@coderifts/agent-guard 1.0.0

package/dist/cjs/guard.js

@@ -0,0 +1,343 @@
+"use strict";
+/**
+ * @coderifts/agent-guard — guardToolCall (the security-core control flow).
+ *
+ * Order (frozen spec): redactor(call) -> input_fingerprint on the redacted call -> detect ->
+ * preflight (unless SKIPPED) -> decide -> executeFactory(envelope, redactedCall) IFF SKIPPED or
+ * CONTINUE / CONTINUE_WITH_MONITORING (or observeOnly). Fail-closed on every unknown; INTEGRITY
+ * causes always resolve CLOSED + trip the breaker; enforced:true only on a LIVE receipt-verified
+ * ALLOW/MONITOR; LKG is dormant in v1 (binding fields absent => UNUSABLE => closed). onEvent never throws.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardToolCall = guardToolCall;
+const node_crypto_1 = require("node:crypto");
+const sdk_1 = require("@coderifts/sdk");
+const detector_js_1 = require("./detector.js");
+// Per-config breaker state (time-window; not consecutive).
+const breakers = new WeakMap();
+const nowMs = () => Date.now();
+const iso = () => new Date().toISOString();
+function emit(config, e) {
+    if (config.onEvent) {
+        try {
+            config.onEvent(e);
+        }
+        catch { /* onEvent never throws out */ }
+    }
+}
+function fingerprint(call) {
+    const canon = JSON.stringify({ toolName: call.toolName, arguments: call.arguments, artifacts: call.artifacts, filesTouched: call.filesTouched, diff: call.diff });
+    return 'sha256:' + (0, node_crypto_1.createHash)('sha256').update(canon).digest('hex');
+}
+function breakerRecord(config) {
+    let s = breakers.get(config);
+    if (!s) {
+        s = { fails: [] };
+        breakers.set(config, s);
+    }
+    s.fails.push(nowMs());
+}
+function breakerTripped(config) {
+    const s = breakers.get(config);
+    if (!s)
+        return false;
+    const win = config.breakerWindowMs ?? 60000;
+    const t = nowMs();
+    s.fails = s.fails.filter((x) => t - x < win);
+    return s.fails.length >= (config.maxUnavailablePerWindow ?? 3);
+}
+function classifyError(err, config) {
+    const e = err;
+    const name = e?.name;
+    const status = e?.status ?? e?.body?.status;
+    if (name === 'TimeoutError' || name === 'AbortError' || e?.code === 'ABORT_ERR')
+        return { cause: 'TIMEOUT', integrity: false };
+    if (status === 429 || name === 'RateLimitError')
+        return { cause: 'RATE_LIMITED', integrity: false };
+    if (status === 413)
+        return { cause: 'PAYLOAD_TOO_LARGE', integrity: true };
+    if (status === 422)
+        return { cause: 'REQUEST_REJECTED', integrity: true };
+    if (status === 400 || status === 401 || status === 409)
+        return { cause: 'REQUEST_REJECTED', integrity: true };
+    if (typeof status === 'number' && status >= 500)
+        return { cause: 'SERVER_ERROR', integrity: false };
+    if (name === 'TypeError' || /fetch failed|network|ENOTFOUND|ECONNREFUSED|EAI_AGAIN/i.test(String(e?.message)))
+        return { cause: 'NETWORK', integrity: false };
+    if (name === 'ApiError')
+        return { cause: 'SERVER_ERROR', integrity: false };
+    return { cause: 'INVALID_RESPONSE', integrity: true }; // unrecognized => integrity => closed
+}
+function withTimeout(p, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(Object.assign(new Error(`preflight timed out after ${ms}ms`), { name: 'TimeoutError' })), Math.max(1, ms));
+        p.then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });
+    });
+}
+async function preflightWithRetry(config, request) {
+    const retries = config.retries ?? 1;
+    const timeoutMs = config.timeoutMs ?? 2000;
+    const budget = config.totalBudgetMs ?? 4500;
+    const start = nowMs();
+    let last = { cause: 'TIMEOUT', integrity: false };
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        const remaining = budget - (nowMs() - start);
+        if (remaining <= 0)
+            return { ok: false, cause: 'TIMEOUT', integrity: false };
+        try {
+            const response = await withTimeout(config.client.preflightChangeSet(request), Math.min(timeoutMs, remaining));
+            return { ok: true, response };
+        }
+        catch (err) {
+            last = classifyError(err, config);
+            if (last.integrity)
+                return { ok: false, ...last }; // integrity: never retry
+        }
+    }
+    return { ok: false, ...last };
+}
+/** Verify the envelope's receipt via the SDK. Returns the BRANDED envelope only when verified. */
+async function verifyEnvelope(config, envelope) {
+    if (!envelope)
+        return null;
+    if (config.verifyReceipts === false)
+        return null; // opt-out => cannot brand => unenforceable + LKG unusable
+    const token = envelope.receipt?.token;
+    if (!token)
+        return null;
+    try {
+        const r = await config.client.verifyReceipt(token);
+        if (r && r.valid === true)
+            return envelope;
+    }
+    catch { /* verification failure is handled as RECEIPT_UNVERIFIED by the caller */ }
+    return null;
+}
+// ── Outcome builders (keep the discriminated union satisfied) ────────────────────
+async function runEnforced(config, factory, approved, redacted) {
+    emit(config, { type: 'execution_started', at: iso(), action: approved.action, decisionId: approved.envelope.decision_id });
+    try {
+        const result = await factory(approved.envelope, redacted);
+        return { executionAttempted: true, executed: true, enforced: true, result, verdict: approved, preflighted: true };
+    }
+    catch (error) {
+        emit(config, { type: 'factory_error', at: iso(), action: approved.action });
+        return { executionAttempted: true, executed: false, enforced: true, error, verdict: approved, preflighted: true };
+    }
+}
+async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted) {
+    emit(config, { type: 'execution_started', at: iso() });
+    try {
+        const result = await factory(envelope, redacted);
+        return { executionAttempted: true, executed: true, enforced: false, result, verdict, preflighted };
+    }
+    catch (error) {
+        emit(config, { type: 'factory_error', at: iso() });
+        return { executionAttempted: true, executed: false, enforced: false, error, verdict, preflighted };
+    }
+}
+function blocked(verdict, preflighted) {
+    return { executionAttempted: false, executed: false, enforced: false, verdict, preflighted };
+}
+function unavailableVerdict(parts, count) {
+    return { kind: 'UNAVAILABLE', decisionMissing: true, unavailableCount: count, ...parts };
+}
+async function guardToolCall(call, executeFactory, config) {
+    const failPolicy = config.failPolicy ?? 'closed';
+    // 12. redactor runs FIRST; everything downstream uses the redacted descriptor.
+    let redacted;
+    try {
+        redacted = config.redactor ? config.redactor(call) : call;
+    }
+    catch {
+        // A redactor throw is a CONFIG_ERROR (integrity) => closed.
+        breakerRecord(config);
+        return closedIntegrity(config, 'CONFIG_ERROR', failPolicy);
+    }
+    const inputFp = fingerprint(redacted); // used for LKG lookup (dormant in v1)
+    // 8/9. detector is fail-safe but a THROW is a DETECTOR_ERROR (integrity) => closed.
+    const detector = config.detector ?? detector_js_1.builtinDetector;
+    let detection;
+    try {
+        detection = detector.detect(redacted);
+    }
+    catch {
+        breakerRecord(config);
+        return closedIntegrity(config, 'DETECTOR_ERROR', failPolicy);
+    }
+    // requireExplicitArtifacts strict SKIP gate: suppress only when nonContract===true AND no signal.
+    const suppressedByStrict = config.requireExplicitArtifacts === true && redacted.nonContract === true
+        && (!detection.artifacts || detection.artifacts.length === 0) && detection.confident && !detection.trigger;
+    // SKIPPED path: not a contract call => execute with enforced:false, preflighted:false.
+    if (!detection.trigger || suppressedByStrict) {
+        emit(config, { type: 'detection_skip', at: iso(), signals: detection.signals, detectorVersion: detector.version });
+        const verdict = { kind: 'SKIPPED', reason: 'NOT_A_CONTRACT_CALL', signals: detection.signals, detectorVersion: detector.version };
+        return runUnenforced(config, executeFactory, null, verdict, false, redacted);
+    }
+    // config validation: lkg policy requires an LkgStore.
+    if (failPolicy === 'lkg' && !config.lkg) {
+        breakerRecord(config);
+        return closedIntegrity(config, 'CONFIG_ERROR', failPolicy);
+    }
+    // build the preflight request from the detected artifacts.
+    const request = {
+        artifacts: detection.artifacts,
+        context: { operation: config.operation ?? 'tool_call', environment: config.environment, audience: config.audience },
+        previous_receipt: undefined,
+        idempotency_key: undefined,
+    };
+    // request-attributable payload cap => PAYLOAD_TOO_LARGE (integrity) => closed.
+    const cap = config.maxPayloadBytes ?? 1_000_000;
+    if (Buffer.byteLength(JSON.stringify(request), 'utf8') > cap) {
+        breakerRecord(config);
+        return closedIntegrity(config, 'PAYLOAD_TOO_LARGE', failPolicy);
+    }
+    emit(config, { type: 'preflight_start', at: iso() });
+    const pf = await preflightWithRetry(config, request);
+    if (!pf.ok) {
+        // UNAVAILABLE. Integrity => always closed + breaker. Availability => failPolicy.
+        breakerRecord(config);
+        const count = (breakers.get(config)?.fails.length) ?? 1;
+        if (pf.integrity) {
+            emit(config, { type: 'breaker_tripped', at: iso(), cause: pf.cause });
+            const v = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+            return blocked(v, false);
+        }
+        // availability
+        const availCause = pf.cause;
+        if (failPolicy === 'open' && !breakerTripped(config)) {
+            emit(config, { type: 'preflight_unavailable', at: iso(), cause: availCause, action: 'CONTINUE' });
+            const v = unavailableVerdict({ cause: availCause, failPolicy: 'open', resolution: 'OPEN_PASSTHROUGH', action: 'CONTINUE' }, count);
+            return runUnenforced(config, executeFactory, null, v, false, redacted);
+        }
+        if (failPolicy === 'lkg') {
+            const lkg = await tryLkg(config, inputFp);
+            if (lkg) {
+                emit(config, { type: 'preflight_unavailable', at: iso(), cause: availCause, action: lkg.action });
+                const v = unavailableVerdict({ cause: availCause, failPolicy: 'lkg', resolution: 'LKG_SUBSTITUTION', action: lkg.action, lkgEnvelope: lkg.envelope }, count);
+                return runUnenforced(config, executeFactory, lkg.envelope, v, false, redacted); // LKG NEVER enforces
+            }
+            // LKG unusable (dormant in v1: binding fields absent) => closed.
+        }
+        if (breakerTripped(config))
+            emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
+        const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+        return blocked(v, false);
+    }
+    // We have a response. Read the decision (envelope-first) and verify the receipt.
+    const rd = (0, sdk_1.readDecision)(pf.response);
+    if (rd.reason === 'UNREADABLE_DECISION' || !rd.envelope) {
+        // Schema-invalid / no envelope => integrity => closed.
+        breakerRecord(config);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy);
+    }
+    const envelope = rd.envelope;
+    // 5. expiry check before honoring any decision.
+    const expired = isExpired(envelope);
+    const verified = await verifyEnvelope(config, envelope);
+    const receiptVerified = !!verified;
+    if (!receiptVerified)
+        emit(config, { type: 'receipt_unverified', at: iso(), decisionId: envelope.decision_id });
+    emit(config, { type: 'preflight_result', at: iso(), action: rd.executionAction, decisionId: envelope.decision_id });
+    // A bad signature (verifyReceipts on, token present, verify failed) is an INTEGRITY attack signal.
+    if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
+        breakerRecord(config);
+        return closedIntegrity(config, 'RECEIPT_UNVERIFIED', failPolicy);
+    }
+    const action = rd.executionAction;
+    // Non-executable decisions.
+    if (action === 'STOP')
+        return blocked({ kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true);
+    if (action === 'REQUEST_APPROVAL')
+        return blocked({ kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true);
+    // An expired decision cannot be honored fresh => closed (integrity: wrong-time state).
+    if (expired) {
+        breakerRecord(config);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy);
+    }
+    // Executable: CONTINUE (ALLOW) or CONTINUE_WITH_MONITORING (MONITOR).
+    const kind = action === 'CONTINUE' ? 'ALLOW' : 'MONITOR';
+    const sinkWired = !!config.onEvent; // v1: onEvent is the telemetry sink for MONITOR.
+    if (kind === 'MONITOR') {
+        if (sinkWired)
+            emit(config, { type: 'monitoring_required', at: iso(), decisionId: envelope.decision_id });
+        else
+            emit(config, { type: 'monitoring_unwired', at: iso(), decisionId: envelope.decision_id });
+    }
+    // observeOnly executes but never enforces.
+    if (config.observeOnly) {
+        emit(config, { type: 'observe_only_passthrough', at: iso(), action });
+        const verdict = kind === 'ALLOW'
+            ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
+            : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
+        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
+    }
+    // enforced:true requires a LIVE receipt-verified ALLOW/MONITOR, and (MONITOR) a wired sink.
+    const enforceable = receiptVerified && (kind === 'ALLOW' || sinkWired);
+    if (enforceable) {
+        const approved = kind === 'ALLOW'
+            ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified: true }
+            : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified: true };
+        return runEnforced(config, executeFactory, approved, redacted);
+    }
+    // MONITOR with no sink (monitoring_unwired): execute but enforced:false.
+    const verdict = kind === 'ALLOW'
+        ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
+        : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
+    return runUnenforced(config, executeFactory, envelope, verdict, true, redacted);
+}
+function closedIntegrity(config, cause, failPolicy) {
+    const count = (breakers.get(config)?.fails.length) ?? 1;
+    emit(config, { type: 'breaker_tripped', at: iso(), cause });
+    const v = unavailableVerdict({ cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+    return blocked(v, false);
+}
+function isExpired(envelope) {
+    const exp = envelope.expires_at;
+    if (typeof exp !== 'string')
+        return false;
+    const t = Date.parse(exp);
+    return Number.isFinite(t) && t < Date.now();
+}
+/** LKG substitution attempt. Dormant in v1: binding fields (ruleset_hash/environment/operation/
+ * audience) are absent from decision-result.v1, so any binding that cannot be evaluated => UNUSABLE. */
+async function tryLkg(config, inputFp) {
+    if (!config.lkg)
+        return null;
+    let cached;
+    try {
+        cached = await config.lkg.get(inputFp);
+    }
+    catch {
+        return null;
+    }
+    if (!cached)
+        return null;
+    // Receipt verification is UNCONDITIONAL for LKG (with verifyReceipts:false it cannot brand => unusable).
+    const verified = await verifyEnvelope(config, cached);
+    if (!verified)
+        return null;
+    // Eligibility (rule 15): decision ALLOW|WARN, unexpired, age<lkgMaxAgeMs, fingerprint + ruleset_hash
+    // + environment + operation + audience all match. Any binding that cannot be evaluated => UNUSABLE.
+    const dec = cached.decision ?? '';
+    if (dec !== 'ALLOW' && dec !== 'WARN')
+        return null;
+    if (isExpired(cached))
+        return null;
+    const maxAge = config.lkgMaxAgeMs ?? 900000;
+    const evalAt = Date.parse(cached.evaluated_at);
+    if (Number.isFinite(evalAt) && Date.now() - evalAt > maxAge)
+        return null;
+    // Binding fields are NOT present in the frozen schema => cannot be evaluated => UNUSABLE (closed).
+    const bindings = [
+        cached.ruleset_hash,
+        cached.environment,
+        cached.operation,
+        cached.audience,
+    ];
+    if (bindings.some((b) => b === undefined))
+        return null; // any absent binding => UNUSABLE => closed
+    const action = dec === 'ALLOW' ? 'CONTINUE' : 'CONTINUE_WITH_MONITORING';
+    return { envelope: verified, action };
+}
+//# sourceMappingURL=guard.js.map

package/dist/cjs/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAgIH,sCA2JC;AAzRD,6CAAyC;AACzC,wCAA8C;AAM9C,+CAAgD;AAEhD,2DAA2D;AAC3D,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoC,CAAC;AAEjE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE3C,SAAS,IAAI,CAAC,MAAmB,EAAE,CAAa;IAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClK,OAAO,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AACxB,CAAC;AACD,SAAS,cAAc,CAAC,MAAmB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAmB;IACtD,MAAM,CAAC,GAAG,GAAkH,CAAC;IAC7H,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;IAC5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/H,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpG,IAAI,IAAI,KAAK,WAAW,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7J,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,sCAAsC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjJ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,OAAgB;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;IACtB,IAAI,IAAI,GAAoD,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAE,MAAM,CAAC,MAA+D,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACxK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,yBAAyB;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,cAAc,CAAC,MAAmB,EAAE,QAAuC;IACxF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,0DAA0D;IAC5G,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAO,MAAM,CAAC,MAAqE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACnH,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,QAAmC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC,CAAC,yEAAyE,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,WAAW,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAyB,EAAE,QAA4B;IACpI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3H,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;AACH,CAAC;AACD,KAAK,UAAU,aAAa,CAAI,MAAmB,EAAE,OAA0B,EAAE,QAAuC,EAAE,OAAqB,EAAE,WAAoB,EAAE,QAA4B;IACjM,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACrG,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAI,OAAqB,EAAE,WAAoB;IAC7D,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/F,CAAC;AAQD,SAAS,kBAAkB,CAAC,KAAY,EAAE,KAAa;IACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3F,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,cAAiC,EACjC,MAAmB;IAEnB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC;IAEjD,+EAA+E;IAC/E,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC;IAE7E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,6BAAe,CAAC;IACpD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,kGAAkG;IAClG,MAAM,kBAAkB,GAAG,MAAM,CAAC,wBAAwB,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;WAC/F,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IAE7G,uFAAuF;IACvF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChJ,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAED,sDAAsD;IACtD,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QACnH,gBAAgB,EAAE,SAA+B;QACjD,eAAe,EAAE,SAA+B;KACjD,CAAC;IAEF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAC7D,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,iFAAiF;QACjF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAuB,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7H,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,eAAe;QACf,MAAM,UAAU,GAAG,EAAE,CAAC,KAA0B,CAAC;QACjD,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACnI,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7J,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB;YACvG,CAAC;YACD,iEAAiE;QACnE,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7G,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,GAAG,IAAA,kBAAY,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxD,uDAAuD;QACvD,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;IAE7B,gDAAgD;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,CAAC,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,eAAe;QAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpH,mGAAmG;IACnG,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACnF,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,eAAe,CAAC;IAElC,4BAA4B;IAC5B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IAErI,uFAAuF;IACvF,IAAI,OAAO,EAAE,CAAC;QAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAAC,CAAC;IAErG,sEAAsE;IACtE,MAAM,IAAI,GAAG,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,iDAAiD;IACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;;YACrG,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,2CAA2C;IAC3C,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAiB,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;YAClE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvF,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,4FAA4F;IAC5F,MAAM,WAAW,GAAG,eAAe,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAoB,IAAI,KAAK,OAAO;YAChD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE;YACxE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC7F,OAAO,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,yEAAyE;IACzE,MAAM,OAAO,GAAiB,IAAI,KAAK,OAAO;QAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE;QAClE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;IACvF,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,eAAe,CAAI,MAAmB,EAAE,KAAqB,EAAE,UAAqC;IAC3G,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgC;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED;wGACwG;AACxG,KAAK,UAAU,MAAM,CAAC,MAAmB,EAAE,OAAe;IACxD,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,yGAAyG;IACzG,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,GAAG,GAAI,MAAM,CAAC,QAAmB,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,mGAAmG;IACnG,MAAM,QAAQ,GAAmB;QAC9B,MAA6C,CAAC,YAAY;QAC1D,MAA6C,CAAC,WAAW;QACzD,MAA6C,CAAC,SAAS;QACvD,MAA6C,CAAC,QAAQ;KACxD,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IACnG,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @coderifts/agent-guard — fail-closed guard for AI agent tool calls.
+ *
+ * Preflight contract changes before they execute. Security core FROZEN (agent-guard-api v1.0).
+ *
+ * @example
+ * ```ts
+ * import { guardToolCall } from '@coderifts/agent-guard';
+ * import { CodeRifts } from '@coderifts/sdk';
+ *
+ * const client = new CodeRifts({ apiKey: 'cr_live_...' });
+ * const outcome = await guardToolCall(
+ *   { toolName: 'Edit', arguments: { path: 'openapi.yaml', ... }, filesTouched: ['openapi.yaml'] },
+ *   async (envelope, redactedCall) => applyTheEdit(redactedCall),
+ *   { client },
+ * );
+ * if (!outcome.executed) console.error('blocked:', outcome.verdict);
+ * ```
+ */
+export { guardToolCall } from './guard.js';
+export { builtinDetector, DETECTOR_VERSION } from './detector.js';
+export { readDecision } from '@coderifts/sdk';
+export type { ReceiptVerifiedEnvelope, GuardConfig, ToolCallDescriptor, ExecuteFactory, ApprovedVerdict, GuardOutcome, GuardVerdict, UnavailableVerdict, AvailabilityCause, IntegrityCause, UnavailableCause, TriggerDetector, LkgStore, GuardEvent, CodeRifts, DecisionResultEnvelope, ExecutionAction, Artifact, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * @coderifts/agent-guard — fail-closed guard for AI agent tool calls.
+ *
+ * Preflight contract changes before they execute. Security core FROZEN (agent-guard-api v1.0).
+ *
+ * @example
+ * ```ts
+ * import { guardToolCall } from '@coderifts/agent-guard';
+ * import { CodeRifts } from '@coderifts/sdk';
+ *
+ * const client = new CodeRifts({ apiKey: 'cr_live_...' });
+ * const outcome = await guardToolCall(
+ *   { toolName: 'Edit', arguments: { path: 'openapi.yaml', ... }, filesTouched: ['openapi.yaml'] },
+ *   async (envelope, redactedCall) => applyTheEdit(redactedCall),
+ *   { client },
+ * );
+ * if (!outcome.executed) console.error('blocked:', outcome.verdict);
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDecision = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
+var guard_js_1 = require("./guard.js");
+Object.defineProperty(exports, "guardToolCall", { enumerable: true, get: function () { return guard_js_1.guardToolCall; } });
+var detector_js_1 = require("./detector.js");
+Object.defineProperty(exports, "builtinDetector", { enumerable: true, get: function () { return detector_js_1.builtinDetector; } });
+Object.defineProperty(exports, "DETECTOR_VERSION", { enumerable: true, get: function () { return detector_js_1.DETECTOR_VERSION; } });
+var sdk_1 = require("@coderifts/sdk");
+Object.defineProperty(exports, "readDecision", { enumerable: true, get: function () { return sdk_1.readDecision; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,sCAA8C;AAArC,mGAAA,YAAY,OAAA"}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/types.d.ts

@@ -0,0 +1,171 @@
+/**
+ * @coderifts/agent-guard — public types (FROZEN security core, agent-guard-api v1.0, 2026-07-26).
+ *
+ * Transcribed VERBATIM from agent-guard-api.FROZEN-v1.0.md § Core API. The discriminated unions
+ * encode the frozen invariants at the type level (tsc-verified): TOCTOU (ExecuteFactory signature),
+ * retry-footgun (executionAttempted split), enforced-bypass (ApprovedVerdict + receiptVerified on
+ * every arm), integrity-fail-open (discriminated UnavailableVerdict), unverified-envelope execution
+ * (branded ReceiptVerifiedEnvelope). Fail-closed by default.
+ */
+import type { CodeRifts, DecisionResultEnvelope, ExecutionAction, Artifact } from '@coderifts/sdk';
+export type { CodeRifts, DecisionResultEnvelope, ExecutionAction, Artifact } from '@coderifts/sdk';
+export type ReceiptVerifiedEnvelope = DecisionResultEnvelope & {
+    readonly __receiptVerified: unique symbol;
+};
+export interface GuardConfig {
+    client: CodeRifts;
+    failPolicy?: 'closed' | 'open' | 'lkg';
+    timeoutMs?: number;
+    retries?: number;
+    totalBudgetMs?: number;
+    maxUnavailablePerWindow?: number;
+    breakerWindowMs?: number;
+    maxPayloadBytes?: number;
+    environment?: string;
+    operation?: string;
+    audience?: string;
+    detector?: TriggerDetector;
+    requireExplicitArtifacts?: boolean;
+    lkg?: LkgStore;
+    lkgMaxAgeMs?: number;
+    observeOnly?: boolean;
+    redactor?: (d: ToolCallDescriptor) => ToolCallDescriptor;
+    verifyReceipts?: boolean;
+    onEvent?: (e: GuardEvent) => void;
+}
+export interface ToolCallDescriptor {
+    toolName: string;
+    arguments: unknown;
+    artifacts?: Artifact[];
+    nonContract?: boolean;
+    intent?: string;
+    filesTouched?: string[];
+    diff?: string;
+}
+export type ExecuteFactory<T> = (envelope: DecisionResultEnvelope | null, redactedCall: ToolCallDescriptor) => Promise<T>;
+export type ApprovedVerdict = ({
+    kind: 'ALLOW';
+    action: 'CONTINUE';
+    envelope: DecisionResultEnvelope;
+} | {
+    kind: 'MONITOR';
+    action: 'CONTINUE_WITH_MONITORING';
+    envelope: DecisionResultEnvelope;
+}) & {
+    receiptVerified: true;
+};
+export type GuardOutcome<T> = {
+    executionAttempted: true;
+    executed: true;
+    enforced: true;
+    result: T;
+    verdict: ApprovedVerdict;
+    preflighted: true;
+} | {
+    executionAttempted: true;
+    executed: true;
+    enforced: false;
+    result: T;
+    verdict: GuardVerdict;
+    preflighted: boolean;
+} | {
+    executionAttempted: false;
+    executed: false;
+    enforced: false;
+    verdict: GuardVerdict;
+    preflighted: boolean;
+} | {
+    executionAttempted: true;
+    executed: false;
+    enforced: true;
+    error: unknown;
+    verdict: ApprovedVerdict;
+    preflighted: true;
+} | {
+    executionAttempted: true;
+    executed: false;
+    enforced: false;
+    error: unknown;
+    verdict: GuardVerdict;
+    preflighted: boolean;
+};
+export type GuardVerdict = {
+    kind: 'ALLOW';
+    action: 'CONTINUE';
+    envelope: DecisionResultEnvelope;
+    receiptVerified: boolean;
+} | {
+    kind: 'MONITOR';
+    action: 'CONTINUE_WITH_MONITORING';
+    envelope: DecisionResultEnvelope;
+    receiptVerified: boolean;
+} | {
+    kind: 'APPROVAL';
+    action: 'REQUEST_APPROVAL';
+    envelope: DecisionResultEnvelope;
+    receiptVerified: boolean;
+} | {
+    kind: 'BLOCK';
+    action: 'STOP';
+    envelope: DecisionResultEnvelope;
+    receiptVerified: boolean;
+} | {
+    kind: 'SKIPPED';
+    reason: 'NOT_A_CONTRACT_CALL';
+    signals: string[];
+    detectorVersion: string;
+} | UnavailableVerdict;
+export type UnavailableVerdict = {
+    kind: 'UNAVAILABLE';
+    decisionMissing: true;
+    unavailableCount: number;
+} & ({
+    cause: IntegrityCause;
+    failPolicy: 'closed' | 'open' | 'lkg';
+    resolution: 'CLOSED';
+    action: 'STOP';
+} | {
+    cause: AvailabilityCause;
+    failPolicy: 'closed' | 'open' | 'lkg';
+    resolution: 'CLOSED';
+    action: 'STOP';
+} | {
+    cause: AvailabilityCause;
+    failPolicy: 'open';
+    resolution: 'OPEN_PASSTHROUGH';
+    action: 'CONTINUE';
+} | {
+    cause: AvailabilityCause;
+    failPolicy: 'lkg';
+    resolution: 'LKG_SUBSTITUTION';
+    action: 'CONTINUE' | 'CONTINUE_WITH_MONITORING';
+    lkgEnvelope: ReceiptVerifiedEnvelope;
+});
+export type AvailabilityCause = 'TIMEOUT' | 'NETWORK' | 'SERVER_ERROR' | 'RATE_LIMITED';
+export type IntegrityCause = 'INVALID_RESPONSE' | 'UNSUPPORTED_VERSION' | 'SCHEMA_INVALID' | 'RECEIPT_UNVERIFIED' | 'DETECTOR_ERROR' | 'CONFIG_ERROR' | 'PAYLOAD_TOO_LARGE' | 'REQUEST_REJECTED';
+export type UnavailableCause = AvailabilityCause | IntegrityCause;
+export interface TriggerDetector {
+    version: string;
+    detect(call: ToolCallDescriptor): {
+        trigger: boolean;
+        artifacts: Artifact[];
+        signals: string[];
+        confident: boolean;
+    };
+}
+export interface LkgStore {
+    get(inputFingerprint: string): Promise<DecisionResultEnvelope | null>;
+    put(env: DecisionResultEnvelope): Promise<void>;
+}
+export type GuardEvent = {
+    type: 'preflight_start' | 'preflight_result' | 'preflight_unavailable' | 'detection_skip' | 'execution_started' | 'execution_skipped' | 'monitoring_required' | 'monitoring_unwired' | 'receipt_unverified' | 'breaker_tripped' | 'observe_only_passthrough' | 'factory_error';
+    at: string;
+    correlationId?: string;
+    decisionId?: string;
+    action?: ExecutionAction;
+    cause?: string;
+    durationMs?: number;
+    signals?: string[];
+    detectorVersion?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/cjs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEnG,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAInG,MAAM,MAAM,uBAAuB,GACjC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,EAAE,YAAY,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAI1H,MAAM,MAAM,eAAe,GACzB,CAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAAE,GAC3F;IAAE,eAAe,EAAE,IAAI,CAAA;CAAE,CAAC;AAE9B,MAAM,MAAM,YAAY,CAAC,CAAC,IAEtB;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GAEzH;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAEzH;IAAE,kBAAkB,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAc,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAEzH;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GAE5H;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAIjI,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,UAAU,CAAC;IAAiB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAS,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,MAAM,CAAC;IAAqB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,qBAAqB,CAAC;IAAM,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACpG,kBAAkB,CAAC;AAIvB,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IACnD,eAAe,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG,CAEpD;IAAE,KAAK,EAAE,cAAc,CAAC;IAAI,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAEpG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAC5E,MAAM,EAAE,UAAU,GAAG,0BAA0B,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,CAC5F,CAAC;AAKF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,cAAc,CAAC;AACxF,MAAM,MAAM,cAAc,GACxB,kBAAkB,GAAG,qBAAqB,GAAG,gBAAgB,GAC3D,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GACxD,mBAAmB,GACnB,kBAAkB,CAAC;AACvB,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAIlE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAC7B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CACtF;AAED,MAAM,WAAW,QAAQ;IAIvB,GAAG,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,iBAAiB,GAAC,kBAAkB,GAAC,uBAAuB,GAC7D,gBAAgB,GAAC,mBAAmB,GAAC,mBAAmB,GACxD,qBAAqB,GAAC,oBAAoB,GAAC,oBAAoB,GAC/D,iBAAiB,GAAC,0BAA0B,GAAC,eAAe,CAAC;IAClE,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxD,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/cjs/types.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * @coderifts/agent-guard — public types (FROZEN security core, agent-guard-api v1.0, 2026-07-26).
+ *
+ * Transcribed VERBATIM from agent-guard-api.FROZEN-v1.0.md § Core API. The discriminated unions
+ * encode the frozen invariants at the type level (tsc-verified): TOCTOU (ExecuteFactory signature),
+ * retry-footgun (executionAttempted split), enforced-bypass (ApprovedVerdict + receiptVerified on
+ * every arm), integrity-fail-open (discriminated UnavailableVerdict), unverified-envelope execution
+ * (branded ReceiptVerifiedEnvelope). Fail-closed by default.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}

package/dist/esm/detector.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @coderifts/agent-guard — builtinDetector (the trust core).
+ *
+ * Fail-safe + versioned. Precedence (frozen spec): explicit artifacts > filesTouched patterns >
+ * diff/content markers > toolName > intent (add-only). A contract surface whose change cannot be
+ * proven inert triggers (confident=false => trigger=true). The Grok corpus of 68 vectors is the
+ * mandatory fixture set; this detector passes all 68 (46 trigger, 22 no-trigger).
+ */
+import type { TriggerDetector } from './types.js';
+export declare const DETECTOR_VERSION = "builtin/1.0.0";
+export declare const builtinDetector: TriggerDetector;
+//# sourceMappingURL=detector.d.ts.map