@coderifts/agent-guard 1.4.0 → 1.6.0

package/dist/cjs/coverage-report.d.ts

@@ -0,0 +1,87 @@
+/**
+ * enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
+ * The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
+ * honest picture — where is the system actually inescapable, and where isn't it?
+ *
+ * Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
+ * ENFORCING for that placement.
+ *
+ * PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
+ * It reads only the input structs the primitives already emit (registry report.coverage +
+ * inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
+ * Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
+ * the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
+ *
+ * Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
+ * contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
+ * even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
+ *
+ * Public source (ships in the npm package): reads only placement state fields — no scoring logic,
+ * weights, thresholds, pattern names, endpoints, or secrets.
+ */
+import type { EnforcementState } from './merge-gate.js';
+export type PlacementId = 'runtime' | 'merge' | 'deploy' | 'content';
+export type Applicability = {
+    runtime: boolean;
+    merge: boolean;
+    deploy: boolean;
+    content: boolean;
+};
+export type RuntimePlacementInput = {
+    coverage: 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN' | string;
+    inescapable_runtime: boolean;
+    residuals?: string[];
+};
+export type MergePlacementInput = {
+    enforcement_state: EnforcementState | string;
+    inescapable_merge: boolean;
+    residuals?: string[];
+};
+export type DeployPlacementInput = {
+    enforcement_state: EnforcementState | string;
+    inescapable_deploy: boolean;
+    residuals?: string[];
+};
+export type ContentPlacementInput = {
+    coverage: 'COMPLETE' | 'PARTIAL' | 'UNRESOLVED' | 'EMPTY' | 'UNKNOWN' | string;
+    artifacts_ready?: boolean;
+    residuals?: string[];
+};
+export type CoverageReportInput = {
+    applicability: Applicability;
+    runtime?: RuntimePlacementInput | null;
+    merge?: MergePlacementInput | null;
+    deploy?: DeployPlacementInput | null;
+    content?: ContentPlacementInput | null;
+};
+export type PlacementStrength = 'ENFORCING' | 'WEAK' | 'UNKNOWN' | 'EXCLUDED';
+export type OverallCoverage = 'FULLY_ENFORCED' | 'PARTIALLY_ENFORCED' | 'ADVISORY_ONLY' | 'CONTENT_BLOCKED' | 'UNKNOWN' | 'NOT_APPLICABLE';
+export type HonestClaimKey = 'claim_fully_enforced' | 'claim_partially_enforced' | 'claim_advisory_only' | 'claim_content_blocked' | 'claim_unknown' | 'claim_not_applicable';
+export type PerPlacementRow = {
+    placement: PlacementId;
+    applicable: boolean;
+    strength: PlacementStrength;
+    summary: {
+        enforcement_or_coverage: string;
+        inescapable_flag?: boolean | null;
+    };
+    residuals: string[];
+};
+export type CoverageReport = {
+    overall_coverage: OverallCoverage;
+    per_placement: PerPlacementRow[];
+    residuals: string[];
+    honest_claim_key: HonestClaimKey;
+    honest_claim_language: string;
+    flags: {
+        may_claim_inescapable_runtime: boolean;
+        may_claim_inescapable_merge: boolean;
+        may_claim_inescapable_deploy: boolean;
+        may_claim_full_tetrad: boolean;
+    };
+};
+/**
+ * §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
+ */
+export declare function coverageReport(input: CoverageReportInput): CoverageReport;
+//# sourceMappingURL=coverage-report.d.ts.map

package/dist/cjs/coverage-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-report.d.ts","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG;IAChC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG;IACjC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE9E,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAAG,oBAAoB,GAAG,eAAe,GACzD,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAErD,MAAM,MAAM,cAAc,GACtB,sBAAsB,GAAG,0BAA0B,GAAG,qBAAqB,GAC3E,uBAAuB,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE;QAAE,uBAAuB,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAChF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,cAAc,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE;QACL,6BAA6B,EAAE,OAAO,CAAC;QACvC,2BAA2B,EAAE,OAAO,CAAC;QACrC,4BAA4B,EAAE,OAAO,CAAC;QACtC,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,CAAC;AA4FF;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA2DzE"}

package/dist/cjs/coverage-report.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
+ * The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
+ * honest picture — where is the system actually inescapable, and where isn't it?
+ *
+ * Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
+ * ENFORCING for that placement.
+ *
+ * PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
+ * It reads only the input structs the primitives already emit (registry report.coverage +
+ * inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
+ * Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
+ * the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
+ *
+ * Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
+ * contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
+ * even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
+ *
+ * Public source (ships in the npm package): reads only placement state fields — no scoring logic,
+ * weights, thresholds, pattern names, endpoints, or secrets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coverageReport = coverageReport;
+// deterministic honest-language templates (§4.4) — no over-claim; FULLY never says "nothing can bypass".
+const TEMPLATES = {
+    claim_fully_enforced: 'All applicable CodeRifts placements are enforcing and non-bypassable for this target. '
+        + 'Residuals outside tetrad (e.g. infra break-glass) may still exist.',
+    claim_partially_enforced: 'Partial enforcement: some applicable placements enforce; open gaps: {residuals}.',
+    claim_advisory_only: 'CodeRifts is present but no applicable placement is fully enforcing. Gaps: {residuals}.',
+    claim_content_blocked: 'Contract artifact content is not fully resolved; enforcement of preflight content is incomplete. Gaps: {residuals}.',
+    claim_unknown: 'One or more applicable placements cannot be observed. Cannot attest full enforcement. Gaps: {residuals}.',
+    claim_not_applicable: 'No CodeRifts placements are in scope for this target.',
+};
+const OVERALL_TO_KEY = {
+    FULLY_ENFORCED: 'claim_fully_enforced',
+    PARTIALLY_ENFORCED: 'claim_partially_enforced',
+    ADVISORY_ONLY: 'claim_advisory_only',
+    CONTENT_BLOCKED: 'claim_content_blocked',
+    UNKNOWN: 'claim_unknown',
+    NOT_APPLICABLE: 'claim_not_applicable',
+};
+function computeRuntime(applicable, input) {
+    if (!applicable)
+        return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.inescapable_runtime ?? null } };
+    if (input == null)
+        return { strength: 'UNKNOWN', residuals: ['runtime_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
+    const residuals = [...(input.residuals ?? [])];
+    let strength;
+    if (input.coverage === 'COMPLETE' && input.inescapable_runtime === true)
+        strength = 'ENFORCING';
+    else if (input.coverage === 'UNKNOWN')
+        strength = 'UNKNOWN';
+    else
+        strength = 'WEAK';
+    if (input.coverage === 'BYPASSED')
+        residuals.push('runtime_bypassed');
+    return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.inescapable_runtime } };
+}
+function computeMerge(applicable, input) {
+    if (!applicable)
+        return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_merge ?? null } };
+    if (input == null)
+        return { strength: 'UNKNOWN', residuals: ['merge_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
+    const residuals = [...(input.residuals ?? [])];
+    let strength;
+    // RT-P-13: ENFORCING requires the flag AND a consistent enforcement_state — never trust the flag
+    // alone. A caller claiming inescapable_merge:true while enforcement_state is not ENFORCING is an
+    // inconsistent (adversarial) state → treat as WEAK and name it, never a false FULLY_ENFORCED.
+    if (input.inescapable_merge === true && input.enforcement_state === 'ENFORCING')
+        strength = 'ENFORCING';
+    else if (input.inescapable_merge === true) {
+        strength = 'WEAK';
+        residuals.push('inescapable_flag_inconsistent');
+    }
+    else if (input.enforcement_state === 'UNKNOWN')
+        strength = 'UNKNOWN';
+    else
+        strength = 'WEAK';
+    if (strength === 'WEAK') {
+        if (input.enforcement_state === 'ENFORCING' && input.inescapable_merge === false)
+            residuals.push('admin_bypass_open');
+        else if (input.enforcement_state === 'ABSENT')
+            residuals.push('merge_gate_not_configured');
+        else if (input.enforcement_state === 'ADVISORY')
+            residuals.push('merge_gate_advisory');
+    }
+    return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_merge } };
+}
+function computeDeploy(applicable, input) {
+    if (!applicable)
+        return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_deploy ?? null } };
+    if (input == null)
+        return { strength: 'UNKNOWN', residuals: ['deploy_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
+    const residuals = [...(input.residuals ?? [])];
+    let strength;
+    // RT-P-13 (deploy analog): ENFORCING requires the flag AND a consistent enforcement_state.
+    if (input.inescapable_deploy === true && input.enforcement_state === 'ENFORCING')
+        strength = 'ENFORCING';
+    else if (input.inescapable_deploy === true) {
+        strength = 'WEAK';
+        residuals.push('inescapable_flag_inconsistent');
+    }
+    else if (input.enforcement_state === 'UNKNOWN')
+        strength = 'UNKNOWN';
+    else
+        strength = 'WEAK';
+    if (strength === 'WEAK') {
+        if (input.enforcement_state === 'ENFORCING' && input.inescapable_deploy === false)
+            residuals.push('bypass_open');
+        else if (input.enforcement_state === 'ABSENT')
+            residuals.push('deploy_path_ungated');
+        else if (input.enforcement_state === 'ADVISORY')
+            residuals.push('deploy_gate_advisory');
+    }
+    return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_deploy } };
+}
+function computeContent(applicable, input) {
+    if (!applicable)
+        return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.artifacts_ready ?? null } };
+    if (input == null)
+        return { strength: 'UNKNOWN', residuals: ['content_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
+    const residuals = [...(input.residuals ?? [])];
+    let strength;
+    if (input.coverage === 'COMPLETE' || input.coverage === 'EMPTY')
+        strength = 'ENFORCING'; // EMPTY is vacuously ready, not a gap
+    else if (input.coverage === 'UNRESOLVED') {
+        strength = 'WEAK';
+        residuals.push('content_unresolved');
+    }
+    else if (input.coverage === 'PARTIAL') {
+        strength = 'WEAK';
+        residuals.push('content_partial');
+    }
+    else
+        strength = 'UNKNOWN'; // 'UNKNOWN' or anything unexpected → fail-closed observation
+    return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.artifacts_ready ?? null } };
+}
+/**
+ * §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
+ */
+function coverageReport(input) {
+    const applicability = input.applicability || { runtime: false, merge: false, deploy: false, content: false };
+    const computed = {
+        runtime: computeRuntime(applicability.runtime === true, input.runtime),
+        merge: computeMerge(applicability.merge === true, input.merge),
+        deploy: computeDeploy(applicability.deploy === true, input.deploy),
+        content: computeContent(applicability.content === true, input.content),
+    };
+    const order = ['runtime', 'merge', 'deploy', 'content'];
+    const isApplicable = (p) => applicability[p] === true;
+    const applicableStrengths = order.filter(isApplicable).map((p) => computed[p].strength);
+    const contentApplicable = isApplicable('content');
+    const contentUnresolved = contentApplicable && input.content != null && input.content.coverage === 'UNRESOLVED';
+    const weakPlacements = order.filter((p) => isApplicable(p) && computed[p].strength === 'WEAK');
+    // §4.2 — mechanical overall aggregation (weakest applicable caps; fail-closed).
+    let overall;
+    if (applicableStrengths.length === 0) {
+        overall = 'NOT_APPLICABLE';
+    }
+    else if (applicableStrengths.every((s) => s === 'ENFORCING')) {
+        overall = 'FULLY_ENFORCED';
+    }
+    else if (applicableStrengths.some((s) => s === 'WEAK') && applicableStrengths.some((s) => s === 'ENFORCING')) {
+        overall = contentUnresolved ? 'CONTENT_BLOCKED' : 'PARTIALLY_ENFORCED';
+    }
+    else if (applicableStrengths.some((s) => s === 'WEAK')) { // no ENFORCING
+        overall = (contentUnresolved && weakPlacements.every((p) => p === 'content')) ? 'CONTENT_BLOCKED' : 'ADVISORY_ONLY';
+    }
+    else { // no WEAK, not all ENFORCING → some UNKNOWN
+        overall = 'UNKNOWN';
+    }
+    // §4.3 — residuals: union of applicable placements only, sorted unique (EXCLUDED contribute none).
+    const residualSet = new Set();
+    for (const p of order)
+        if (isApplicable(p))
+            for (const r of computed[p].residuals)
+                residualSet.add(r);
+    const residuals = [...residualSet].sort();
+    // §4.4 — claim key + deterministic honest language.
+    const honest_claim_key = OVERALL_TO_KEY[overall];
+    const honest_claim_language = TEMPLATES[honest_claim_key].replace('{residuals}', residuals.length ? residuals.join(', ') : 'none');
+    // §4.5 — flags (must not disagree with overall). RT-P-13: a per-placement inescapable claim tracks
+    // the COMPUTED strength (flag ∧ consistent enforcement), never the raw flag alone — so an
+    // inconsistent inescapable_* claim cannot leak into a may_claim_* true.
+    const flags = {
+        may_claim_inescapable_runtime: isApplicable('runtime') && computed.runtime.strength === 'ENFORCING',
+        may_claim_inescapable_merge: isApplicable('merge') && computed.merge.strength === 'ENFORCING',
+        may_claim_inescapable_deploy: isApplicable('deploy') && computed.deploy.strength === 'ENFORCING',
+        may_claim_full_tetrad: overall === 'FULLY_ENFORCED',
+    };
+    const per_placement = order.map((p) => ({
+        placement: p,
+        applicable: isApplicable(p),
+        strength: computed[p].strength,
+        summary: computed[p].summary,
+        residuals: isApplicable(p) ? [...new Set(computed[p].residuals)].sort() : [],
+    }));
+    return { overall_coverage: overall, per_placement, residuals, honest_claim_key, honest_claim_language, flags };
+}
+//# sourceMappingURL=coverage-report.js.map

package/dist/cjs/coverage-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-report.js","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAkKH,wCA2DC;AAxJD,yGAAyG;AACzG,MAAM,SAAS,GAAmC;IAChD,oBAAoB,EAClB,wFAAwF;UACtF,oEAAoE;IACxE,wBAAwB,EACtB,kFAAkF;IACpF,mBAAmB,EACjB,yFAAyF;IAC3F,qBAAqB,EACnB,qHAAqH;IACvH,aAAa,EACX,0GAA0G;IAC5G,oBAAoB,EAClB,uDAAuD;CAC1D,CAAC;AAEF,MAAM,cAAc,GAA4C;IAC9D,cAAc,EAAE,sBAAsB;IACtC,kBAAkB,EAAE,0BAA0B;IAC9C,aAAa,EAAE,qBAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,OAAO,EAAE,eAAe;IACxB,cAAc,EAAE,sBAAsB;CACvC,CAAC;AAIF,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI,EAAE,EAAE,CAAC;IACtL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,QAAQ,GAAG,WAAW,CAAC;SAC3F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QACvD,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,SAAS,YAAY,CAAC,UAAmB,EAAE,KAA6C;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC7L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAC/J,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACnG,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC7G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;aACjH,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;aACtF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;AAC3I,CAAC;AAED,SAAS,aAAa,CAAC,UAAmB,EAAE,KAA8C;IACxF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,2FAA2F;IAC3F,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACpG,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC9G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;aAC5G,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;aAChF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;IAClL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,QAAQ,GAAG,WAAW,CAAC,CAAG,sCAAsC;SAC5H,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;SACjG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;;QAC3F,QAAQ,GAAG,SAAS,CAAC,CAAC,6DAA6D;IACxF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;AACxI,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,aAAa,GAAkB,KAAK,CAAC,aAAa,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5H,MAAM,QAAQ,GAAkC;QAC9C,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACtE,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,KAAK,KAAK,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC9D,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QAClE,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACnE,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,iBAAiB,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC;IAChH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE/F,gFAAgF;IAChF,IAAI,OAAwB,CAAC;IAC7B,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/G,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACzE,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe;QACzE,OAAO,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC;IACtH,CAAC;SAAM,CAAC,CAAC,4CAA4C;QACnD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,mGAAmG;IACnG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,YAAY,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1C,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEnI,mGAAmG;IACnG,0FAA0F;IAC1F,wEAAwE;IACxE,MAAM,KAAK,GAAG;QACZ,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,WAAW;QACnG,2BAA2B,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,WAAW;QAC7F,4BAA4B,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW;QAChG,qBAAqB,EAAE,OAAO,KAAK,gBAAgB;KACpD,CAAC;IAEF,MAAM,aAAa,GAAsB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC9B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO;QAC5B,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC7E,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AACjH,CAAC"}

package/dist/cjs/deploy-gate.d.ts

@@ -0,0 +1,103 @@
+/**
+ * deploy-gate (#8) — the PURE deploy authorization decision (deploy-gate-SPEC §1). The DEPLOY sibling
+ * of the merge gate: it answers "may THIS artifact deploy to THIS environment, given the finished
+ * receipt and the observed pipeline-enforcement state?"
+ *
+ * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
+ * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
+ * inputs → same output (D9).
+ *
+ * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
+ * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
+ * binding (an old artifact's ALLOW never deploys a newer one). Scope honesty mirrors the merge gate:
+ * `inescapable_deploy` is true ONLY in the fully-enforcing, non-bypassable case; otherwise the check
+ * may be `success` for visibility but the claim is false with the residual named.
+ *
+ * Public source (ships in the npm package): references only receipt/target/enforcement fields and
+ * generic deploy-gate concepts — no scoring logic, weights, thresholds, pattern names, endpoints, or
+ * secrets.
+ */
+import type { GateStatusState, EnforcementState } from './merge-gate.js';
+export type { GateStatusState, EnforcementState } from './merge-gate.js';
+/** The 13 deploy-gate reason codes (§1.1). Success uses allow_current_deploy; enforcement_not_configured
+ *  and bypass_open name the honesty residual on an otherwise-green check. */
+export type DeployGateReason = 'allow_current_deploy' | 'no_receipt' | 'receipt_not_authorized' | 'operation_mismatch' | 'env_mismatch' | 'stale_artifact' | 'fingerprint_mismatch' | 'body_hash_mismatch' | 'target_mismatch' | 'decision_not_allow' | 'inputs_incomplete' | 'enforcement_not_configured' | 'bypass_open';
+/** What is being deployed — all fields are INPUTS (the pure function performs no discovery). */
+export type DeployTarget = {
+    environment: string;
+    /** Immutable artifact identity: content digest, or a commit SHA when that is the deploy unit. */
+    artifact_id: string;
+    service?: string;
+    pipeline_run_id?: string;
+};
+/** A view of the finished receipt. Reuses the shipped field names + the deploy analogs of bound_head_sha. */
+export type DeployReceiptView = {
+    currently_authorized: boolean;
+    authz_reason?: string;
+    decision: 'ALLOW' | 'WARN' | 'REQUIRE_APPROVAL' | 'BLOCK' | string;
+    execution_action?: 'CONTINUE' | 'CONTINUE_WITH_MONITORING' | 'REQUEST_APPROVAL' | 'STOP' | string;
+    /** MUST be 'deploy' for success (T7). */
+    operation?: 'merge' | 'deploy' | 'tool_call' | 'publish' | string;
+    /** The environment this receipt authorizes (deploy analog of bound_head_sha). */
+    bound_environment?: string | null;
+    /** The artifact/commit this receipt was issued for (deploy analog of bound_head_sha). */
+    bound_artifact_id?: string | null;
+    verdict_fingerprint?: string;
+    body_hash?: string;
+    target_id?: string;
+    signature_valid?: boolean;
+};
+/** Pipeline-enforcement observation (from the host's CD-config read — the pure gate consumes it). */
+export type DeployEnforcementState = {
+    enforcement: EnforcementState;
+    bypass_possible: boolean;
+    required_step_name?: string;
+};
+export type DeployRequiredContext = {
+    operation?: 'deploy' | string;
+    repository?: string;
+    service?: string;
+    expected_fingerprint?: string;
+    expected_body_hash?: string;
+    enforcement: DeployEnforcementState;
+    /** Default true: a missing bound_environment on the receipt → env_mismatch. */
+    require_bound_environment?: boolean;
+    /** Default true: a missing bound_artifact_id → stale_artifact. */
+    require_bound_artifact?: boolean;
+    allowWarnDeploy?: boolean;
+    allowPrefixCompare?: boolean;
+    allowPending?: boolean;
+};
+export type DeployGateInput = {
+    deployTarget: DeployTarget;
+    receipt: DeployReceiptView | null;
+    requiredContext: DeployRequiredContext;
+    /** Incomplete/no-receipt → pending when true, else failure (default false). */
+    allowPending?: boolean;
+    /** Green the gate on WARN as well as ALLOW (default false; stricter for prod-shaped envs). */
+    allowWarnDeploy?: boolean;
+    /** Compare env/artifact by prefix instead of full equality (default false). */
+    allowPrefixCompare?: boolean;
+};
+export type DeployGateDecision = {
+    deploy_allowed: boolean;
+    state: GateStatusState;
+    reason: DeployGateReason;
+    enforcement_state: EnforcementState;
+    inescapable_deploy: boolean;
+    /** Named residual when the check is green but NOT inescapable (honesty channel, §3.2). */
+    residual?: DeployGateReason;
+    detail: {
+        environment: string;
+        artifact_id: string;
+        bound_environment: string | null;
+        bound_artifact_id: string | null;
+        operation: string | null;
+    };
+};
+/**
+ * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.
+ */
+export declare function deployGate(input: DeployGateInput): DeployGateDecision;
+//# sourceMappingURL=deploy-gate.d.ts.map

package/dist/cjs/deploy-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEzE;6EAC6E;AAC7E,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,YAAY,GACZ,wBAAwB,GACxB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,GAC5B,aAAa,CAAC;AAElB,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,qGAAqG;AACrG,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,qBAAqB,CAAC;IACvC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH,CAAC;AAkCF;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAiGrE"}

package/dist/cjs/deploy-gate.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * deploy-gate (#8) — the PURE deploy authorization decision (deploy-gate-SPEC §1). The DEPLOY sibling
+ * of the merge gate: it answers "may THIS artifact deploy to THIS environment, given the finished
+ * receipt and the observed pipeline-enforcement state?"
+ *
+ * Same shape as the merge gate, different operation. It is a PURE function — NO I/O, NO CD-API call
+ * (pipeline enforcement is an INPUT, observed by the host and passed in). It does NOT re-decide: it
+ * reads only the finished receipt fields — the deterministic verdict stays the server's (D7). Same
+ * inputs → same output (D9).
+ *
+ * The three deploy-specific binds are the whole point: T7 (a MERGE — or operation-less — receipt can
+ * never deploy), environment binding (a staging ALLOW never authorizes production), and artifact
+ * binding (an old artifact's ALLOW never deploys a newer one). Scope honesty mirrors the merge gate:
+ * `inescapable_deploy` is true ONLY in the fully-enforcing, non-bypassable case; otherwise the check
+ * may be `success` for visibility but the claim is false with the residual named.
+ *
+ * Public source (ships in the npm package): references only receipt/target/enforcement fields and
+ * generic deploy-gate concepts — no scoring logic, weights, thresholds, pattern names, endpoints, or
+ * secrets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployGate = deployGate;
+// ── helpers (pure) ────────────────────────────────────────────────────────────────────────────────
+function norm(s) {
+    return String(s == null ? '' : s).trim().toLowerCase();
+}
+/** §1.2 — full lowercase equality by default (env exact; artifact digest/sha); prefix opt-in. */
+function sameNorm(a, b, allowPrefix) {
+    const na = norm(a);
+    const nb = norm(b);
+    if (!na || !nb)
+        return false;
+    if (na === nb)
+        return true;
+    if (allowPrefix && na.length >= 7 && nb.length >= 7 && (na.startsWith(nb) || nb.startsWith(na)))
+        return true;
+    return false;
+}
+/** §1.3 — allow-class for deploy: ALLOW (or WARN only when opted in) + a continue-class action. */
+function isAllowClass(receipt, allowWarnDeploy) {
+    const dec = receipt.decision;
+    const decisionOk = dec === 'ALLOW' || (dec === 'WARN' && allowWarnDeploy === true);
+    if (!decisionOk)
+        return false;
+    const ea = receipt.execution_action;
+    if (ea === undefined || ea === null || ea === '')
+        return true;
+    return ea === 'CONTINUE' || ea === 'CONTINUE_WITH_MONITORING';
+}
+/** target_id must name this service/repository (exact or `svc:`/`repo:`/path/colon suffix). */
+function idMatchesName(targetId, name) {
+    const t = norm(targetId);
+    const r = norm(name);
+    return t === r || t === `svc:${r}` || t === `repo:${r}` || t.endsWith(`:${r}`) || t.endsWith(`/${r}`);
+}
+/**
+ * §1.4 — the normative, first-match-wins deploy decision. Pure; no I/O; deterministic.
+ */
+function deployGate(input) {
+    const target = input.deployTarget || {};
+    const rc = input.requiredContext || {};
+    const enf = rc.enforcement || { enforcement: 'UNKNOWN', bypass_possible: true };
+    const enforcement_state = enf.enforcement;
+    const opRequired = rc.operation ?? 'deploy';
+    const requireEnv = rc.require_bound_environment !== false; // default true
+    const requireArt = rc.require_bound_artifact !== false; // default true
+    const allowPending = input.allowPending ?? rc.allowPending ?? false;
+    const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
+    const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
+    const receipt = input.receipt;
+    const detail = {
+        environment: norm(target.environment),
+        artifact_id: norm(target.artifact_id),
+        bound_environment: receipt && receipt.bound_environment != null ? norm(receipt.bound_environment) : null,
+        bound_artifact_id: receipt && receipt.bound_artifact_id != null ? norm(receipt.bound_artifact_id) : null,
+        operation: receipt && receipt.operation != null ? String(receipt.operation) : null,
+    };
+    const deny = (state, reason) => ({
+        deploy_allowed: false, state, reason, enforcement_state, inescapable_deploy: false, detail,
+    });
+    // 0) incomplete target → pending/failure (fail-closed on missing evaluation input).
+    if (!target.environment || String(target.environment).trim() === ''
+        || !target.artifact_id || String(target.artifact_id).trim() === '') {
+        return deny(allowPending ? 'pending' : 'failure', 'inputs_incomplete');
+    }
+    // 1) no receipt → fail-closed (D4).
+    if (receipt === null || receipt === undefined) {
+        return deny(allowPending ? 'pending' : 'failure', 'no_receipt');
+    }
+    // 2) lifecycle authorization — a valid signature alone is NOT sufficient (D5).
+    if (receipt.currently_authorized !== true) {
+        return deny('failure', 'receipt_not_authorized');
+    }
+    // 3) T7 — operation MUST be deploy. A merge (or any other) receipt cannot deploy, and a MISSING
+    //    operation also fails closed (stricter than the merge gate — deploy is higher-risk) (D1).
+    if (receipt.operation == null || norm(receipt.operation) !== norm(opRequired)) {
+        return deny('failure', 'operation_mismatch');
+    }
+    // 4) ENVIRONMENT binding — a staging ALLOW never authorizes production (D2).
+    if (requireEnv) {
+        if (!receipt.bound_environment || !sameNorm(receipt.bound_environment, target.environment, allowPrefix)) {
+            return deny('failure', 'env_mismatch');
+        }
+    }
+    else if (receipt.bound_environment && !sameNorm(receipt.bound_environment, target.environment, allowPrefix)) {
+        return deny('failure', 'env_mismatch');
+    }
+    // 5) ARTIFACT binding — an old artifact's ALLOW never deploys a newer one (D3, the stale analog).
+    if (requireArt) {
+        if (!receipt.bound_artifact_id || !sameNorm(receipt.bound_artifact_id, target.artifact_id, allowPrefix)) {
+            return deny('failure', 'stale_artifact');
+        }
+    }
+    else if (receipt.bound_artifact_id && !sameNorm(receipt.bound_artifact_id, target.artifact_id, allowPrefix)) {
+        return deny('failure', 'stale_artifact');
+    }
+    // 6) optional re-bind to the current change set.
+    if (rc.expected_fingerprint != null && receipt.verdict_fingerprint !== rc.expected_fingerprint) {
+        return deny('failure', 'fingerprint_mismatch');
+    }
+    if (rc.expected_body_hash != null && receipt.body_hash !== rc.expected_body_hash) {
+        return deny('failure', 'body_hash_mismatch');
+    }
+    // 7) optional service / repository target binding.
+    if (rc.service && receipt.target_id) {
+        if (!idMatchesName(receipt.target_id, rc.service))
+            return deny('failure', 'target_mismatch');
+    }
+    else if (rc.repository && receipt.target_id) {
+        if (!idMatchesName(receipt.target_id, rc.repository))
+            return deny('failure', 'target_mismatch');
+    }
+    // 8) decision class — only an allow-class verdict greens the deploy gate (D6).
+    if (!isAllowClass(receipt, allowWarnDeploy)) {
+        return deny('failure', 'decision_not_allow');
+    }
+    // 9) success for the CHECK / pipeline step — green for visibility regardless of enforcement strength.
+    // 10) inescapable_deploy claim (STRICT, §1.4 step 10 / D8): only when the pipeline actually enforces
+    //     the step AND no bypass is possible. Never true otherwise.
+    const inescapable_deploy = enforcement_state === 'ENFORCING' && enf.bypass_possible === false;
+    let residual;
+    if (!inescapable_deploy) {
+        if (enforcement_state === 'ENFORCING')
+            residual = 'bypass_open'; // enforced, but a bypass exists
+        else
+            residual = 'enforcement_not_configured'; // ADVISORY / ABSENT / UNKNOWN
+    }
+    return {
+        deploy_allowed: true,
+        state: 'success',
+        reason: 'allow_current_deploy',
+        enforcement_state,
+        inescapable_deploy,
+        ...(residual ? { residual } : {}),
+        detail,
+    };
+}
+//# sourceMappingURL=deploy-gate.js.map

package/dist/cjs/deploy-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/deploy-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA0IH,gCAiGC;AApID,qGAAqG;AACrG,SAAS,IAAI,CAAC,CAA4B;IACxC,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAA4B,EAAE,CAA4B,EAAE,WAAoB;IAChG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,OAA0B,EAAE,eAAwB;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,eAAe,KAAK,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAiB,KAAK,CAAC,YAAY,IAAK,EAAmB,CAAC;IACxE,MAAM,EAAE,GAA0B,KAAK,CAAC,eAAe,IAAK,EAA4B,CAAC;IACzF,MAAM,GAAG,GAA2B,EAAE,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC,WAAW,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,yBAAyB,KAAK,KAAK,CAAC,CAAC,eAAe;IAC1E,MAAM,UAAU,GAAG,EAAE,CAAC,sBAAsB,KAAK,KAAK,CAAC,CAAI,eAAe;IAC1E,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACrC,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,iBAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QACxG,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KACnF,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAwB,EAAsB,EAAE,CAAC,CAAC;QACtF,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;KAC3F,CAAC,CAAC;IAEH,oFAAoF;IACpF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WAC9D,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,6EAA6E;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,mDAAmD;IACnD,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClG,CAAC;IACD,+EAA+E;IAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,sGAAsG;IACtG,qGAAqG;IACrG,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,iBAAiB,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC;IAE9F,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,iBAAiB,KAAK,WAAW;YAAE,QAAQ,GAAG,aAAa,CAAC,CAAQ,gCAAgC;;YACnG,QAAQ,GAAG,4BAA4B,CAAC,CAA0B,8BAA8B;IACvG,CAAC;IAED,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,sBAAsB;QAC9B,iBAAiB;QACjB,kBAAkB;QAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/cjs/index.d.ts

@@ -34,4 +34,8 @@ export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js
 export type { RawTool, ProtectedTool, ToolMutationClass, EnforcementCoverage, RegistryCoverageReport, GuardToolRegistryConfig, RegistryResult, ToolBinder, RegistryConstructionErrorCode, } from './tool-registry.js';
 export { gateDecision } from './merge-gate.js';
 export type { GateDecisionInput, GateDecision, ReceiptView, RequiredContext, ProtectionState, GateReason, GateStatusState, EnforcementState, } from './merge-gate.js';
+export { deployGate } from './deploy-gate.js';
+export type { DeployGateInput, DeployGateDecision, DeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, } from './deploy-gate.js';
+export { coverageReport } from './coverage-report.js';
+export type { CoverageReportInput, CoverageReport, Applicability, PlacementId, PlacementStrength, OverallCoverage, HonestClaimKey, PerPlacementRow, RuntimePlacementInput, MergePlacementInput, DeployPlacementInput, ContentPlacementInput, } from './coverage-report.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC"}