slice(0, slash), name: agent.slice(slash + 1) };
 }
+/**
+ * DR-041 Amendment A's unified cross-fleet guest resolution ladder
+ * (groundnuty/macf#786) — the SINGLE implementation `notify_peer` (outbound
+ * `/notify` + outbound A2A `message/send`, both dispatch through the SAME
+ * resolved peer in `notify-peer.ts`) and `macf-ping` reuse, so the addressing
+ * gate + its exact error text can never drift between call sites.
+ *
+ * Gated on `federatedCas` ALONE (DR-041 Amendment A decision 1) — NEVER on a
+ * `guests` binding. Rationale (science-ratified on macf#786): trust (the
+ * per-fleet-CA mTLS bundle, #785) is the SOLE admission gate for cross-fleet
+ * addressing — once a fleet's CA is federated, every agent that CA has
+ * signed is mTLS-reachable, so gating addressing on that SAME set keeps
+ * "can I address it" and "can I mTLS it" consistent. The `guests` binding
+ * (`.github/macf-fleet.json` `guests[]`) remains a relationship/metadata
+ * layer (DR-036) — consulted for scope-awareness in a FUTURE amendment
+ * (`scope_out`/`capabilities`, #779), never a second hard addressing gate.
+ *
+ * A malformed / non-slug `to` (rung 4) is NOT an error here — it returns
+ * `{ kind: 'not-a-guest-ref' }` so the caller falls through to its own
+ * unchanged own-project resolution, byte-identical to pre-#786 behavior.
+ */
+export async function resolveGuestAddress(to, federatedCas, resolve) {
+    let ref;
+    try {
+        ref = parseGuestAgentRef(to);
+    }
+    catch {
+        return { kind: 'not-a-guest-ref' };
+    }
+    const { homeProject, name } = ref;
+    if (!federatedCas.includes(homeProject)) {
+        return {
+            kind: 'not-federated',
+            homeProject,
+            name,
+            error: `guest ${homeProject}/${name}: home fleet '${homeProject}' not in federated_cas — ` +
+                'federate it (DR-041) to message this guest.',
+        };
+    }
+    const info = await resolve(homeProject, name);
+    if (info === null) {
+        return {
+            kind: 'not-found',
+            homeProject,
+            name,
+            error: `guest ${homeProject}/${name} not found in registry.`,
+        };
+    }
+    return { kind: 'resolved', homeProject, name, info };
+}
 //# sourceMappingURL=guest.js.map

package/dist/guest.js.map

@@ -1 +1 @@
-{"version":3,"file":"guest.js","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAU,CAAC;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sFAAsF;IACtF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,kBAAkB,EAAE,oEAAoE,CAAC;IAClG,uGAAuG;IACvG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;IACnE,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;IAC7D,sFAAsF;IACtF,YAAY,EAAE,sBAAsB;IACpC;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAI9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,KAAK,uDAAuD,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"guest.js","sourceRoot":"","sources":["../src/guest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAU,CAAC;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAGjE;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sFAAsF;IACtF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,kBAAkB,EAAE,oEAAoE,CAAC;IAClG,uGAAuG;IACvG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;IACnE,gFAAgF;IAChF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;IAC7D,sFAAsF;IACtF,YAAY,EAAE,sBAAsB;IACpC;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAI9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,KAAK,uDAAuD,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AA2DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,YAA+B,EAC/B,OAAkC;IAElC,IAAI,GAA4D,CAAC;IACjE,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAElC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,WAAW;YACX,IAAI;YACJ,KAAK,EACH,SAAS,WAAW,IAAI,IAAI,iBAAiB,WAAW,2BAA2B;gBACnF,6CAA6C;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,WAAW;YACX,IAAI;YACJ,KAAK,EAAE,SAAS,WAAW,IAAI,IAAI,yBAAyB;SAC7D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -29,6 +29,7 @@ export * from './guest.js';
 export * from './norm.js';
 export * from './protected-invariant-norms.js';
 export * from './mtls-health-ping.js';
+export * from './trust-bundle.js';
 export * from './certs/index.js';
 export * from './registry/index.js';
 export * from './delivery/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -29,6 +29,7 @@ export * from './guest.js';
 export * from './norm.js';
 export * from './protected-invariant-norms.js';
 export * from './mtls-health-ping.js';
+export * from './trust-bundle.js';
 export * from './certs/index.js';
 export * from './registry/index.js';
 export * from './delivery/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAEpC,kEAAkE;AAClE,oEAAoE;AACpE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAEpC,kEAAkE;AAClE,oEAAoE;AACpE,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/trust-bundle.d.ts

@@ -0,0 +1,88 @@
+import { MacfError } from './errors.js';
+import type { GitHubVariablesClient } from './registry/types.js';
+import type { Logger } from './types.js';
+/** Raised when a declared `federated_cas` entry cannot be resolved to a CA PEM. */
+export declare class TrustBundleError extends MacfError {
+    constructor(message: string);
+}
+/**
+ * Read `<workspaceDir>/.github/macf-fleet.json` and return the declared
+ * `federated_cas` project list. Pure file-IO + parse — no network.
+ *
+ * Degrades to `[]` (i.e. "no federation") on every "the file doesn't clearly
+ * express federation intent" case: no workspaceDir, absent file, unparseable
+ * JSON, or a schema violation. This is the SAFE default for a trust-boundary
+ * config — an empty bundle-addition means "trust only my own CA," which is
+ * strictly MORE conservative than the pre-#784 behavior, never less. This
+ * mirrors `fleet-guests.ts`'s `loadGuestBindings` loud-but-degrade posture
+ * for the same file. Contrast with `resolveFederatedCaBundle` below, which
+ * FAILS LOUD once a project is unambiguously *declared* — degrading there
+ * would silently narrow an operator's explicit trust intent.
+ */
+export declare function loadFederatedCaProjects(workspaceDir: string | undefined, logger: Logger): readonly string[];
+/**
+ * Resolve `federatedProjects` to their `<PROJECT>_CA_CERT` shared-registry
+ * variables and concatenate them onto `ownCaCertPem`, producing the final
+ * trust-bundle PEM string threaded to all three mTLS-configuring sites
+ * (`https.ts` inbound, `a2a-client.ts` + `notify-peer.ts` outbound).
+ *
+ * Empty `federatedProjects` short-circuits to `ownCaCertPem` UNCHANGED — the
+ * exact pre-#784 single-CA value, byte-for-byte — so the zero-federation
+ * path has no observable difference from before this feature existed.
+ *
+ * THROWS `TrustBundleError` (never returns a partial bundle) when:
+ *  - `federatedProjects` is non-empty but `varsClient` is `undefined` (this
+ *    agent's registry is DR-024 local-mode, which has no shared-registry
+ *    variable to resolve a foreign project's CA from); or
+ *  - any declared project's `<PROJECT>_CA_CERT` variable read fails
+ *    (network/auth error) or resolves to `null`/empty (variable absent).
+ *
+ * Exported standalone (no file IO) so tests can exercise every resolution
+ * outcome — success, missing-var, read-error, local-mode-with-federation —
+ * without needing a real `.github/macf-fleet.json` fixture.
+ */
+export declare function resolveFederatedCaBundle(ownCaCertPem: string, federatedProjects: readonly string[], varsClient: GitHubVariablesClient | undefined, logger: Logger): Promise<string>;
+/**
+ * Full orchestration: load `federated_cas` from the workspace's
+ * `.github/macf-fleet.json` (degrade-to-`[]` on absent/malformed — safe
+ * default), then resolve + concatenate into the final trust-bundle PEM
+ * (fail-loud on an unresolvable DECLARED project — see module doc). This is
+ * the single call `server.ts` makes at startup; its result is threaded
+ * unchanged to `createHttpsServer`'s `caBundlePem`, `A2aClient`'s
+ * `caCertPem`, and `notifyDispatchDeps.caCertPem`.
+ */
+export declare function buildTrustBundlePem(deps: {
+    readonly workspaceDir: string | undefined;
+    readonly ownCaCertPem: string;
+    readonly varsClient: GitHubVariablesClient | undefined;
+    readonly logger: Logger;
+}): Promise<string>;
+/**
+ * DR-041 Amendment B (federation-aware guest probe, groundnuty/macf#794):
+ * resolve the CA bundle to use when probing ONE specific cross-fleet guest's
+ * `/health` endpoint.
+ *
+ * If `homeProject` is a DECLARED `federated_cas` entry, returns `ownCaCertPem`
+ * plus JUST that project's federated CA — a MINIMAL, single-project bundle,
+ * deliberately narrower than `resolveFederatedCaBundle`'s "all declared
+ * projects" bundle. A resolution failure (missing/unreadable CA variable) for
+ * some OTHER federated project must never block probing THIS guest — each
+ * guest probe is isolated from every other federated project's health.
+ *
+ * If `homeProject` is NOT declared in `federatedCaProjects`, returns
+ * `ownCaCertPem` UNCHANGED — byte-for-byte the pre-#794 behavior (probe with
+ * the own CA only). This preserves both pre-existing outcomes for a
+ * non-federated guest: a "shared-operator" guest signed by the SAME CA still
+ * verifies + reads online; a genuinely-foreign-CA guest still fails the TLS
+ * handshake + reads offline (see `fleet-guests.ts` module doc, path B1).
+ *
+ * Callers that want the security-critical fail-loud behavior for an
+ * unresolvable DECLARED project (e.g. an interactive `macf-ping` command)
+ * should let the thrown `TrustBundleError` propagate. Callers that isolate
+ * per-guest probe failures (e.g. `resolveGuestStatus`'s
+ * `.catch(() => null)`) get the existing degrade-to-offline behavior with no
+ * extra code — a misconfigured federated guest simply reads offline, same as
+ * a genuinely-down one.
+ */
+export declare function resolveGuestProbeCaBundle(ownCaCertPem: string, homeProject: string, federatedCaProjects: readonly string[], varsClient: GitHubVariablesClient | undefined, logger: Logger): Promise<string>;
+//# sourceMappingURL=trust-bundle.d.ts.map

package/dist/trust-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-bundle.d.ts","sourceRoot":"","sources":["../src/trust-bundle.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,mFAAmF;AACnF,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,GACb,SAAS,MAAM,EAAE,CAyBnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,SAAS,MAAM,EAAE,EACpC,UAAU,EAAE,qBAAqB,GAAG,SAAS,EAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,UAAU,EAAE,qBAAqB,GAAG,SAAS,EAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/trust-bundle.js

@@ -0,0 +1,202 @@
+/**
+ * DR-041 Decision 1 (cross-fleet trust federation, groundnuty/macf#784):
+ * builds a channel-server's (or CLI probe's) multi-CA mTLS trust bundle from
+ * its own CA + zero-or-more federated fleets' CAs declared in
+ * `.github/macf-fleet.json` `federated_cas` (`guest.ts` schema).
+ *
+ * Lives in `macf-core` (moved here from `macf-channel-server` by DR-041
+ * Amendment B, groundnuty/macf#794) because BOTH the channel-server's inbound
+ * mTLS server + outbound A2A/notify clients AND the `macf` CLI's `/macf-peers`
+ * / `/macf-ping` / `macf fleet status` guest probes need this SAME
+ * security-critical trust-resolution logic — duplicating it across two
+ * packages would risk the two copies drifting apart (check-before-propose
+ * §4). This module has zero channel-server-specific coupling: it imports
+ * only from sibling macf-core modules + node builtins.
+ *
+ * v1 = the STATIC committed-bundle tier (DR-041 Decision 1c Tier v1): the
+ * bundle is resolved ONCE at process startup from the shared registry (the
+ * same GitHub-Variables backing this agent's OWN registry, per DR-006 shared
+ * profile scope — a federated fleet's `<PROJECT>_CA_CERT` variable lives in
+ * the same registry namespace as this fleet's own, just under a different
+ * project prefix). Re-resolved on the next process restart if a federated
+ * fleet rotates its CA (documented rotation model: re-commit + notify). The
+ * well-known bundle-endpoint + poller tier (rotation-aware, live-fetched) is
+ * v2 — documented, not built (backlog groundnuty/macf#783).
+ *
+ * SECURITY-CRITICAL trust-boundary code. Two invariants this module upholds
+ * (DR-041 Decision 1b):
+ *
+ *  1. **Complete-allow-list, never partial.** The resulting bundle REPLACES
+ *     Node's default TLS root store at every consuming site (`https.ts`
+ *     inbound `ca:`, `a2a-client.ts` + `notify-peer.ts` outbound `ca:`), so
+ *     it MUST carry every CA this agent intends to trust. If a declared
+ *     `federated_cas` project's CA is unresolvable (registry read failure,
+ *     or the variable is simply absent), this module THROWS rather than
+ *     silently omitting that CA from the bundle — a silently-partial bundle
+ *     would present as the EXACT same symptom (a guest reading `offline`)
+ *     DR-041 exists to fix, with no signal pointing at the real cause. See
+ *     `.claude/rules/silent-fallback-hazards.md` — this is Pattern B
+ *     (reject-at-the-boundary) applied to a trust-anchor set.
+ *  2. **All-or-nothing per fleet-CA, by design.** Federating a fleet's CA
+ *     trusts EVERY certificate that CA has signed or will sign — there is
+ *     no per-agent or per-skill restriction at this layer (DR-041 Decision
+ *     4 explicitly defers finer-grained capability enforcement to a future
+ *     capability-token mechanism, NOT this bundle).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { MacfError } from './errors.js';
+import { parseMacfFleetConfig } from './guest.js';
+import { toVariableSegment } from './registry/variable-name.js';
+/** Raised when a declared `federated_cas` entry cannot be resolved to a CA PEM. */
+export class TrustBundleError extends MacfError {
+    constructor(message) {
+        super('TRUST_BUNDLE_ERROR', message);
+        this.name = 'TrustBundleError';
+    }
+}
+/**
+ * Read `<workspaceDir>/.github/macf-fleet.json` and return the declared
+ * `federated_cas` project list. Pure file-IO + parse — no network.
+ *
+ * Degrades to `[]` (i.e. "no federation") on every "the file doesn't clearly
+ * express federation intent" case: no workspaceDir, absent file, unparseable
+ * JSON, or a schema violation. This is the SAFE default for a trust-boundary
+ * config — an empty bundle-addition means "trust only my own CA," which is
+ * strictly MORE conservative than the pre-#784 behavior, never less. This
+ * mirrors `fleet-guests.ts`'s `loadGuestBindings` loud-but-degrade posture
+ * for the same file. Contrast with `resolveFederatedCaBundle` below, which
+ * FAILS LOUD once a project is unambiguously *declared* — degrading there
+ * would silently narrow an operator's explicit trust intent.
+ */
+export function loadFederatedCaProjects(workspaceDir, logger) {
+    if (workspaceDir === undefined)
+        return [];
+    const path = join(workspaceDir, '.github', 'macf-fleet.json');
+    if (!existsSync(path))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch (e) {
+        logger.warn('trust_bundle_fleet_config_parse_failed', {
+            path,
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return [];
+    }
+    try {
+        return parseMacfFleetConfig(raw).federated_cas;
+    }
+    catch (e) {
+        logger.warn('trust_bundle_fleet_config_invalid', {
+            path,
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return [];
+    }
+}
+/**
+ * Resolve `federatedProjects` to their `<PROJECT>_CA_CERT` shared-registry
+ * variables and concatenate them onto `ownCaCertPem`, producing the final
+ * trust-bundle PEM string threaded to all three mTLS-configuring sites
+ * (`https.ts` inbound, `a2a-client.ts` + `notify-peer.ts` outbound).
+ *
+ * Empty `federatedProjects` short-circuits to `ownCaCertPem` UNCHANGED — the
+ * exact pre-#784 single-CA value, byte-for-byte — so the zero-federation
+ * path has no observable difference from before this feature existed.
+ *
+ * THROWS `TrustBundleError` (never returns a partial bundle) when:
+ *  - `federatedProjects` is non-empty but `varsClient` is `undefined` (this
+ *    agent's registry is DR-024 local-mode, which has no shared-registry
+ *    variable to resolve a foreign project's CA from); or
+ *  - any declared project's `<PROJECT>_CA_CERT` variable read fails
+ *    (network/auth error) or resolves to `null`/empty (variable absent).
+ *
+ * Exported standalone (no file IO) so tests can exercise every resolution
+ * outcome — success, missing-var, read-error, local-mode-with-federation —
+ * without needing a real `.github/macf-fleet.json` fixture.
+ */
+export async function resolveFederatedCaBundle(ownCaCertPem, federatedProjects, varsClient, logger) {
+    if (federatedProjects.length === 0) {
+        return ownCaCertPem;
+    }
+    if (varsClient === undefined) {
+        throw new TrustBundleError(`DR-041 federated_cas declares ${federatedProjects.length} federated project(s) ` +
+            `(${federatedProjects.join(', ')}) but this agent's registry is DR-024 local-mode, ` +
+            'which has no shared GitHub-Variables registry to resolve a foreign fleet\'s CA from. ' +
+            'Cross-fleet CA federation (DR-041) requires a GitHub-backed registry (repo/org/profile). ' +
+            'Remove federated_cas from .github/macf-fleet.json, or switch this agent off local mode.');
+    }
+    const parts = [ownCaCertPem];
+    for (const project of federatedProjects) {
+        const varName = `${toVariableSegment(project)}_CA_CERT`;
+        let pem;
+        try {
+            pem = await varsClient.readVariable(varName);
+        }
+        catch (e) {
+            throw new TrustBundleError(`DR-041 federated_cas: failed to read registry variable "${varName}" for declared ` +
+                `federated project "${project}": ${e instanceof Error ? e.message : String(e)}. ` +
+                'Refusing to start with an INCOMPLETE trust bundle (a partial bundle would present ' +
+                'as the exact same "guest reads offline" symptom DR-041 fixes, with no signal why).');
+        }
+        if (pem === null || pem.trim() === '') {
+            throw new TrustBundleError(`DR-041 federated_cas: registry variable "${varName}" is missing/empty for declared ` +
+                `federated project "${project}". Run \`macf certs\` on that project first to publish ` +
+                'its CA, or remove the project from federated_cas. Refusing to start with an ' +
+                'INCOMPLETE trust bundle.');
+        }
+        parts.push(pem);
+        logger.info('trust_bundle_federated_ca_added', { project, variable: varName });
+    }
+    return parts.join('\n');
+}
+/**
+ * Full orchestration: load `federated_cas` from the workspace's
+ * `.github/macf-fleet.json` (degrade-to-`[]` on absent/malformed — safe
+ * default), then resolve + concatenate into the final trust-bundle PEM
+ * (fail-loud on an unresolvable DECLARED project — see module doc). This is
+ * the single call `server.ts` makes at startup; its result is threaded
+ * unchanged to `createHttpsServer`'s `caBundlePem`, `A2aClient`'s
+ * `caCertPem`, and `notifyDispatchDeps.caCertPem`.
+ */
+export async function buildTrustBundlePem(deps) {
+    const federatedProjects = loadFederatedCaProjects(deps.workspaceDir, deps.logger);
+    return resolveFederatedCaBundle(deps.ownCaCertPem, federatedProjects, deps.varsClient, deps.logger);
+}
+/**
+ * DR-041 Amendment B (federation-aware guest probe, groundnuty/macf#794):
+ * resolve the CA bundle to use when probing ONE specific cross-fleet guest's
+ * `/health` endpoint.
+ *
+ * If `homeProject` is a DECLARED `federated_cas` entry, returns `ownCaCertPem`
+ * plus JUST that project's federated CA — a MINIMAL, single-project bundle,
+ * deliberately narrower than `resolveFederatedCaBundle`'s "all declared
+ * projects" bundle. A resolution failure (missing/unreadable CA variable) for
+ * some OTHER federated project must never block probing THIS guest — each
+ * guest probe is isolated from every other federated project's health.
+ *
+ * If `homeProject` is NOT declared in `federatedCaProjects`, returns
+ * `ownCaCertPem` UNCHANGED — byte-for-byte the pre-#794 behavior (probe with
+ * the own CA only). This preserves both pre-existing outcomes for a
+ * non-federated guest: a "shared-operator" guest signed by the SAME CA still
+ * verifies + reads online; a genuinely-foreign-CA guest still fails the TLS
+ * handshake + reads offline (see `fleet-guests.ts` module doc, path B1).
+ *
+ * Callers that want the security-critical fail-loud behavior for an
+ * unresolvable DECLARED project (e.g. an interactive `macf-ping` command)
+ * should let the thrown `TrustBundleError` propagate. Callers that isolate
+ * per-guest probe failures (e.g. `resolveGuestStatus`'s
+ * `.catch(() => null)`) get the existing degrade-to-offline behavior with no
+ * extra code — a misconfigured federated guest simply reads offline, same as
+ * a genuinely-down one.
+ */
+export async function resolveGuestProbeCaBundle(ownCaCertPem, homeProject, federatedCaProjects, varsClient, logger) {
+    if (!federatedCaProjects.includes(homeProject)) {
+        return ownCaCertPem;
+    }
+    return resolveFederatedCaBundle(ownCaCertPem, [homeProject], varsClient, logger);
+}
+//# sourceMappingURL=trust-bundle.js.map

package/dist/trust-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-bundle.js","sourceRoot":"","sources":["../src/trust-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAIhE,mFAAmF;AACnF,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAgC,EAChC,MAAc;IAEd,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,IAAI;YACJ,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC/C,IAAI;YACJ,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAoB,EACpB,iBAAoC,EACpC,UAA6C,EAC7C,MAAc;IAEd,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,iBAAiB,CAAC,MAAM,wBAAwB;YAC/E,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;YACpF,uFAAuF;YACvF,2FAA2F;YAC3F,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC;QACxD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CACxB,2DAA2D,OAAO,iBAAiB;gBACjF,sBAAsB,OAAO,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACjF,oFAAoF;gBACpF,oFAAoF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,gBAAgB,CACxB,4CAA4C,OAAO,kCAAkC;gBACnF,sBAAsB,OAAO,yDAAyD;gBACtF,8EAA8E;gBAC9E,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAKzC;IACC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACtG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAoB,EACpB,WAAmB,EACnB,mBAAsC,EACtC,UAA6C,EAC7C,MAAc;IAEd,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,wBAAwB,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/types.d.ts

@@ -47,6 +47,7 @@ export declare const NotifyPayloadSchema: z.ZodObject<{
         "turn-complete": "turn-complete";
     }>>;
     github_anchor: z.ZodOptional<z.ZodString>;
+    reply_to: z.ZodOptional<z.ZodString>;
     message_id: z.ZodOptional<z.ZodString>;
     review_state: z.ZodOptional<z.ZodEnum<{
         approved: "approved";

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;EAgC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAK1D,eAAO,MAAM,0BAA0B;;;;;EAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgH/B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBASpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAaxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAOrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,qBAAqB,EAAE,cAAc,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAYD,eAAO,MAAM,iBAAiB;;;;;;iBAS7B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACzE;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,cAAc,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;;;;EAgC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAK1D,eAAO,MAAM,0BAA0B;;;;;EAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyH/B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBASpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAaxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAOrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsE/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,qBAAqB,EAAE,cAAc,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAYD,eAAO,MAAM,iBAAiB;;;;;;iBAS7B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAIH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAIH,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AAIH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACvE,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACzE;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,cAAc,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CAC/B"}

package/dist/types.js

@@ -80,6 +80,15 @@ export const NotifyPayloadSchema = z.object({
     event: z.enum(['session-end', 'session-compact', 'turn-complete', 'error', 'custom']).optional(),
     // macf#473: optional owner/repo#N anchor a peer_notification nudge is tied to, for the comms-ledger graph join.
     github_anchor: z.string().optional(),
+    // macf#790 Gap 2: the sender's canonical cross-fleet reply-to slug, in
+    // `<project>/<routing-label>` form (e.g. `icsoc-2026/science-agent`). A
+    // BARE `source` (e.g. `science-agent`) is ambiguous once agents talk
+    // across fleets — a guest receiving `source: "science-agent"` resolves a
+    // reply inside its OWN project, never reaching the sender's home fleet.
+    // `reply_to` is the unambiguous address the recipient should use instead.
+    // Optional for back-compat with pre-#790 senders (who never set it) and
+    // with every NotifyType that has no sender-identity concept at all.
+    reply_to: z.string().optional(),
     // DR-038 Decision 2: the sender's stable dedup key for the direct
     // peer_notification path — a UUIDv4 minted ONCE at outbox-enqueue and
     // reused verbatim on every retry (never regenerated). Optional at the

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6CAA6C;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,cAAc;IACd,SAAS;IACT,eAAe;IACf,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,gDAAgD;IAChD,eAAe;IACf,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,oDAAoD;IACpD,mBAAmB;IACnB,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,sEAAsE;IACtE,6DAA6D;IAC7D,+CAA+C;IAC/C,iBAAiB;CAClB,CAAC,CAAC;AAIH,iEAAiE;AACjE,qEAAqE;AACrE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,gBAAgB;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,6DAA6D;IAC7D,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,+DAA+D;IAC/D,+DAA+D;IAC/D,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,+DAA+D;IAC/D,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,qBAAqB;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,qEAAqE;IACrE,mEAAmE;IACnE,4DAA4D;IAC5D,oEAAoE;IACpE,mDAAmD;IACnD,sEAAsE;IACtE,oEAAoE;IACpE,yFAAyF;IACzF,gEAAgE;IAChE,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,qEAAqE;IACrE,qBAAqB;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChG,gHAAgH;IAChH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,qEAAqE;IACrE,+DAA+D;IAC/D,iEAAiE;IACjE,qEAAqE;IACrE,8DAA8D;IAC9D,oEAAoE;IACpE,uBAAuB;IACvB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,4CAA4C;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM;AACP,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;OACvB,OAAO,CAAC,UAAU,KAAK,IAAI;OAC3B,OAAO,CAAC,OAAO,KAAK,SAAS;OAC7B,OAAO,CAAC,YAAY,KAAK,SAAS;OAClC,OAAO,CAAC,SAAS,KAAK,SAAS,EACpC;IACE,OAAO,EACL,iFAAiF;UAC/E,6EAA6E;IACjF,IAAI,EAAE,CAAC,SAAS,CAAC;CAClB,CACF,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,UAAU,EAAE,0BAA0B;IACtC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,uEAAuE;IACvE,8DAA8D;IAC9D,gEAAgE;IAChE,6DAA6D;IAC7D,0EAA0E;IAC1E,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,6CAA6C;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,oDAAoD;IACpD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,oEAAoE;IACpE,kDAAkD;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC1C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAChE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxB,2EAA2E;IAC3E,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;KAChC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxB,2EAA2E;IAC3E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAC;AAgDH,yCAAyC;AACzC,EAAE;AACF,8DAA8D;AAC9D,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AAEzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC,MAAM,CACP,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,EAClD,EAAE,OAAO,EAAE,sDAAsD,EAAE,CACpE,CAAC;AAIF,yBAAyB;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,mCAAmC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAC9B,CAAC,CAAC;AAEH,yBAAyB;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6CAA6C;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,cAAc;IACd,SAAS;IACT,eAAe;IACf,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,0DAA0D;IAC1D,gDAAgD;IAChD,eAAe;IACf,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,oDAAoD;IACpD,mBAAmB;IACnB,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,sEAAsE;IACtE,6DAA6D;IAC7D,+CAA+C;IAC/C,iBAAiB;CAClB,CAAC,CAAC;AAIH,iEAAiE;AACjE,qEAAqE;AACrE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,gBAAgB;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,6DAA6D;IAC7D,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,+DAA+D;IAC/D,+DAA+D;IAC/D,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,+DAA+D;IAC/D,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,qBAAqB;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,qEAAqE;IACrE,mEAAmE;IACnE,4DAA4D;IAC5D,oEAAoE;IACpE,mDAAmD;IACnD,sEAAsE;IACtE,oEAAoE;IACpE,yFAAyF;IACzF,gEAAgE;IAChE,mEAAmE;IACnE,gEAAgE;IAChE,+DAA+D;IAC/D,qEAAqE;IACrE,qBAAqB;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChG,gHAAgH;IAChH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,kDAAkD;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,qEAAqE;IACrE,+DAA+D;IAC/D,iEAAiE;IACjE,qEAAqE;IACrE,8DAA8D;IAC9D,oEAAoE;IACpE,uBAAuB;IACvB,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,4CAA4C;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM;AACP,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;OACvB,OAAO,CAAC,UAAU,KAAK,IAAI;OAC3B,OAAO,CAAC,OAAO,KAAK,SAAS;OAC7B,OAAO,CAAC,YAAY,KAAK,SAAS;OAClC,OAAO,CAAC,SAAS,KAAK,SAAS,EACpC;IACE,OAAO,EACL,iFAAiF;UAC/E,6EAA6E;IACjF,IAAI,EAAE,CAAC,SAAS,CAAC;CAClB,CACF,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,UAAU,EAAE,0BAA0B;IACtC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,uEAAuE;IACvE,8DAA8D;IAC9D,gEAAgE;IAChE,6DAA6D;IAC7D,0EAA0E;IAC1E,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,6CAA6C;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,oDAAoD;IACpD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,oEAAoE;IACpE,kDAAkD;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC1C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAChE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxB,2EAA2E;IAC3E,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;KAChC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxB,2EAA2E;IAC3E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAC;AAgDH,yCAAyC;AACzC,EAAE;AACF,8DAA8D;AAC9D,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AAEzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC,MAAM,CACP,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,EAClD,EAAE,OAAO,EAAE,sDAAsD,EAAE,CACpE,CAAC;AAIF,yBAAyB;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,mCAAmC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAC9B,CAAC,CAAC;AAEH,yBAAyB;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundnuty/macf-core",
-  "version": "0.2.54",
+  "version": "0.2.56",
   "description": "Shared internals consumed by the MACF CLI and channel-server packages. Not intended for direct external use — will be marked deprecated-internal on first npm publish per DR-022 Amendment A.",
   "type": "module",
   "main": "dist/index.js",