agentskeptic 1.0.0 → 1.0.1

package/dist/stateWitness.test.js

@@ -0,0 +1,120 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+const s3Send = vi.hoisted(() => vi.fn());
+vi.mock("@aws-sdk/client-s3", () => ({
+    S3Client: class MockS3Client {
+        send = s3Send;
+    },
+    HeadObjectCommand: class HeadObjectCommand {
+        input;
+        constructor(input) {
+            this.input = input;
+        }
+    },
+    GetObjectCommand: class GetObjectCommand {
+        input;
+        constructor(input) {
+            this.input = input;
+        }
+    },
+}));
+import { reconcileStateWitness } from "./stateWitness.js";
+describe("reconcileStateWitness", () => {
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+        s3Send.mockReset();
+    });
+    describe("http_witness", () => {
+        it("returns verified when status and JSON assertions match", async () => {
+            vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ ok: true, n: 1 }), { status: 200 })));
+            const out = await reconcileStateWitness({
+                kind: "http_witness",
+                method: "GET",
+                url: "http://witness.test/health",
+                expectedStatus: 200,
+                assertions: [{ jsonPointer: "/ok", value: true }],
+            });
+            expect(out.status).toBe("verified");
+        });
+        it("returns inconsistent on HTTP status mismatch", async () => {
+            vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({}), { status: 500 })));
+            const out = await reconcileStateWitness({
+                kind: "http_witness",
+                method: "GET",
+                url: "http://witness.test/x",
+                expectedStatus: 200,
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("HTTP_WITNESS_STATUS_MISMATCH");
+        });
+    });
+    describe("vector_document (pinecone)", () => {
+        it("returns verified when fetch returns matching vector metadata", async () => {
+            const prevHost = process.env.PINECONE_INDEX_HOST;
+            const prevKey = process.env.PINECONE_API_KEY;
+            process.env.PINECONE_INDEX_HOST = "https://pinecone.test";
+            process.env.PINECONE_API_KEY = "secret";
+            try {
+                vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
+                    vectors: { "doc-1": { metadata: { tier: "gold" } } },
+                }), { status: 200 })));
+                const out = await reconcileStateWitness({
+                    kind: "vector_document",
+                    provider: "pinecone",
+                    documentId: "doc-1",
+                    indexName: "idx",
+                    metadataSubset: { tier: "gold" },
+                });
+                expect(out.status).toBe("verified");
+            }
+            finally {
+                if (prevHost === undefined)
+                    delete process.env.PINECONE_INDEX_HOST;
+                else
+                    process.env.PINECONE_INDEX_HOST = prevHost;
+                if (prevKey === undefined)
+                    delete process.env.PINECONE_API_KEY;
+                else
+                    process.env.PINECONE_API_KEY = prevKey;
+            }
+        });
+    });
+    describe("object_storage_object", () => {
+        it("returns verified when HeadObject matches size and ETag", async () => {
+            s3Send.mockResolvedValueOnce({ ContentLength: 3, ETag: '"abc"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectSizeBytes: 3,
+                expectEtag: "abc",
+            });
+            expect(out.status).toBe("verified");
+            expect(s3Send).toHaveBeenCalledTimes(1);
+        });
+        it("returns inconsistent on ETag mismatch", async () => {
+            s3Send.mockResolvedValueOnce({ ContentLength: 3, ETag: '"wrong"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectEtag: "expected",
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("OBJECT_DIGEST_MISMATCH");
+        });
+        it("returns inconsistent when full-object hash requested over byte cap", async () => {
+            const big = 11 * 1024 * 1024;
+            s3Send.mockResolvedValueOnce({ ContentLength: big, ETag: '"x"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectSha256: "a".repeat(64),
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("OBJECT_TOO_LARGE_FOR_HASH");
+        });
+    });
+});
+//# sourceMappingURL=stateWitness.test.js.map

package/dist/stateWitness.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateWitness.test.js","sourceRoot":"","sources":["../src/stateWitness.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE7D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,YAAY;QAC1B,IAAI,GAAG,MAAM,CAAC;KACf;IACD,iBAAiB,EAAE,MAAM,iBAAiB;QACZ;QAA5B,YAA4B,KAAc;YAAd,UAAK,GAAL,KAAK,CAAS;QAAG,CAAC;KAC/C;IACD,gBAAgB,EAAE,MAAM,gBAAgB;QACV;QAA5B,YAA4B,KAAc;YAAd,UAAK,GAAL,KAAK,CAAS;QAAG,CAAC;KAC/C;CACF,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACrF,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,4BAA4B;gBACjC,cAAc,EAAE,GAAG;gBACnB,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,uBAAuB;gBAC5B,cAAc,EAAE,GAAG;aACpB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,uBAAuB,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC;YACxC,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CACf,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;iBACrD,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CACF,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;oBACtC,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,OAAO;oBACnB,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBACjC,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;;oBAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC;gBAChD,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;;oBAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,eAAe,EAAE,CAAC;gBAClB,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,UAAU;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/telemetry/maybeEmitOssClaimTicketUrl.d.ts

@@ -4,5 +4,7 @@ export declare function maybeEmitOssClaimTicketUrlToStderr(input: {
     workload_class: "bundled_examples" | "non_bundled";
     subcommand: "batch_verify" | "quick_verify" | "verify_integrator_owned";
     build_profile: "oss" | "commercial";
+    /** When set, reused for claim-ticket + claim-continuation HTTP `x-request-id`. */
+    xRequestId?: string;
 }): Promise<void>;
 //# sourceMappingURL=maybeEmitOssClaimTicketUrl.d.ts.map

package/dist/telemetry/maybeEmitOssClaimTicketUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maybeEmitOssClaimTicketUrl.d.ts","sourceRoot":"","sources":["../../src/telemetry/maybeEmitOssClaimTicketUrl.ts"],"names":[],"mappings":"AAMA,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;IAC5D,cAAc,EAAE,kBAAkB,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,yBAAyB,CAAC;IACxE,aAAa,EAAE,KAAK,GAAG,YAAY,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB"}
+{"version":3,"file":"maybeEmitOssClaimTicketUrl.d.ts","sourceRoot":"","sources":["../../src/telemetry/maybeEmitOssClaimTicketUrl.ts"],"names":[],"mappings":"AAOA,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;IAC5D,cAAc,EAAE,kBAAkB,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,yBAAyB,CAAC;IACxE,aAAa,EAAE,KAAK,GAAG,YAAY,CAAC;IACpC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDhB"}

package/dist/telemetry/maybeEmitOssClaimTicketUrl.js

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { LICENSE_PREFLIGHT_ENABLED } from "../generated/commercialBuildFlags.js";
+import { newActivationHttpCorrelationId } from "../commercial/activationCorrelation.js";
 import { openHandoffUrlInOsBrowser } from "./openHandoffUrlInOsBrowser.js";
 import { postOssClaimContinuation } from "./postOssClaimContinuation.js";
 import { postOssClaimTicket } from "./postOssClaimTicket.js";
@@ -15,17 +16,19 @@ export async function maybeEmitOssClaimTicketUrlToStderr(input) {
     const interactiveHuman = Boolean(process.stdout.isTTY) &&
         Boolean(process.stderr.isTTY) &&
         String(process.env.CI).toLowerCase() !== "true";
+    const xRequestId = input.xRequestId?.trim() || newActivationHttpCorrelationId();
     const r = await postOssClaimTicket({
         claim_secret,
         issued_at,
         ...input,
         interactive_human: interactiveHuman ? true : undefined,
+        xRequestId,
     });
     if (r.outcome === "ok") {
         if (interactiveHuman) {
             const { ok } = await openHandoffUrlInOsBrowser(r.handoff_url);
             if (ok) {
-                await postOssClaimContinuation(claim_secret);
+                await postOssClaimContinuation(claim_secret, xRequestId);
             }
         }
         console.error(`[agentskeptic] Link this verification run to your account: ${r.handoff_url} — open the link, then sign in with email when prompted.`);
@@ -35,6 +38,14 @@ export async function maybeEmitOssClaimTicketUrlToStderr(input) {
         console.error("[agentskeptic] This verification run was already linked to an account. Open the product site and sign in to manage your account, or run verify again for a new run.");
         return;
     }
-    console.error("[agentskeptic] Could not register a claim link (network). When you are online, run verify again to get a new link, or sign in at the product site without this shortcut.");
+    if (r.outcome === "rate_limited") {
+        console.error(`[agentskeptic] Could not register a claim link (rate limited). x-request-id=${xRequestId}`);
+        return;
+    }
+    if (r.outcome === "forbidden" || r.outcome === "bad_request") {
+        console.error(`[agentskeptic] Could not register a claim link (${r.outcome}). x-request-id=${xRequestId}`);
+        return;
+    }
+    console.error(`[agentskeptic] Could not register a claim link (network). x-request-id=${xRequestId} When you are online, run verify again to get a new link, or sign in at the product site without this shortcut.`);
 }
 //# sourceMappingURL=maybeEmitOssClaimTicketUrl.js.map

package/dist/telemetry/maybeEmitOssClaimTicketUrl.js.map

@@ -1 +1 @@
-{"version":3,"file":"maybeEmitOssClaimTicketUrl.js","sourceRoot":"","sources":["../../src/telemetry/maybeEmitOssClaimTicketUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAMxD;IACC,IAAI,yBAAyB;QAAE,OAAO;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACtE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IAE/D,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAElD,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC;QACjC,YAAY;QACZ,SAAS;QACT,GAAG,KAAK;QACR,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CACX,8DAA8D,CAAC,CAAC,WAAW,0DAA0D,CACtI,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CACX,qKAAqK,CACtK,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CACX,0KAA0K,CAC3K,CAAC;AACJ,CAAC"}
+{"version":3,"file":"maybeEmitOssClaimTicketUrl.js","sourceRoot":"","sources":["../../src/telemetry/maybeEmitOssClaimTicketUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,IAAI,yBAAyB;QAAE,OAAO;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACtE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IAE/D,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAElD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,8BAA8B,EAAE,CAAC;IAEhF,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC;QACjC,YAAY;QACZ,SAAS;QACT,GAAG,KAAK;QACR,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACtD,UAAU;KACX,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,wBAAwB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CACX,8DAA8D,CAAC,CAAC,WAAW,0DAA0D,CACtI,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CACX,qKAAqK,CACtK,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CACX,+EAA+E,UAAU,EAAE,CAC5F,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,mDAAmD,CAAC,CAAC,OAAO,mBAAmB,UAAU,EAAE,CAC5F,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CACX,0EAA0E,UAAU,iHAAiH,CACtM,CAAC;AACJ,CAAC"}

package/dist/telemetry/ossClaimOrigin.d.ts

@@ -1,6 +1,6 @@
 /**
  * OSS claim-ticket POST base (v1): canonical public site origin only — no env overrides.
- * Normative: docs/oss-account-claim-ssot.md
+ * Normative: docs/oss-account-claim.md
  */
 export declare function resolveOssClaimApiOrigin(): string;
 //# sourceMappingURL=ossClaimOrigin.d.ts.map

package/dist/telemetry/ossClaimOrigin.js

@@ -1,7 +1,7 @@
 import { PUBLIC_CANONICAL_SITE_ORIGIN } from "../publicDistribution.generated.js";
 /**
  * OSS claim-ticket POST base (v1): canonical public site origin only — no env overrides.
- * Normative: docs/oss-account-claim-ssot.md
+ * Normative: docs/oss-account-claim.md
  */
 export function resolveOssClaimApiOrigin() {
     return PUBLIC_CANONICAL_SITE_ORIGIN.replace(/\/$/, "");

package/dist/telemetry/postOssClaimContinuation.d.ts

@@ -1,5 +1,5 @@
 /**
  * POST /api/oss/claim-continuation — records `browser_open_invoked_at` once (interactive-human tickets only).
  */
-export declare function postOssClaimContinuation(claimSecret: string): Promise<boolean>;
+export declare function postOssClaimContinuation(claimSecret: string, xRequestId?: string): Promise<boolean>;
 //# sourceMappingURL=postOssClaimContinuation.d.ts.map

package/dist/telemetry/postOssClaimContinuation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postOssClaimContinuation.d.ts","sourceRoot":"","sources":["../../src/telemetry/postOssClaimContinuation.ts"],"names":[],"mappings":"AAWA;;GAEG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBpF"}
+{"version":3,"file":"postOssClaimContinuation.d.ts","sourceRoot":"","sources":["../../src/telemetry/postOssClaimContinuation.ts"],"names":[],"mappings":"AAWA;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CA2BlB"}

package/dist/telemetry/postOssClaimContinuation.js

@@ -6,19 +6,23 @@ const OSS_CLAIM_CONTINUATION_FETCH_TIMEOUT_MS = 400;
 /**
  * POST /api/oss/claim-continuation — records `browser_open_invoked_at` once (interactive-human tickets only).
  */
-export async function postOssClaimContinuation(claimSecret) {
+export async function postOssClaimContinuation(claimSecret, xRequestId) {
     if (process.env.AGENTSKEPTIC_TELEMETRY?.trim() === "0")
         return false;
     const base = resolveOssClaimApiOrigin();
     const url = `${base}/api/oss/claim-continuation`;
+    const headers = {
+        "Content-Type": "application/json",
+        [PRODUCT_ACTIVATION_CLI_PRODUCT_HEADER]: PRODUCT_ACTIVATION_CLI_PRODUCT_VALUE,
+        [PRODUCT_ACTIVATION_CLI_VERSION_HEADER]: AGENTSKEPTIC_CLI_SEMVER,
+    };
+    if (xRequestId?.trim()) {
+        headers["x-request-id"] = xRequestId.trim();
+    }
     try {
         const res = await fetchWithTimeout(url, {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                [PRODUCT_ACTIVATION_CLI_PRODUCT_HEADER]: PRODUCT_ACTIVATION_CLI_PRODUCT_VALUE,
-                [PRODUCT_ACTIVATION_CLI_VERSION_HEADER]: AGENTSKEPTIC_CLI_SEMVER,
-            },
+            headers,
             body: JSON.stringify({ claim_secret: claimSecret }),
         }, OSS_CLAIM_CONTINUATION_FETCH_TIMEOUT_MS);
         return res.status === 204;

package/dist/telemetry/postOssClaimContinuation.js.map

@@ -1 +1 @@
-{"version":3,"file":"postOssClaimContinuation.js","sourceRoot":"","sources":["../../src/telemetry/postOssClaimContinuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAEpD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAErE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,6BAA6B,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,CAAC,qCAAqC,CAAC,EAAE,oCAAoC;gBAC7E,CAAC,qCAAqC,CAAC,EAAE,uBAAuB;aACjE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;SACpD,EACD,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"postOssClaimContinuation.js","sourceRoot":"","sources":["../../src/telemetry/postOssClaimContinuation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAEpD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAmB,EACnB,UAAmB;IAEnB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAErE,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,6BAA6B,CAAC;IACjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,CAAC,qCAAqC,CAAC,EAAE,oCAAoC;QAC7E,CAAC,qCAAqC,CAAC,EAAE,uBAAuB;KACjE,CAAC;IACF,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,cAAc,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;SACpD,EACD,uCAAuC,CACxC,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/telemetry/postOssClaimTicket.d.ts

@@ -8,12 +8,20 @@ export type PostOssClaimTicketInput = {
     build_profile: "oss" | "commercial";
     /** Mint-time interactive human cohort (`D_ihm`); must match CLI TTY rule in journey SSOT. */
     interactive_human?: boolean;
+    /** Echoed as `x-request-id` (match claim-continuation for the same ticket). */
+    xRequestId?: string;
 };
 export type PostOssClaimTicketResult = {
     outcome: "ok";
     handoff_url: string;
 } | {
     outcome: "already_claimed";
+} | {
+    outcome: "rate_limited";
+} | {
+    outcome: "forbidden";
+} | {
+    outcome: "bad_request";
 } | {
     outcome: "failed";
 };

package/dist/telemetry/postOssClaimTicket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postOssClaimTicket.d.ts","sourceRoot":"","sources":["../../src/telemetry/postOssClaimTicket.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;IAC5D,cAAc,EAAE,kBAAkB,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,yBAAyB,CAAC;IACxE,aAAa,EAAE,KAAK,GAAG,YAAY,CAAC;IACpC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC9B;IAAE,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAuD1B;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAS1G"}
+{"version":3,"file":"postOssClaimTicket.d.ts","sourceRoot":"","sources":["../../src/telemetry/postOssClaimTicket.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;IAC5D,cAAc,EAAE,kBAAkB,GAAG,aAAa,CAAC;IACnD,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,yBAAyB,CAAC;IACxE,aAAa,EAAE,KAAK,GAAG,YAAY,CAAC;IACpC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC9B;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,GAC3B;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,GACxB;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AA6E1B;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAU1G"}

package/dist/telemetry/postOssClaimTicket.js

@@ -8,20 +8,29 @@ const RETRY_MS = [250, 750, 2250];
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+function readProblemCode(j) {
+    if (!j || typeof j.code !== "string")
+        return undefined;
+    return j.code;
+}
 async function postOssClaimTicketOnce(input) {
     if (process.env.AGENTSKEPTIC_TELEMETRY?.trim() === "0")
         return { outcome: "failed" };
     const base = resolveOssClaimApiOrigin();
     const url = `${base}/api/oss/claim-ticket`;
     const telemetry_source = resolveTelemetrySource();
+    const headers = {
+        "Content-Type": "application/json",
+        [PRODUCT_ACTIVATION_CLI_PRODUCT_HEADER]: PRODUCT_ACTIVATION_CLI_PRODUCT_VALUE,
+        [PRODUCT_ACTIVATION_CLI_VERSION_HEADER]: AGENTSKEPTIC_CLI_SEMVER,
+    };
+    if (input.xRequestId?.trim()) {
+        headers["x-request-id"] = input.xRequestId.trim();
+    }
     try {
         const res = await fetchWithTimeout(url, {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                [PRODUCT_ACTIVATION_CLI_PRODUCT_HEADER]: PRODUCT_ACTIVATION_CLI_PRODUCT_VALUE,
-                [PRODUCT_ACTIVATION_CLI_VERSION_HEADER]: AGENTSKEPTIC_CLI_SEMVER,
-            },
+            headers,
             body: JSON.stringify({
                 schema_version: 2,
                 telemetry_source,
@@ -48,6 +57,21 @@ async function postOssClaimTicketOnce(input) {
         if (res.status === 204) {
             return { outcome: "already_claimed" };
         }
+        if (res.status === 429) {
+            return { outcome: "rate_limited" };
+        }
+        if (res.status === 403) {
+            return { outcome: "forbidden" };
+        }
+        if (res.status === 400 || res.status === 413) {
+            const j = (await res.json().catch(() => null));
+            const c = readProblemCode(j);
+            if (c === "RATE_LIMITED")
+                return { outcome: "rate_limited" };
+            if (c === "FORBIDDEN")
+                return { outcome: "forbidden" };
+            return { outcome: "bad_request" };
+        }
         return { outcome: "failed" };
     }
     catch {
@@ -62,6 +86,8 @@ export async function postOssClaimTicket(input) {
         const r = await postOssClaimTicketOnce(input);
         if (r.outcome === "ok" || r.outcome === "already_claimed")
             return r;
+        if (r.outcome === "rate_limited" || r.outcome === "forbidden" || r.outcome === "bad_request")
+            return r;
         if (attempt < RETRY_MS.length) {
             await sleep(RETRY_MS[attempt]);
         }

package/dist/telemetry/postOssClaimTicket.js.map

@@ -1 +1 @@
-{"version":3,"file":"postOssClaimTicket.js","sourceRoot":"","sources":["../../src/telemetry/postOssClaimTicket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAU,CAAC;AAE3C,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAmBD,KAAK,UAAU,sBAAsB,CAAC,KAA8B;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAErF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,uBAAuB,CAAC;IAC3C,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,CAAC,qCAAqC,CAAC,EAAE,oCAAoC;gBAC7E,CAAC,qCAAqC,CAAC,EAAE,uBAAuB;aACjE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,CAAU;gBAC1B,gBAAgB;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF,CAAC;SACH,EACD,iCAAiC,CAClC,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;YACjF,IACE,CAAC;gBACD,CAAC,CAAC,cAAc,KAAK,CAAC;gBACtB,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;gBACjC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EACxB,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;YAAE,OAAO,CAAC,CAAC;QACpE,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"postOssClaimTicket.js","sourceRoot":"","sources":["../../src/telemetry/postOssClaimTicket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAU,CAAC;AAE3C,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAwBD,SAAS,eAAe,CAAC,CAAiC;IACxD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAA8B;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAErF,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,uBAAuB,CAAC;IAC3C,MAAM,gBAAgB,GAAG,sBAAsB,EAAE,CAAC;IAClD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,CAAC,qCAAqC,CAAC,EAAE,oCAAoC;QAC7E,CAAC,qCAAqC,CAAC,EAAE,uBAAuB;KACjE,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,CAAU;gBAC1B,gBAAgB;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF,CAAC;SACH,EACD,iCAAiC,CAClC,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;YACjF,IACE,CAAC;gBACD,CAAC,CAAC,cAAc,KAAK,CAAC;gBACtB,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;gBACjC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EACxB,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;YACjF,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,cAAc;gBAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;YAAE,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,OAAO,CAAC,CAAC;QACvG,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/telemetry/verificationHypothesisContract.d.ts

@@ -1,6 +1,6 @@
 /**
  * Canonical rules for optional `verification_hypothesis` on product-activation wire (schema_version 2).
- * @see docs/funnel-observability-ssot.md (field semantics; charset lives only here).
+ * @see docs/funnel-observability.md (field semantics; charset lives only here).
  */
 export declare const VERIFICATION_HYPOTHESIS_MIN_LEN = 1;
 export declare const VERIFICATION_HYPOTHESIS_MAX_LEN = 240;

package/dist/telemetry/verificationHypothesisContract.js

@@ -1,6 +1,6 @@
 /**
  * Canonical rules for optional `verification_hypothesis` on product-activation wire (schema_version 2).
- * @see docs/funnel-observability-ssot.md (field semantics; charset lives only here).
+ * @see docs/funnel-observability.md (field semantics; charset lives only here).
  */
 export const VERIFICATION_HYPOTHESIS_MIN_LEN = 1;
 export const VERIFICATION_HYPOTHESIS_MAX_LEN = 240;

package/dist/trustDecision.d.ts

@@ -0,0 +1,8 @@
+import type { OutcomeCertificateV1 } from "./outcomeCertificate.js";
+/** Sole operator-facing trust enum for high-stakes gating. */
+export type TrustDecision = "safe" | "unsafe" | "unknown";
+/**
+ * Derive trust from Outcome Certificate v1 (normative: quick_preview is never high-stakes safe).
+ */
+export declare function trustDecisionFromCertificate(certificate: OutcomeCertificateV1): TrustDecision;
+//# sourceMappingURL=trustDecision.d.ts.map

package/dist/trustDecision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustDecision.d.ts","sourceRoot":"","sources":["../src/trustDecision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,oBAAoB,GAAG,aAAa,CAK7F"}

package/dist/trustDecision.js

@@ -0,0 +1,13 @@
+/**
+ * Derive trust from Outcome Certificate v1 (normative: quick_preview is never high-stakes safe).
+ */
+export function trustDecisionFromCertificate(certificate) {
+    if (certificate.runKind === "quick_preview")
+        return "unknown";
+    if (certificate.highStakesReliance === "permitted")
+        return "safe";
+    if (certificate.stateRelation === "does_not_match")
+        return "unsafe";
+    return "unknown";
+}
+//# sourceMappingURL=trustDecision.js.map

package/dist/trustDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustDecision.js","sourceRoot":"","sources":["../src/trustDecision.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAiC;IAC5E,IAAI,WAAW,CAAC,OAAO,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,WAAW,CAAC,kBAAkB,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,WAAW,CAAC,aAAa,KAAK,gBAAgB;QAAE,OAAO,QAAQ,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/types.d.ts

@@ -21,7 +21,25 @@ export type ToolObservedEventV2 = {
     params: Record<string, unknown>;
     timestamp?: string;
 };
-export type ToolObservedEvent = ToolObservedEventV1 | ToolObservedEventV2;
+/** LangGraph checkpoint trust wire: v2 graph ids plus required checkpoint identity. */
+export type LanggraphCheckpointRef = {
+    threadId: string;
+    checkpointNs: string;
+    checkpointId: string;
+};
+export type ToolObservedEventV3 = {
+    schemaVersion: 3;
+    workflowId: string;
+    runEventId: string;
+    parentRunEventId?: string;
+    type: "tool_observed";
+    seq: number;
+    toolId: string;
+    params: Record<string, unknown>;
+    timestamp?: string;
+    langgraphCheckpoint: LanggraphCheckpointRef;
+};
+export type ToolObservedEvent = ToolObservedEventV1 | ToolObservedEventV2 | ToolObservedEventV3;
 export type ModelTurnRunEvent = {
     schemaVersion: 2;
     workflowId: string;
@@ -216,6 +234,63 @@ export type SqlRelationalCheckSpec = {
     filterEqAnchor?: RegistryEqualityPair[];
     filterEqLookup?: RegistryEqualityPair[];
 };
+/** String or JSON pointer in tools.json (const vs /path). */
+export type RegistryStringSpec = {
+    const: string;
+} | {
+    pointer: string;
+};
+export type RegistryNumberOrPointerSpec = {
+    const: number;
+} | {
+    pointer: string;
+};
+export type VectorDocumentVerificationSpec = {
+    kind: "vector_document";
+    provider: "pinecone" | "weaviate" | "chroma";
+    documentId: RegistryStringSpec;
+    indexName: RegistryStringSpec;
+    namespace?: RegistryStringSpec;
+    host?: RegistryStringSpec;
+    metadataEq?: {
+        pointer: string;
+    };
+    expectPayloadSha256?: RegistryStringSpec;
+};
+export type ObjectStorageVerificationSpec = {
+    kind: "object_storage_object";
+    bucket: RegistryStringSpec;
+    key: RegistryStringSpec;
+    endpoint?: RegistryStringSpec;
+    expectSizeBytes?: RegistryNumberOrPointerSpec;
+    expectSha256?: RegistryStringSpec;
+    expectEtag?: RegistryStringSpec;
+};
+export type HttpWitnessAssertionSpec = {
+    jsonPointer: string;
+    value: {
+        const: string | number | boolean | null;
+    } | {
+        pointer: string;
+    };
+};
+export type HttpWitnessVerificationSpec = {
+    kind: "http_witness";
+    method?: "GET" | "POST";
+    url: RegistryStringSpec;
+    expectedStatus?: RegistryNumberOrPointerSpec;
+    assertions?: HttpWitnessAssertionSpec[];
+};
+export type MongoDocumentVerificationSpec = {
+    kind: "mongo_document";
+    collection: RegistryStringSpec;
+    filterPointer: {
+        pointer: string;
+    };
+    requiredFields: {
+        pointer: string;
+    };
+};
 export type ToolRegistryVerification = ({
     kind: "sql_row";
 } & SqlRowVerificationSpec) | ({
@@ -228,7 +303,7 @@ export type ToolRegistryVerification = ({
 } | {
     kind: "sql_relational";
     checks: SqlRelationalCheckSpec[];
-};
+} | VectorDocumentVerificationSpec | ObjectStorageVerificationSpec | HttpWitnessVerificationSpec | MongoDocumentVerificationSpec;
 export type ToolRegistryEntry = {
     toolId: string;
     effectDescriptionTemplate: string;
@@ -330,13 +405,59 @@ export type SqlRelationalVerificationPayload = {
     kind: "sql_relational";
     checks: ResolvedRelationalCheck[];
 };
-export type StepVerificationRequest = VerificationRequest | RowAbsentVerificationRequest | SqlEffectsVerificationPayload | SqlRelationalVerificationPayload | null;
+export type VectorDocumentVerificationRequest = {
+    kind: "vector_document";
+    provider: "pinecone" | "weaviate" | "chroma";
+    documentId: string;
+    indexName: string;
+    namespace?: string;
+    host?: string;
+    metadataSubset?: Record<string, VerificationScalar>;
+    expectPayloadSha256?: string;
+};
+export type ObjectStorageVerificationRequest = {
+    kind: "object_storage_object";
+    bucket: string;
+    key: string;
+    endpoint?: string;
+    expectSizeBytes?: number;
+    expectSha256?: string;
+    expectEtag?: string;
+};
+export type HttpWitnessResolvedAssertion = {
+    jsonPointer: string;
+    value: VerificationScalar;
+};
+export type HttpWitnessVerificationRequest = {
+    kind: "http_witness";
+    method: "GET" | "POST";
+    url: string;
+    expectedStatus: number;
+    assertions?: HttpWitnessResolvedAssertion[];
+};
+export type MongoDocumentVerificationRequest = {
+    kind: "mongo_document";
+    collection: string;
+    filter: Record<string, unknown>;
+    requiredFields: Record<string, VerificationScalar>;
+};
+export type StateWitnessRequest = VectorDocumentVerificationRequest | ObjectStorageVerificationRequest | HttpWitnessVerificationRequest | MongoDocumentVerificationRequest;
+export type StepVerificationRequest = VerificationRequest | RowAbsentVerificationRequest | SqlEffectsVerificationPayload | SqlRelationalVerificationPayload | VectorDocumentVerificationRequest | ObjectStorageVerificationRequest | HttpWitnessVerificationRequest | MongoDocumentVerificationRequest | null;
 export type StepStatus = "verified" | "missing" | "inconsistent" | "incomplete_verification" | "partially_verified" | "uncertain";
 /** Active verification timing/consistency contract (emitted on WorkflowResult). */
 export type VerificationPolicy = {
-    consistencyMode: "strong" | "eventual";
+    consistencyMode: "strong";
+    verificationWindowMs: number;
+    pollIntervalMs: number;
+} | {
+    consistencyMode: "eventual";
     verificationWindowMs: number;
     pollIntervalMs: number;
+} | {
+    consistencyMode: "bounded";
+    verificationWindowMs: number;
+    pollIntervalMs: number;
+    maxStalenessMs: number;
 };
 export type Reason = {
     code: string;
@@ -368,6 +489,8 @@ export type StepOutcome = {
     evaluatedObservationOrdinal: number;
     /** Required when status is not verified; must be absent when status is verified. */
     failureDiagnostic?: FailureDiagnostic;
+    /** Present when source `tool_observed` was schemaVersion 3 (LangGraph checkpoint trust wire). */
+    langgraphCheckpointKey?: string;
 };
 export type WorkflowStatus = "complete" | "incomplete" | "inconsistent";
 export type EventSequenceIntegrity = {
@@ -384,7 +507,7 @@ export type VerificationRunContextLastEvent = {
 };
 /** Digest of v2 run graph + tool_observed positions; built at verify time from `runEvents`. */
 export type VerificationRunContext = {
-    maxWireSchemaVersion: 1 | 2;
+    maxWireSchemaVersion: 1 | 2 | 3;
     retrievalEvents: Array<{
         ingestIndex: number;
         runEventId: string | null;
@@ -650,7 +773,7 @@ export type ExecutionTraceVerificationLink = {
 export type ExecutionTraceNode = {
     ingestIndex: number;
     runEventId: string;
-    wireSchemaVersion: 1 | 2;
+    wireSchemaVersion: 1 | 2 | 3;
     wireType: RunEvent["type"];
     parentRunEventId: string | null;
     traceStepKind: TraceStepKind;
@@ -695,12 +818,21 @@ export type LoadEventsResult = {
     malformedEventLineCount: number;
     eventFileAggregateCounts: EventFileAggregateCounts;
 };
-/** Batch / CLI verification target (`verifyWorkflow`). In-process hook remains SQLite `dbPath` only. */
+/** Batch / CLI verification target (`verifyWorkflow`) and `createDecisionGate` (`databaseUrl`). */
 export type VerificationDatabase = {
     kind: "sqlite";
     path: string;
 } | {
     kind: "postgres";
     connectionString: string;
+} | {
+    kind: "mysql";
+    connectionString: string;
+} | {
+    kind: "bigquery";
+    connectionString: string;
+} | {
+    kind: "sqlserver";
+    connectionString: string;
 };
 //# sourceMappingURL=types.d.ts.map