@coderifts/agent-guard 1.1.0 → 1.2.0

package/dist/esm/resolver-glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-glob.d.ts","sourceRoot":"","sources":["../../src/resolver-glob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uGAAuG;AACvG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBjD;AAED,sCAAsC;AACtC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAG3E;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjF"}

package/dist/esm/resolver-glob.js

@@ -0,0 +1,59 @@
+/**
+ * resolver-glob — a correct POSIX-path glob matcher for SSOT selection (§5). The naive `fnmatch`
+ * fails on the double-star token (which must span zero-or-more path segments); this handles it (plus
+ * `*` / `?`) precisely so a `generated` double-star pattern matches `generated/x.json`,
+ * `a/generated/b.yaml`, etc., but not `src/x.yaml`.
+ */
+/** Compile a glob to an anchored RegExp. Double-star spans segments; `*`/`?` stay within a segment. */
+export function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i += 1) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i += 1;
+                if (glob[i + 1] === '/') {
+                    re += '(?:.*/)?';
+                    i += 1;
+                }
+                else {
+                    re += '.*';
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if ('.+^${}()|[]\\'.includes(c)) {
+            re += `\\${c}`;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/** True iff `path` matches `glob`. */
+export function matchGlob(glob, path) {
+    return globToRegExp(glob).test(path);
+}
+/** True iff `path` matches ANY of the globs (also accepts an exact-path equality). */
+export function matchAny(globs, path) {
+    if (!Array.isArray(globs))
+        return false;
+    return globs.some((g) => g === path || matchGlob(g, path));
+}
+/** Index of the FIRST glob matching `path` (exact or glob), else -1 (first-match-wins). */
+export function firstMatchIndex(globs, path) {
+    if (!Array.isArray(globs))
+        return -1;
+    for (let i = 0; i < globs.length; i += 1) {
+        if (globs[i] === path || matchGlob(globs[i], path))
+            return i;
+    }
+    return -1;
+}
+//# sourceMappingURL=resolver-glob.js.map

package/dist/esm/resolver-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-glob.js","sourceRoot":"","sources":["../../src/resolver-glob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uGAAuG;AACvG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,EAAE,IAAI,UAAU,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;qBAAM,CAAC;oBAAC,EAAE,IAAI,IAAI,CAAC;gBAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,KAA2B,EAAE,IAAY;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,KAA2B,EAAE,IAAY;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/esm/resolver-yaml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * resolver-yaml — a MINIMAL, deterministic YAML/JSON reader for the artifact resolver's $ref bundler.
+ *
+ * The guard package has no YAML dependency; the resolver only needs to parse the constrained YAML
+ * that appears in OpenAPI/AsyncAPI contract docs (block mappings, flow mappings, quoted keys, scalar
+ * values, and `$ref` strings) to inline external file refs into a deterministic JSON bundle (§4.3).
+ * It is NOT a general YAML engine — anything outside the supported subset throws, and the resolver
+ * turns that into a `parse_error` unresolved entry (never a fabricated document).
+ *
+ * Determinism: plain scalars are kept as raw strings (no lossy type coercion), so parse→serialize is
+ * byte-stable per input.
+ */
+export declare class YamlLiteError extends Error {
+    constructor(message: string);
+}
+/** Parse a JSON or (subset) YAML document to a plain JS value. Throws YamlLiteError on unsupported input. */
+export declare function parseDoc(text: string): unknown;
+/** Deterministic JSON serialization with recursively sorted object keys (byte-stable — §4.3, A6). */
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=resolver-yaml.d.ts.map

package/dist/esm/resolver-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-yaml.d.ts","sourceRoot":"","sources":["../../src/resolver-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAC5B;AAID,6GAA6G;AAC7G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAc9C;AAiJD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/esm/resolver-yaml.js

@@ -0,0 +1,229 @@
+/**
+ * resolver-yaml — a MINIMAL, deterministic YAML/JSON reader for the artifact resolver's $ref bundler.
+ *
+ * The guard package has no YAML dependency; the resolver only needs to parse the constrained YAML
+ * that appears in OpenAPI/AsyncAPI contract docs (block mappings, flow mappings, quoted keys, scalar
+ * values, and `$ref` strings) to inline external file refs into a deterministic JSON bundle (§4.3).
+ * It is NOT a general YAML engine — anything outside the supported subset throws, and the resolver
+ * turns that into a `parse_error` unresolved entry (never a fabricated document).
+ *
+ * Determinism: plain scalars are kept as raw strings (no lossy type coercion), so parse→serialize is
+ * byte-stable per input.
+ */
+export class YamlLiteError extends Error {
+    constructor(message) { super(message); this.name = 'YamlLiteError'; }
+}
+/** Parse a JSON or (subset) YAML document to a plain JS value. Throws YamlLiteError on unsupported input. */
+export function parseDoc(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return JSON.parse(text);
+        }
+        catch (e) {
+            throw new YamlLiteError(`invalid JSON: ${e.message}`);
+        }
+    }
+    const lines = [];
+    for (const raw of text.split('\n')) {
+        const trimmedLine = raw.trim();
+        if (trimmedLine === '' || trimmedLine.startsWith('#'))
+            continue;
+        lines.push({ indent: raw.length - raw.trimStart().length, text: trimmedLine });
+    }
+    if (lines.length === 0)
+        return null;
+    const [value] = parseBlock(lines, 0, lines[0].indent);
+    return value;
+}
+function parseBlock(lines, start, indent) {
+    if (start >= lines.length)
+        return [null, start];
+    const first = lines[start];
+    if (first.text === '-' || first.text.startsWith('- '))
+        return parseSequence(lines, start, indent);
+    return parseMapping(lines, start, indent);
+}
+function parseMapping(lines, start, indent) {
+    const obj = {};
+    let i = start;
+    while (i < lines.length && lines[i].indent === indent) {
+        const { key, rest } = splitKeyValue(lines[i].text);
+        i += 1;
+        if (rest === '') {
+            if (i < lines.length && lines[i].indent > indent) {
+                const [child, next] = parseBlock(lines, i, lines[i].indent);
+                obj[key] = child;
+                i = next;
+            }
+            else {
+                obj[key] = null;
+            }
+        }
+        else {
+            obj[key] = parseScalarOrFlow(rest);
+        }
+    }
+    return [obj, i];
+}
+function parseSequence(lines, start, indent) {
+    const arr = [];
+    let i = start;
+    while (i < lines.length && lines[i].indent === indent && (lines[i].text === '-' || lines[i].text.startsWith('- '))) {
+        const itemText = lines[i].text.slice(1).trim();
+        i += 1;
+        if (itemText === '') {
+            if (i < lines.length && lines[i].indent > indent) {
+                const [child, next] = parseBlock(lines, i, lines[i].indent);
+                arr.push(child);
+                i = next;
+            }
+            else {
+                arr.push(null);
+            }
+        }
+        else {
+            arr.push(parseScalarOrFlow(itemText));
+        }
+    }
+    return [arr, i];
+}
+/** Split "key: rest" honoring a quoted key; the separator is the first top-level colon. */
+function splitKeyValue(text) {
+    let key;
+    let idx;
+    if (text[0] === "'" || text[0] === '"') {
+        const q = text[0];
+        let j = 1;
+        while (j < text.length && text[j] !== q)
+            j += 1;
+        key = text.slice(1, j);
+        idx = text.indexOf(':', j);
+    }
+    else {
+        idx = text.indexOf(':');
+        key = idx === -1 ? text : text.slice(0, idx);
+    }
+    if (idx === -1)
+        return { key: key.trim(), rest: '' };
+    return { key: key.trim(), rest: text.slice(idx + 1).trim() };
+}
+function parseScalarOrFlow(s) {
+    const t = s.trim();
+    if (t === '' || t === '~' || t === 'null')
+        return null;
+    if (t[0] === '{' || t[0] === '[')
+        return parseFlow(t).value;
+    if (t[0] === "'" || t[0] === '"')
+        return unquote(t);
+    return t;
+}
+function unquote(t) {
+    const q = t[0];
+    let j = 1;
+    let out = '';
+    while (j < t.length && t[j] !== q) {
+        out += t[j];
+        j += 1;
+    }
+    return out;
+}
+function parseFlow(s) {
+    if (s[0] === '{')
+        return parseFlowMap(s);
+    if (s[0] === '[')
+        return parseFlowSeq(s);
+    throw new YamlLiteError(`not a flow collection: ${s.slice(0, 20)}`);
+}
+function parseFlowMap(s) {
+    const obj = {};
+    let i = 1;
+    while (i < s.length) {
+        while (i < s.length && (s[i] === ' ' || s[i] === ','))
+            i += 1;
+        if (s[i] === '}')
+            return { value: obj, end: i + 1 };
+        let key;
+        if (s[i] === "'" || s[i] === '"') {
+            const q = s[i];
+            let j = i + 1;
+            let k = '';
+            while (j < s.length && s[j] !== q) {
+                k += s[j];
+                j += 1;
+            }
+            key = k;
+            i = j + 1;
+        }
+        else {
+            let k = '';
+            while (i < s.length && s[i] !== ':' && s[i] !== '}' && s[i] !== ',') {
+                k += s[i];
+                i += 1;
+            }
+            key = k.trim();
+        }
+        while (i < s.length && (s[i] === ' ' || s[i] === ':'))
+            i += 1;
+        const [val, next] = readFlowValue(s, i);
+        obj[key] = val;
+        i = next;
+    }
+    throw new YamlLiteError(`unterminated flow map: ${s.slice(0, 40)}`);
+}
+function parseFlowSeq(s) {
+    const arr = [];
+    let i = 1;
+    while (i < s.length) {
+        while (i < s.length && (s[i] === ' ' || s[i] === ','))
+            i += 1;
+        if (s[i] === ']')
+            return { value: arr, end: i + 1 };
+        const [val, next] = readFlowValue(s, i);
+        arr.push(val);
+        i = next;
+    }
+    throw new YamlLiteError(`unterminated flow seq: ${s.slice(0, 40)}`);
+}
+function readFlowValue(s, start) {
+    let i = start;
+    while (i < s.length && s[i] === ' ')
+        i += 1;
+    if (s[i] === '{' || s[i] === '[') {
+        const { value, end } = parseFlow(s.slice(i));
+        return [value, i + end];
+    }
+    if (s[i] === "'" || s[i] === '"') {
+        const q = s[i];
+        let j = i + 1;
+        let out = '';
+        while (j < s.length && s[j] !== q) {
+            out += s[j];
+            j += 1;
+        }
+        return [out, j + 1];
+    }
+    let out = '';
+    while (i < s.length && s[i] !== ',' && s[i] !== '}' && s[i] !== ']') {
+        out += s[i];
+        i += 1;
+    }
+    return [out.trim(), i];
+}
+/** Deterministic JSON serialization with recursively sorted object keys (byte-stable — §4.3, A6). */
+export function stableStringify(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const k of Object.keys(value).sort()) {
+            out[k] = sortKeys(value[k]);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=resolver-yaml.js.map

package/dist/esm/resolver-yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-yaml.js","sourceRoot":"","sources":["../../src/resolver-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC;CAC9E;AAID,6GAA6G;AAC7G,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAClG,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IAChE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACjB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IACjE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACzD,GAAG,GAAG,CAAC,CAAC;YAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAC3F,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACf,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,KAAa;IAC7C,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/tool-registry.d.ts

@@ -0,0 +1,88 @@
+/**
+ * guardToolRegistry — the agent-runtime inescapability layer (guard-tool-registry-SPEC v1.0).
+ *
+ * The layer ABOVE the shipped `guardToolCall`: it takes the host's raw tool list and returns the ONLY
+ * tool table the agent is allowed to see — every mutating capability wrapped so it cannot execute
+ * without entering `guardToolCall`, and construction FAILS CLOSED if a mutator would remain raw.
+ *
+ * Scope honesty (enforcement-architecture §1): this secures **Placement A — the agent-host runtime
+ * tool boundary ONLY**. It NEVER claims merge (Placement B / sibling #7) or deploy inescapability;
+ * `claim.inescapable_merge` / `claim.inescapable_deploy` are ALWAYS false here.
+ *
+ * Determinism (§7): same tool names + classes + config flags → same registry, coverage, guarded set.
+ * Anti-fabrication: unknown tools default to MUTATING (never a false COMPLETE); never invent a tool.
+ * Non-leakage (§1.2): each raw `execute` is captured in a NEW closure, is never a property of the
+ * returned ProtectedTool, the tools array + each tool are frozen, and raw executors live only in a
+ * WeakMap keyed by the protected object. `result.tools` is the sole return surface.
+ */
+import type { GuardConfig, ToolCallDescriptor } from './types.js';
+export type ToolMutationClass = 'readonly' | 'mutating' | 'mutating_shell' | 'mutating_vcs' | 'mutating_deploy' | 'mutating_publish' | 'mutating_schema';
+export type RawTool = {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+    execute: (args: unknown) => Promise<unknown> | unknown;
+    mutationClass?: ToolMutationClass;
+    meta?: Record<string, unknown>;
+};
+export type ProtectedTool = {
+    readonly name: string;
+    readonly description?: string;
+    readonly inputSchema?: unknown;
+    readonly meta?: Record<string, unknown>;
+    /** The ONLY entry point exposed to the agent runtime (guarded for mutators, direct for readonly). */
+    readonly execute: (args: unknown) => Promise<unknown>;
+    readonly _coderifts: {
+        readonly guarded: boolean;
+        readonly mutationClass: ToolMutationClass;
+        /** guard operation bound for this tool (diagnostic; mutators only). */
+        readonly operation?: string;
+    };
+};
+export type EnforcementCoverage = 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN';
+export type RegistryCoverageReport = {
+    version: 'guard-tool-registry-report/1.0';
+    coverage: EnforcementCoverage;
+    protected_tools: string[];
+    guarded_mutators: string[];
+    readonly_passthrough: string[];
+    unguarded_mutators: string[];
+    unknown_treated_as: 'mutating' | 'readonly' | 'reject';
+    claim: {
+        inescapable_runtime: boolean;
+        inescapable_merge: false;
+        inescapable_deploy: false;
+    };
+    siblings: {
+        merge_gate: 'required_separate_#7';
+        artifact_resolver: 'sibling_#4';
+    };
+    warnings: string[];
+};
+export type ToolBinder = (tool: RawTool, args: unknown, cls: ToolMutationClass) => ToolCallDescriptor;
+export type GuardToolRegistryConfig = {
+    guard?: GuardConfig;
+    unknownToolPolicy?: 'mutating' | 'readonly' | 'reject';
+    classify?: Record<string, ToolMutationClass>;
+    failOnUnguardedMutator?: boolean;
+    binders?: Record<string, ToolBinder>;
+    forceReadonly?: string[];
+};
+export type RegistryResult = {
+    tools: ProtectedTool[];
+    coverage: EnforcementCoverage;
+    report: RegistryCoverageReport;
+};
+export type RegistryConstructionErrorCode = 'GUARD_CONFIG_INVALID' | 'UNKNOWN_TOOL' | 'DUPLICATE_TOOL_NAME' | 'INVALID_TOOL' | 'FORCE_READONLY_MUTATOR';
+/** Fail-closed construction error (§3) — thrown at CONSTRUCTION, never at first agent call. */
+export declare class RegistryConstructionError extends Error {
+    readonly code: RegistryConstructionErrorCode;
+    readonly toolName?: string;
+    constructor(code: RegistryConstructionErrorCode, message: string, toolName?: string);
+}
+/**
+ * Construct the frozen, fail-closed protected tool registry (§1.3). Pure + deterministic.
+ * @throws {RegistryConstructionError} per §3 (default failOnUnguardedMutator=true).
+ */
+export declare function guardToolRegistry(rawTools: RawTool[], config?: GuardToolRegistryConfig): RegistryResult;
+//# sourceMappingURL=tool-registry.d.ts.map

package/dist/esm/tool-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registry.d.ts","sourceRoot":"","sources":["../../src/tool-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAC;AAG1F,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,UAAU,GACV,gBAAgB,GAChB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,OAAO,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACvD,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAC1C,uEAAuE;QACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,gCAAgC,CAAC;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvD,KAAK,EAAE;QACL,mBAAmB,EAAE,OAAO,CAAC;QAC7B,iBAAiB,EAAE,KAAK,CAAC;QACzB,kBAAkB,EAAE,KAAK,CAAC;KAC3B,CAAC;IACF,QAAQ,EAAE;QACR,UAAU,EAAE,sBAAsB,CAAC;QACnC,iBAAiB,EAAE,YAAY,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iBAAiB,KAAK,kBAAkB,CAAC;AAEtG,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GACrC,sBAAsB,GACtB,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,wBAAwB,CAAC;AAE7B,+FAA+F;AAC/F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;gBACf,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAMpF;AA2HD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,GAAE,uBAA4B,GAAG,cAAc,CAoI3G"}