@coderifts/agent-guard 1.5.0 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/coverage-report.d.ts +87 -0
- package/dist/cjs/coverage-report.d.ts.map +1 -0
- package/dist/cjs/coverage-report.js +201 -0
- package/dist/cjs/coverage-report.js.map +1 -0
- package/dist/cjs/index.d.ts +2 -0
- package/dist/cjs/index.d.ts.map +1 -1
- package/dist/cjs/index.js +4 -1
- package/dist/cjs/index.js.map +1 -1
- package/dist/cjs/merge-gate.d.ts.map +1 -1
- package/dist/cjs/merge-gate.js +9 -2
- package/dist/cjs/merge-gate.js.map +1 -1
- package/dist/esm/coverage-report.d.ts +87 -0
- package/dist/esm/coverage-report.d.ts.map +1 -0
- package/dist/esm/coverage-report.js +198 -0
- package/dist/esm/coverage-report.js.map +1 -0
- package/dist/esm/index.d.ts +2 -0
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.js +2 -0
- package/dist/esm/index.js.map +1 -1
- package/dist/esm/merge-gate.d.ts.map +1 -1
- package/dist/esm/merge-gate.js +9 -2
- package/dist/esm/merge-gate.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
|
|
3
|
+
* The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
|
|
4
|
+
* honest picture — where is the system actually inescapable, and where isn't it?
|
|
5
|
+
*
|
|
6
|
+
* Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
|
|
7
|
+
* ENFORCING for that placement.
|
|
8
|
+
*
|
|
9
|
+
* PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
|
|
10
|
+
* It reads only the input structs the primitives already emit (registry report.coverage +
|
|
11
|
+
* inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
|
|
12
|
+
* Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
|
|
13
|
+
* the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
|
|
14
|
+
*
|
|
15
|
+
* Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
|
|
16
|
+
* contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
|
|
17
|
+
* even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
|
|
18
|
+
*
|
|
19
|
+
* Public source (ships in the npm package): reads only placement state fields — no scoring logic,
|
|
20
|
+
* weights, thresholds, pattern names, endpoints, or secrets.
|
|
21
|
+
*/
|
|
22
|
+
import type { EnforcementState } from './merge-gate.js';
|
|
23
|
+
export type PlacementId = 'runtime' | 'merge' | 'deploy' | 'content';
|
|
24
|
+
export type Applicability = {
|
|
25
|
+
runtime: boolean;
|
|
26
|
+
merge: boolean;
|
|
27
|
+
deploy: boolean;
|
|
28
|
+
content: boolean;
|
|
29
|
+
};
|
|
30
|
+
export type RuntimePlacementInput = {
|
|
31
|
+
coverage: 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN' | string;
|
|
32
|
+
inescapable_runtime: boolean;
|
|
33
|
+
residuals?: string[];
|
|
34
|
+
};
|
|
35
|
+
export type MergePlacementInput = {
|
|
36
|
+
enforcement_state: EnforcementState | string;
|
|
37
|
+
inescapable_merge: boolean;
|
|
38
|
+
residuals?: string[];
|
|
39
|
+
};
|
|
40
|
+
export type DeployPlacementInput = {
|
|
41
|
+
enforcement_state: EnforcementState | string;
|
|
42
|
+
inescapable_deploy: boolean;
|
|
43
|
+
residuals?: string[];
|
|
44
|
+
};
|
|
45
|
+
export type ContentPlacementInput = {
|
|
46
|
+
coverage: 'COMPLETE' | 'PARTIAL' | 'UNRESOLVED' | 'EMPTY' | 'UNKNOWN' | string;
|
|
47
|
+
artifacts_ready?: boolean;
|
|
48
|
+
residuals?: string[];
|
|
49
|
+
};
|
|
50
|
+
export type CoverageReportInput = {
|
|
51
|
+
applicability: Applicability;
|
|
52
|
+
runtime?: RuntimePlacementInput | null;
|
|
53
|
+
merge?: MergePlacementInput | null;
|
|
54
|
+
deploy?: DeployPlacementInput | null;
|
|
55
|
+
content?: ContentPlacementInput | null;
|
|
56
|
+
};
|
|
57
|
+
export type PlacementStrength = 'ENFORCING' | 'WEAK' | 'UNKNOWN' | 'EXCLUDED';
|
|
58
|
+
export type OverallCoverage = 'FULLY_ENFORCED' | 'PARTIALLY_ENFORCED' | 'ADVISORY_ONLY' | 'CONTENT_BLOCKED' | 'UNKNOWN' | 'NOT_APPLICABLE';
|
|
59
|
+
export type HonestClaimKey = 'claim_fully_enforced' | 'claim_partially_enforced' | 'claim_advisory_only' | 'claim_content_blocked' | 'claim_unknown' | 'claim_not_applicable';
|
|
60
|
+
export type PerPlacementRow = {
|
|
61
|
+
placement: PlacementId;
|
|
62
|
+
applicable: boolean;
|
|
63
|
+
strength: PlacementStrength;
|
|
64
|
+
summary: {
|
|
65
|
+
enforcement_or_coverage: string;
|
|
66
|
+
inescapable_flag?: boolean | null;
|
|
67
|
+
};
|
|
68
|
+
residuals: string[];
|
|
69
|
+
};
|
|
70
|
+
export type CoverageReport = {
|
|
71
|
+
overall_coverage: OverallCoverage;
|
|
72
|
+
per_placement: PerPlacementRow[];
|
|
73
|
+
residuals: string[];
|
|
74
|
+
honest_claim_key: HonestClaimKey;
|
|
75
|
+
honest_claim_language: string;
|
|
76
|
+
flags: {
|
|
77
|
+
may_claim_inescapable_runtime: boolean;
|
|
78
|
+
may_claim_inescapable_merge: boolean;
|
|
79
|
+
may_claim_inescapable_deploy: boolean;
|
|
80
|
+
may_claim_full_tetrad: boolean;
|
|
81
|
+
};
|
|
82
|
+
};
|
|
83
|
+
/**
|
|
84
|
+
* §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
|
|
85
|
+
*/
|
|
86
|
+
export declare function coverageReport(input: CoverageReportInput): CoverageReport;
|
|
87
|
+
//# sourceMappingURL=coverage-report.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"coverage-report.d.ts","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG;IAChC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG;IACjC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE9E,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAAG,oBAAoB,GAAG,eAAe,GACzD,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAErD,MAAM,MAAM,cAAc,GACtB,sBAAsB,GAAG,0BAA0B,GAAG,qBAAqB,GAC3E,uBAAuB,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE;QAAE,uBAAuB,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAChF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,cAAc,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE;QACL,6BAA6B,EAAE,OAAO,CAAC;QACvC,2BAA2B,EAAE,OAAO,CAAC;QACrC,4BAA4B,EAAE,OAAO,CAAC;QACtC,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,CAAC;AA4FF;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA2DzE"}
|
|
@@ -0,0 +1,201 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
|
|
4
|
+
* The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
|
|
5
|
+
* honest picture — where is the system actually inescapable, and where isn't it?
|
|
6
|
+
*
|
|
7
|
+
* Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
|
|
8
|
+
* ENFORCING for that placement.
|
|
9
|
+
*
|
|
10
|
+
* PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
|
|
11
|
+
* It reads only the input structs the primitives already emit (registry report.coverage +
|
|
12
|
+
* inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
|
|
13
|
+
* Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
|
|
14
|
+
* the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
|
|
15
|
+
*
|
|
16
|
+
* Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
|
|
17
|
+
* contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
|
|
18
|
+
* even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
|
|
19
|
+
*
|
|
20
|
+
* Public source (ships in the npm package): reads only placement state fields — no scoring logic,
|
|
21
|
+
* weights, thresholds, pattern names, endpoints, or secrets.
|
|
22
|
+
*/
|
|
23
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
24
|
+
exports.coverageReport = coverageReport;
|
|
25
|
+
// deterministic honest-language templates (§4.4) — no over-claim; FULLY never says "nothing can bypass".
|
|
26
|
+
const TEMPLATES = {
|
|
27
|
+
claim_fully_enforced: 'All applicable CodeRifts placements are enforcing and non-bypassable for this target. '
|
|
28
|
+
+ 'Residuals outside tetrad (e.g. infra break-glass) may still exist.',
|
|
29
|
+
claim_partially_enforced: 'Partial enforcement: some applicable placements enforce; open gaps: {residuals}.',
|
|
30
|
+
claim_advisory_only: 'CodeRifts is present but no applicable placement is fully enforcing. Gaps: {residuals}.',
|
|
31
|
+
claim_content_blocked: 'Contract artifact content is not fully resolved; enforcement of preflight content is incomplete. Gaps: {residuals}.',
|
|
32
|
+
claim_unknown: 'One or more applicable placements cannot be observed. Cannot attest full enforcement. Gaps: {residuals}.',
|
|
33
|
+
claim_not_applicable: 'No CodeRifts placements are in scope for this target.',
|
|
34
|
+
};
|
|
35
|
+
const OVERALL_TO_KEY = {
|
|
36
|
+
FULLY_ENFORCED: 'claim_fully_enforced',
|
|
37
|
+
PARTIALLY_ENFORCED: 'claim_partially_enforced',
|
|
38
|
+
ADVISORY_ONLY: 'claim_advisory_only',
|
|
39
|
+
CONTENT_BLOCKED: 'claim_content_blocked',
|
|
40
|
+
UNKNOWN: 'claim_unknown',
|
|
41
|
+
NOT_APPLICABLE: 'claim_not_applicable',
|
|
42
|
+
};
|
|
43
|
+
function computeRuntime(applicable, input) {
|
|
44
|
+
if (!applicable)
|
|
45
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.inescapable_runtime ?? null } };
|
|
46
|
+
if (input == null)
|
|
47
|
+
return { strength: 'UNKNOWN', residuals: ['runtime_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
48
|
+
const residuals = [...(input.residuals ?? [])];
|
|
49
|
+
let strength;
|
|
50
|
+
if (input.coverage === 'COMPLETE' && input.inescapable_runtime === true)
|
|
51
|
+
strength = 'ENFORCING';
|
|
52
|
+
else if (input.coverage === 'UNKNOWN')
|
|
53
|
+
strength = 'UNKNOWN';
|
|
54
|
+
else
|
|
55
|
+
strength = 'WEAK';
|
|
56
|
+
if (input.coverage === 'BYPASSED')
|
|
57
|
+
residuals.push('runtime_bypassed');
|
|
58
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.inescapable_runtime } };
|
|
59
|
+
}
|
|
60
|
+
function computeMerge(applicable, input) {
|
|
61
|
+
if (!applicable)
|
|
62
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_merge ?? null } };
|
|
63
|
+
if (input == null)
|
|
64
|
+
return { strength: 'UNKNOWN', residuals: ['merge_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
65
|
+
const residuals = [...(input.residuals ?? [])];
|
|
66
|
+
let strength;
|
|
67
|
+
// RT-P-13: ENFORCING requires the flag AND a consistent enforcement_state — never trust the flag
|
|
68
|
+
// alone. A caller claiming inescapable_merge:true while enforcement_state is not ENFORCING is an
|
|
69
|
+
// inconsistent (adversarial) state → treat as WEAK and name it, never a false FULLY_ENFORCED.
|
|
70
|
+
if (input.inescapable_merge === true && input.enforcement_state === 'ENFORCING')
|
|
71
|
+
strength = 'ENFORCING';
|
|
72
|
+
else if (input.inescapable_merge === true) {
|
|
73
|
+
strength = 'WEAK';
|
|
74
|
+
residuals.push('inescapable_flag_inconsistent');
|
|
75
|
+
}
|
|
76
|
+
else if (input.enforcement_state === 'UNKNOWN')
|
|
77
|
+
strength = 'UNKNOWN';
|
|
78
|
+
else
|
|
79
|
+
strength = 'WEAK';
|
|
80
|
+
if (strength === 'WEAK') {
|
|
81
|
+
if (input.enforcement_state === 'ENFORCING' && input.inescapable_merge === false)
|
|
82
|
+
residuals.push('admin_bypass_open');
|
|
83
|
+
else if (input.enforcement_state === 'ABSENT')
|
|
84
|
+
residuals.push('merge_gate_not_configured');
|
|
85
|
+
else if (input.enforcement_state === 'ADVISORY')
|
|
86
|
+
residuals.push('merge_gate_advisory');
|
|
87
|
+
}
|
|
88
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_merge } };
|
|
89
|
+
}
|
|
90
|
+
function computeDeploy(applicable, input) {
|
|
91
|
+
if (!applicable)
|
|
92
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_deploy ?? null } };
|
|
93
|
+
if (input == null)
|
|
94
|
+
return { strength: 'UNKNOWN', residuals: ['deploy_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
95
|
+
const residuals = [...(input.residuals ?? [])];
|
|
96
|
+
let strength;
|
|
97
|
+
// RT-P-13 (deploy analog): ENFORCING requires the flag AND a consistent enforcement_state.
|
|
98
|
+
if (input.inescapable_deploy === true && input.enforcement_state === 'ENFORCING')
|
|
99
|
+
strength = 'ENFORCING';
|
|
100
|
+
else if (input.inescapable_deploy === true) {
|
|
101
|
+
strength = 'WEAK';
|
|
102
|
+
residuals.push('inescapable_flag_inconsistent');
|
|
103
|
+
}
|
|
104
|
+
else if (input.enforcement_state === 'UNKNOWN')
|
|
105
|
+
strength = 'UNKNOWN';
|
|
106
|
+
else
|
|
107
|
+
strength = 'WEAK';
|
|
108
|
+
if (strength === 'WEAK') {
|
|
109
|
+
if (input.enforcement_state === 'ENFORCING' && input.inescapable_deploy === false)
|
|
110
|
+
residuals.push('bypass_open');
|
|
111
|
+
else if (input.enforcement_state === 'ABSENT')
|
|
112
|
+
residuals.push('deploy_path_ungated');
|
|
113
|
+
else if (input.enforcement_state === 'ADVISORY')
|
|
114
|
+
residuals.push('deploy_gate_advisory');
|
|
115
|
+
}
|
|
116
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_deploy } };
|
|
117
|
+
}
|
|
118
|
+
function computeContent(applicable, input) {
|
|
119
|
+
if (!applicable)
|
|
120
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.artifacts_ready ?? null } };
|
|
121
|
+
if (input == null)
|
|
122
|
+
return { strength: 'UNKNOWN', residuals: ['content_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
123
|
+
const residuals = [...(input.residuals ?? [])];
|
|
124
|
+
let strength;
|
|
125
|
+
if (input.coverage === 'COMPLETE' || input.coverage === 'EMPTY')
|
|
126
|
+
strength = 'ENFORCING'; // EMPTY is vacuously ready, not a gap
|
|
127
|
+
else if (input.coverage === 'UNRESOLVED') {
|
|
128
|
+
strength = 'WEAK';
|
|
129
|
+
residuals.push('content_unresolved');
|
|
130
|
+
}
|
|
131
|
+
else if (input.coverage === 'PARTIAL') {
|
|
132
|
+
strength = 'WEAK';
|
|
133
|
+
residuals.push('content_partial');
|
|
134
|
+
}
|
|
135
|
+
else
|
|
136
|
+
strength = 'UNKNOWN'; // 'UNKNOWN' or anything unexpected → fail-closed observation
|
|
137
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.artifacts_ready ?? null } };
|
|
138
|
+
}
|
|
139
|
+
/**
|
|
140
|
+
* §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
|
|
141
|
+
*/
|
|
142
|
+
function coverageReport(input) {
|
|
143
|
+
const applicability = input.applicability || { runtime: false, merge: false, deploy: false, content: false };
|
|
144
|
+
const computed = {
|
|
145
|
+
runtime: computeRuntime(applicability.runtime === true, input.runtime),
|
|
146
|
+
merge: computeMerge(applicability.merge === true, input.merge),
|
|
147
|
+
deploy: computeDeploy(applicability.deploy === true, input.deploy),
|
|
148
|
+
content: computeContent(applicability.content === true, input.content),
|
|
149
|
+
};
|
|
150
|
+
const order = ['runtime', 'merge', 'deploy', 'content'];
|
|
151
|
+
const isApplicable = (p) => applicability[p] === true;
|
|
152
|
+
const applicableStrengths = order.filter(isApplicable).map((p) => computed[p].strength);
|
|
153
|
+
const contentApplicable = isApplicable('content');
|
|
154
|
+
const contentUnresolved = contentApplicable && input.content != null && input.content.coverage === 'UNRESOLVED';
|
|
155
|
+
const weakPlacements = order.filter((p) => isApplicable(p) && computed[p].strength === 'WEAK');
|
|
156
|
+
// §4.2 — mechanical overall aggregation (weakest applicable caps; fail-closed).
|
|
157
|
+
let overall;
|
|
158
|
+
if (applicableStrengths.length === 0) {
|
|
159
|
+
overall = 'NOT_APPLICABLE';
|
|
160
|
+
}
|
|
161
|
+
else if (applicableStrengths.every((s) => s === 'ENFORCING')) {
|
|
162
|
+
overall = 'FULLY_ENFORCED';
|
|
163
|
+
}
|
|
164
|
+
else if (applicableStrengths.some((s) => s === 'WEAK') && applicableStrengths.some((s) => s === 'ENFORCING')) {
|
|
165
|
+
overall = contentUnresolved ? 'CONTENT_BLOCKED' : 'PARTIALLY_ENFORCED';
|
|
166
|
+
}
|
|
167
|
+
else if (applicableStrengths.some((s) => s === 'WEAK')) { // no ENFORCING
|
|
168
|
+
overall = (contentUnresolved && weakPlacements.every((p) => p === 'content')) ? 'CONTENT_BLOCKED' : 'ADVISORY_ONLY';
|
|
169
|
+
}
|
|
170
|
+
else { // no WEAK, not all ENFORCING → some UNKNOWN
|
|
171
|
+
overall = 'UNKNOWN';
|
|
172
|
+
}
|
|
173
|
+
// §4.3 — residuals: union of applicable placements only, sorted unique (EXCLUDED contribute none).
|
|
174
|
+
const residualSet = new Set();
|
|
175
|
+
for (const p of order)
|
|
176
|
+
if (isApplicable(p))
|
|
177
|
+
for (const r of computed[p].residuals)
|
|
178
|
+
residualSet.add(r);
|
|
179
|
+
const residuals = [...residualSet].sort();
|
|
180
|
+
// §4.4 — claim key + deterministic honest language.
|
|
181
|
+
const honest_claim_key = OVERALL_TO_KEY[overall];
|
|
182
|
+
const honest_claim_language = TEMPLATES[honest_claim_key].replace('{residuals}', residuals.length ? residuals.join(', ') : 'none');
|
|
183
|
+
// §4.5 — flags (must not disagree with overall). RT-P-13: a per-placement inescapable claim tracks
|
|
184
|
+
// the COMPUTED strength (flag ∧ consistent enforcement), never the raw flag alone — so an
|
|
185
|
+
// inconsistent inescapable_* claim cannot leak into a may_claim_* true.
|
|
186
|
+
const flags = {
|
|
187
|
+
may_claim_inescapable_runtime: isApplicable('runtime') && computed.runtime.strength === 'ENFORCING',
|
|
188
|
+
may_claim_inescapable_merge: isApplicable('merge') && computed.merge.strength === 'ENFORCING',
|
|
189
|
+
may_claim_inescapable_deploy: isApplicable('deploy') && computed.deploy.strength === 'ENFORCING',
|
|
190
|
+
may_claim_full_tetrad: overall === 'FULLY_ENFORCED',
|
|
191
|
+
};
|
|
192
|
+
const per_placement = order.map((p) => ({
|
|
193
|
+
placement: p,
|
|
194
|
+
applicable: isApplicable(p),
|
|
195
|
+
strength: computed[p].strength,
|
|
196
|
+
summary: computed[p].summary,
|
|
197
|
+
residuals: isApplicable(p) ? [...new Set(computed[p].residuals)].sort() : [],
|
|
198
|
+
}));
|
|
199
|
+
return { overall_coverage: overall, per_placement, residuals, honest_claim_key, honest_claim_language, flags };
|
|
200
|
+
}
|
|
201
|
+
//# sourceMappingURL=coverage-report.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"coverage-report.js","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAkKH,wCA2DC;AAxJD,yGAAyG;AACzG,MAAM,SAAS,GAAmC;IAChD,oBAAoB,EAClB,wFAAwF;UACtF,oEAAoE;IACxE,wBAAwB,EACtB,kFAAkF;IACpF,mBAAmB,EACjB,yFAAyF;IAC3F,qBAAqB,EACnB,qHAAqH;IACvH,aAAa,EACX,0GAA0G;IAC5G,oBAAoB,EAClB,uDAAuD;CAC1D,CAAC;AAEF,MAAM,cAAc,GAA4C;IAC9D,cAAc,EAAE,sBAAsB;IACtC,kBAAkB,EAAE,0BAA0B;IAC9C,aAAa,EAAE,qBAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,OAAO,EAAE,eAAe;IACxB,cAAc,EAAE,sBAAsB;CACvC,CAAC;AAIF,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI,EAAE,EAAE,CAAC;IACtL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,QAAQ,GAAG,WAAW,CAAC;SAC3F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QACvD,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,SAAS,YAAY,CAAC,UAAmB,EAAE,KAA6C;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC7L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAC/J,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACnG,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC7G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;aACjH,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;aACtF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;AAC3I,CAAC;AAED,SAAS,aAAa,CAAC,UAAmB,EAAE,KAA8C;IACxF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,2FAA2F;IAC3F,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACpG,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC9G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;aAC5G,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;aAChF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;IAClL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,QAAQ,GAAG,WAAW,CAAC,CAAG,sCAAsC;SAC5H,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;SACjG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;;QAC3F,QAAQ,GAAG,SAAS,CAAC,CAAC,6DAA6D;IACxF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;AACxI,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,aAAa,GAAkB,KAAK,CAAC,aAAa,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5H,MAAM,QAAQ,GAAkC;QAC9C,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACtE,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,KAAK,KAAK,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC9D,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QAClE,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACnE,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,iBAAiB,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC;IAChH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE/F,gFAAgF;IAChF,IAAI,OAAwB,CAAC;IAC7B,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/G,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACzE,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe;QACzE,OAAO,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC;IACtH,CAAC;SAAM,CAAC,CAAC,4CAA4C;QACnD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,mGAAmG;IACnG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,YAAY,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1C,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEnI,mGAAmG;IACnG,0FAA0F;IAC1F,wEAAwE;IACxE,MAAM,KAAK,GAAG;QACZ,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,WAAW;QACnG,2BAA2B,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,WAAW;QAC7F,4BAA4B,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW;QAChG,qBAAqB,EAAE,OAAO,KAAK,gBAAgB;KACpD,CAAC;IAEF,MAAM,aAAa,GAAsB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC9B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO;QAC5B,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC7E,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AACjH,CAAC"}
|
package/dist/cjs/index.d.ts
CHANGED
|
@@ -36,4 +36,6 @@ export { gateDecision } from './merge-gate.js';
|
|
|
36
36
|
export type { GateDecisionInput, GateDecision, ReceiptView, RequiredContext, ProtectionState, GateReason, GateStatusState, EnforcementState, } from './merge-gate.js';
|
|
37
37
|
export { deployGate } from './deploy-gate.js';
|
|
38
38
|
export type { DeployGateInput, DeployGateDecision, DeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, } from './deploy-gate.js';
|
|
39
|
+
export { coverageReport } from './coverage-report.js';
|
|
40
|
+
export type { CoverageReportInput, CoverageReport, Applicability, PlacementId, PlacementStrength, OverallCoverage, HonestClaimKey, PerPlacementRow, RuntimePlacementInput, MergePlacementInput, DeployPlacementInput, ContentPlacementInput, } from './coverage-report.js';
|
|
39
41
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/cjs/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC"}
|
package/dist/cjs/index.js
CHANGED
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
* ```
|
|
20
20
|
*/
|
|
21
21
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
22
|
-
exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.resolveArtifacts = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
|
|
22
|
+
exports.coverageReport = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.resolveArtifacts = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
|
|
23
23
|
var guard_js_1 = require("./guard.js");
|
|
24
24
|
Object.defineProperty(exports, "guardToolCall", { enumerable: true, get: function () { return guard_js_1.guardToolCall; } });
|
|
25
25
|
var detector_js_1 = require("./detector.js");
|
|
@@ -67,4 +67,7 @@ Object.defineProperty(exports, "gateDecision", { enumerable: true, get: function
|
|
|
67
67
|
// deploy-gate (#8) — the PURE deploy authorization decision. No I/O; pipeline enforcement is input.
|
|
68
68
|
var deploy_gate_js_1 = require("./deploy-gate.js");
|
|
69
69
|
Object.defineProperty(exports, "deployGate", { enumerable: true, get: function () { return deploy_gate_js_1.deployGate; } });
|
|
70
|
+
// enforcement-coverage report (#9) — the PURE tetrad aggregator. No I/O; reads the primitives' states.
|
|
71
|
+
var coverage_report_js_1 = require("./coverage-report.js");
|
|
72
|
+
Object.defineProperty(exports, "coverageReport", { enumerable: true, get: function () { return coverage_report_js_1.coverageReport; } });
|
|
70
73
|
//# sourceMappingURL=index.js.map
|
package/dist/cjs/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,sCAA8C;AAArC,mGAAA,YAAY,OAAA;AACrB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AA2B9E,kGAAkG;AAClG,wFAAwF;AACxF,+DAAqE;AAA5D,wHAAA,OAAO,OAAoB;AAKpC,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAA8C;AAArC,4GAAA,UAAU,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,sCAA8C;AAArC,mGAAA,YAAY,OAAA;AACrB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AA2B9E,kGAAkG;AAClG,wFAAwF;AACxF,+DAAqE;AAA5D,wHAAA,OAAO,OAAoB;AAKpC,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAA8C;AAArC,4GAAA,UAAU,OAAA;AAMnB,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;uGACuG;AACvG,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvF,CAAC;
|
|
1
|
+
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;uGACuG;AACvG,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvF,CAAC;AAwCF;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA+EnE"}
|
package/dist/cjs/merge-gate.js
CHANGED
|
@@ -23,6 +23,11 @@ exports.gateDecision = gateDecision;
|
|
|
23
23
|
function normSha(s) {
|
|
24
24
|
return String(s == null ? '' : s).trim().toLowerCase();
|
|
25
25
|
}
|
|
26
|
+
/** Normalize an operation label for comparison (mirrors the deploy-gate): trim + lowercase, so a
|
|
27
|
+
* canonical 'merge' in any notation ('Merge', 'MERGE') is valid, while an absent/other op fails. */
|
|
28
|
+
function normOp(o) {
|
|
29
|
+
return String(o == null ? '' : o).trim().toLowerCase();
|
|
30
|
+
}
|
|
26
31
|
/** §1.2 — full lowercase SHA equality by default; prefix comparison is opt-in. */
|
|
27
32
|
function sameHead(a, b, allowPrefix) {
|
|
28
33
|
const na = normSha(a);
|
|
@@ -83,9 +88,11 @@ function gateDecision(input) {
|
|
|
83
88
|
if (receipt.currently_authorized !== true) {
|
|
84
89
|
return fail('failure', 'receipt_not_authorized');
|
|
85
90
|
}
|
|
86
|
-
// 4) operation binding — a receipt for a different operation does not authorize
|
|
91
|
+
// 4) operation binding (RT-P-01 / RT-P-05) — a receipt for a different operation does not authorize
|
|
92
|
+
// this gate, and a MISSING operation also fails closed (mirrors the deploy-gate T7). Compared via
|
|
93
|
+
// normOp so casing is notation, not an attack: 'Merge' is a valid merge; only a real other op fails.
|
|
87
94
|
const op = rc.operation ?? 'merge';
|
|
88
|
-
if (receipt.operation
|
|
95
|
+
if (receipt.operation == null || normOp(receipt.operation) !== normOp(op)) {
|
|
89
96
|
return fail('failure', 'operation_mismatch');
|
|
90
97
|
}
|
|
91
98
|
// 5) STALE HEAD — the central invariant: a receipt bound to an old head never greens a new one (M1).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;
|
|
1
|
+
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AA8HH,oCA+EC;AAxHD,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAA4B;IAC3C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;qGACqG;AACrG,SAAS,MAAM,CAAC,CAA4B;IAC1C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,SAAS,YAAY,CAAC,OAAoB,EAAE,cAAuB;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,cAAc,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1H,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAoB,KAAK,CAAC,eAAe,IAAK,EAAsB,CAAC;IAC7E,MAAM,UAAU,GAAoB,EAAE,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC7G,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;IAEjD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,cAAc,IAAI,KAAK,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KACpD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAkB,EAAgB,EAAE,CAAC,CAAC;QAC1E,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM;KACzF,CAAC,CAAC;IAEH,kFAAkF;IAClF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC;IACnC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qGAAqG;IACrG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,8EAA8E;IAC9E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,qFAAqF;IACrF,oGAAoG;IACpG,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,iBAAiB,KAAK,WAAW,IAAI,UAAU,CAAC,qBAAqB,KAAK,KAAK,CAAC;IAE1G,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,iBAAiB,KAAK,WAAW;YAAE,QAAQ,GAAG,mBAAmB,CAAC,CAAU,oCAAoC;aAC/G,IAAI,iBAAiB,KAAK,UAAU;YAAE,QAAQ,GAAG,0BAA0B,CAAC,CAAC,0BAA0B;;YACvG,QAAQ,GAAG,2BAA2B,CAAC,CAAqC,oCAAoC;IACvH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,oBAAoB;QAC5B,iBAAiB;QACjB,iBAAiB;QACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
|
|
3
|
+
* The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
|
|
4
|
+
* honest picture — where is the system actually inescapable, and where isn't it?
|
|
5
|
+
*
|
|
6
|
+
* Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
|
|
7
|
+
* ENFORCING for that placement.
|
|
8
|
+
*
|
|
9
|
+
* PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
|
|
10
|
+
* It reads only the input structs the primitives already emit (registry report.coverage +
|
|
11
|
+
* inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
|
|
12
|
+
* Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
|
|
13
|
+
* the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
|
|
14
|
+
*
|
|
15
|
+
* Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
|
|
16
|
+
* contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
|
|
17
|
+
* even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
|
|
18
|
+
*
|
|
19
|
+
* Public source (ships in the npm package): reads only placement state fields — no scoring logic,
|
|
20
|
+
* weights, thresholds, pattern names, endpoints, or secrets.
|
|
21
|
+
*/
|
|
22
|
+
import type { EnforcementState } from './merge-gate.js';
|
|
23
|
+
export type PlacementId = 'runtime' | 'merge' | 'deploy' | 'content';
|
|
24
|
+
export type Applicability = {
|
|
25
|
+
runtime: boolean;
|
|
26
|
+
merge: boolean;
|
|
27
|
+
deploy: boolean;
|
|
28
|
+
content: boolean;
|
|
29
|
+
};
|
|
30
|
+
export type RuntimePlacementInput = {
|
|
31
|
+
coverage: 'COMPLETE' | 'PARTIAL' | 'BYPASSED' | 'UNKNOWN' | string;
|
|
32
|
+
inescapable_runtime: boolean;
|
|
33
|
+
residuals?: string[];
|
|
34
|
+
};
|
|
35
|
+
export type MergePlacementInput = {
|
|
36
|
+
enforcement_state: EnforcementState | string;
|
|
37
|
+
inescapable_merge: boolean;
|
|
38
|
+
residuals?: string[];
|
|
39
|
+
};
|
|
40
|
+
export type DeployPlacementInput = {
|
|
41
|
+
enforcement_state: EnforcementState | string;
|
|
42
|
+
inescapable_deploy: boolean;
|
|
43
|
+
residuals?: string[];
|
|
44
|
+
};
|
|
45
|
+
export type ContentPlacementInput = {
|
|
46
|
+
coverage: 'COMPLETE' | 'PARTIAL' | 'UNRESOLVED' | 'EMPTY' | 'UNKNOWN' | string;
|
|
47
|
+
artifacts_ready?: boolean;
|
|
48
|
+
residuals?: string[];
|
|
49
|
+
};
|
|
50
|
+
export type CoverageReportInput = {
|
|
51
|
+
applicability: Applicability;
|
|
52
|
+
runtime?: RuntimePlacementInput | null;
|
|
53
|
+
merge?: MergePlacementInput | null;
|
|
54
|
+
deploy?: DeployPlacementInput | null;
|
|
55
|
+
content?: ContentPlacementInput | null;
|
|
56
|
+
};
|
|
57
|
+
export type PlacementStrength = 'ENFORCING' | 'WEAK' | 'UNKNOWN' | 'EXCLUDED';
|
|
58
|
+
export type OverallCoverage = 'FULLY_ENFORCED' | 'PARTIALLY_ENFORCED' | 'ADVISORY_ONLY' | 'CONTENT_BLOCKED' | 'UNKNOWN' | 'NOT_APPLICABLE';
|
|
59
|
+
export type HonestClaimKey = 'claim_fully_enforced' | 'claim_partially_enforced' | 'claim_advisory_only' | 'claim_content_blocked' | 'claim_unknown' | 'claim_not_applicable';
|
|
60
|
+
export type PerPlacementRow = {
|
|
61
|
+
placement: PlacementId;
|
|
62
|
+
applicable: boolean;
|
|
63
|
+
strength: PlacementStrength;
|
|
64
|
+
summary: {
|
|
65
|
+
enforcement_or_coverage: string;
|
|
66
|
+
inescapable_flag?: boolean | null;
|
|
67
|
+
};
|
|
68
|
+
residuals: string[];
|
|
69
|
+
};
|
|
70
|
+
export type CoverageReport = {
|
|
71
|
+
overall_coverage: OverallCoverage;
|
|
72
|
+
per_placement: PerPlacementRow[];
|
|
73
|
+
residuals: string[];
|
|
74
|
+
honest_claim_key: HonestClaimKey;
|
|
75
|
+
honest_claim_language: string;
|
|
76
|
+
flags: {
|
|
77
|
+
may_claim_inescapable_runtime: boolean;
|
|
78
|
+
may_claim_inescapable_merge: boolean;
|
|
79
|
+
may_claim_inescapable_deploy: boolean;
|
|
80
|
+
may_claim_full_tetrad: boolean;
|
|
81
|
+
};
|
|
82
|
+
};
|
|
83
|
+
/**
|
|
84
|
+
* §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
|
|
85
|
+
*/
|
|
86
|
+
export declare function coverageReport(input: CoverageReportInput): CoverageReport;
|
|
87
|
+
//# sourceMappingURL=coverage-report.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"coverage-report.d.ts","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErE,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG;IAChC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG;IACjC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAC7C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE9E,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAAG,oBAAoB,GAAG,eAAe,GACzD,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAErD,MAAM,MAAM,cAAc,GACtB,sBAAsB,GAAG,0BAA0B,GAAG,qBAAqB,GAC3E,uBAAuB,GAAG,eAAe,GAAG,sBAAsB,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE;QAAE,uBAAuB,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAChF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,cAAc,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE;QACL,6BAA6B,EAAE,OAAO,CAAC;QACvC,2BAA2B,EAAE,OAAO,CAAC;QACrC,4BAA4B,EAAE,OAAO,CAAC;QACtC,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,CAAC;AA4FF;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA2DzE"}
|
|
@@ -0,0 +1,198 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* enforcement-coverage report (#9) — the PURE tetrad aggregator (enforcement-coverage-SPEC §1–5).
|
|
3
|
+
* The capstone of scope honesty: it composes the four primitives' ALREADY-COMPUTED states into ONE
|
|
4
|
+
* honest picture — where is the system actually inescapable, and where isn't it?
|
|
5
|
+
*
|
|
6
|
+
* Thesis: complete ≠ enforced. A primitive installed or green for one commit is not the same as
|
|
7
|
+
* ENFORCING for that placement.
|
|
8
|
+
*
|
|
9
|
+
* PURE aggregator — NO I/O; it NEVER re-decides and NEVER re-runs a gate / resolver / registry (C7).
|
|
10
|
+
* It reads only the input structs the primitives already emit (registry report.coverage +
|
|
11
|
+
* inescapable_runtime; merge/deploy enforcement_state + inescapable_*; resolver report.coverage).
|
|
12
|
+
* Same input → same report (C9; residuals sorted). Fail-closed: the weakest applicable placement caps
|
|
13
|
+
* the overall, and a missing/unobservable applicable state is UNKNOWN — never treated as "fine".
|
|
14
|
+
*
|
|
15
|
+
* Applicability-aware: a placement that is not in scope for this target is EXCLUDED and NEVER
|
|
16
|
+
* contributes a residual or a cap (C4/C5). Scope honesty is paramount: every residual is named, and
|
|
17
|
+
* even FULLY_ENFORCED does not claim "nothing can ever bypass" — an infra residual always exists.
|
|
18
|
+
*
|
|
19
|
+
* Public source (ships in the npm package): reads only placement state fields — no scoring logic,
|
|
20
|
+
* weights, thresholds, pattern names, endpoints, or secrets.
|
|
21
|
+
*/
|
|
22
|
+
// deterministic honest-language templates (§4.4) — no over-claim; FULLY never says "nothing can bypass".
|
|
23
|
+
const TEMPLATES = {
|
|
24
|
+
claim_fully_enforced: 'All applicable CodeRifts placements are enforcing and non-bypassable for this target. '
|
|
25
|
+
+ 'Residuals outside tetrad (e.g. infra break-glass) may still exist.',
|
|
26
|
+
claim_partially_enforced: 'Partial enforcement: some applicable placements enforce; open gaps: {residuals}.',
|
|
27
|
+
claim_advisory_only: 'CodeRifts is present but no applicable placement is fully enforcing. Gaps: {residuals}.',
|
|
28
|
+
claim_content_blocked: 'Contract artifact content is not fully resolved; enforcement of preflight content is incomplete. Gaps: {residuals}.',
|
|
29
|
+
claim_unknown: 'One or more applicable placements cannot be observed. Cannot attest full enforcement. Gaps: {residuals}.',
|
|
30
|
+
claim_not_applicable: 'No CodeRifts placements are in scope for this target.',
|
|
31
|
+
};
|
|
32
|
+
const OVERALL_TO_KEY = {
|
|
33
|
+
FULLY_ENFORCED: 'claim_fully_enforced',
|
|
34
|
+
PARTIALLY_ENFORCED: 'claim_partially_enforced',
|
|
35
|
+
ADVISORY_ONLY: 'claim_advisory_only',
|
|
36
|
+
CONTENT_BLOCKED: 'claim_content_blocked',
|
|
37
|
+
UNKNOWN: 'claim_unknown',
|
|
38
|
+
NOT_APPLICABLE: 'claim_not_applicable',
|
|
39
|
+
};
|
|
40
|
+
function computeRuntime(applicable, input) {
|
|
41
|
+
if (!applicable)
|
|
42
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.inescapable_runtime ?? null } };
|
|
43
|
+
if (input == null)
|
|
44
|
+
return { strength: 'UNKNOWN', residuals: ['runtime_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
45
|
+
const residuals = [...(input.residuals ?? [])];
|
|
46
|
+
let strength;
|
|
47
|
+
if (input.coverage === 'COMPLETE' && input.inescapable_runtime === true)
|
|
48
|
+
strength = 'ENFORCING';
|
|
49
|
+
else if (input.coverage === 'UNKNOWN')
|
|
50
|
+
strength = 'UNKNOWN';
|
|
51
|
+
else
|
|
52
|
+
strength = 'WEAK';
|
|
53
|
+
if (input.coverage === 'BYPASSED')
|
|
54
|
+
residuals.push('runtime_bypassed');
|
|
55
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.inescapable_runtime } };
|
|
56
|
+
}
|
|
57
|
+
function computeMerge(applicable, input) {
|
|
58
|
+
if (!applicable)
|
|
59
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_merge ?? null } };
|
|
60
|
+
if (input == null)
|
|
61
|
+
return { strength: 'UNKNOWN', residuals: ['merge_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
62
|
+
const residuals = [...(input.residuals ?? [])];
|
|
63
|
+
let strength;
|
|
64
|
+
// RT-P-13: ENFORCING requires the flag AND a consistent enforcement_state — never trust the flag
|
|
65
|
+
// alone. A caller claiming inescapable_merge:true while enforcement_state is not ENFORCING is an
|
|
66
|
+
// inconsistent (adversarial) state → treat as WEAK and name it, never a false FULLY_ENFORCED.
|
|
67
|
+
if (input.inescapable_merge === true && input.enforcement_state === 'ENFORCING')
|
|
68
|
+
strength = 'ENFORCING';
|
|
69
|
+
else if (input.inescapable_merge === true) {
|
|
70
|
+
strength = 'WEAK';
|
|
71
|
+
residuals.push('inescapable_flag_inconsistent');
|
|
72
|
+
}
|
|
73
|
+
else if (input.enforcement_state === 'UNKNOWN')
|
|
74
|
+
strength = 'UNKNOWN';
|
|
75
|
+
else
|
|
76
|
+
strength = 'WEAK';
|
|
77
|
+
if (strength === 'WEAK') {
|
|
78
|
+
if (input.enforcement_state === 'ENFORCING' && input.inescapable_merge === false)
|
|
79
|
+
residuals.push('admin_bypass_open');
|
|
80
|
+
else if (input.enforcement_state === 'ABSENT')
|
|
81
|
+
residuals.push('merge_gate_not_configured');
|
|
82
|
+
else if (input.enforcement_state === 'ADVISORY')
|
|
83
|
+
residuals.push('merge_gate_advisory');
|
|
84
|
+
}
|
|
85
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_merge } };
|
|
86
|
+
}
|
|
87
|
+
function computeDeploy(applicable, input) {
|
|
88
|
+
if (!applicable)
|
|
89
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.enforcement_state ?? 'N/A', inescapable_flag: input?.inescapable_deploy ?? null } };
|
|
90
|
+
if (input == null)
|
|
91
|
+
return { strength: 'UNKNOWN', residuals: ['deploy_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
92
|
+
const residuals = [...(input.residuals ?? [])];
|
|
93
|
+
let strength;
|
|
94
|
+
// RT-P-13 (deploy analog): ENFORCING requires the flag AND a consistent enforcement_state.
|
|
95
|
+
if (input.inescapable_deploy === true && input.enforcement_state === 'ENFORCING')
|
|
96
|
+
strength = 'ENFORCING';
|
|
97
|
+
else if (input.inescapable_deploy === true) {
|
|
98
|
+
strength = 'WEAK';
|
|
99
|
+
residuals.push('inescapable_flag_inconsistent');
|
|
100
|
+
}
|
|
101
|
+
else if (input.enforcement_state === 'UNKNOWN')
|
|
102
|
+
strength = 'UNKNOWN';
|
|
103
|
+
else
|
|
104
|
+
strength = 'WEAK';
|
|
105
|
+
if (strength === 'WEAK') {
|
|
106
|
+
if (input.enforcement_state === 'ENFORCING' && input.inescapable_deploy === false)
|
|
107
|
+
residuals.push('bypass_open');
|
|
108
|
+
else if (input.enforcement_state === 'ABSENT')
|
|
109
|
+
residuals.push('deploy_path_ungated');
|
|
110
|
+
else if (input.enforcement_state === 'ADVISORY')
|
|
111
|
+
residuals.push('deploy_gate_advisory');
|
|
112
|
+
}
|
|
113
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.enforcement_state, inescapable_flag: input.inescapable_deploy } };
|
|
114
|
+
}
|
|
115
|
+
function computeContent(applicable, input) {
|
|
116
|
+
if (!applicable)
|
|
117
|
+
return { strength: 'EXCLUDED', residuals: [], summary: { enforcement_or_coverage: input?.coverage ?? 'N/A', inescapable_flag: input?.artifacts_ready ?? null } };
|
|
118
|
+
if (input == null)
|
|
119
|
+
return { strength: 'UNKNOWN', residuals: ['content_state_missing'], summary: { enforcement_or_coverage: 'MISSING', inescapable_flag: null } };
|
|
120
|
+
const residuals = [...(input.residuals ?? [])];
|
|
121
|
+
let strength;
|
|
122
|
+
if (input.coverage === 'COMPLETE' || input.coverage === 'EMPTY')
|
|
123
|
+
strength = 'ENFORCING'; // EMPTY is vacuously ready, not a gap
|
|
124
|
+
else if (input.coverage === 'UNRESOLVED') {
|
|
125
|
+
strength = 'WEAK';
|
|
126
|
+
residuals.push('content_unresolved');
|
|
127
|
+
}
|
|
128
|
+
else if (input.coverage === 'PARTIAL') {
|
|
129
|
+
strength = 'WEAK';
|
|
130
|
+
residuals.push('content_partial');
|
|
131
|
+
}
|
|
132
|
+
else
|
|
133
|
+
strength = 'UNKNOWN'; // 'UNKNOWN' or anything unexpected → fail-closed observation
|
|
134
|
+
return { strength, residuals, summary: { enforcement_or_coverage: input.coverage, inescapable_flag: input.artifacts_ready ?? null } };
|
|
135
|
+
}
|
|
136
|
+
/**
|
|
137
|
+
* §1–5 — the pure tetrad aggregator. Deterministic; no I/O; reads only the primitives' emitted states.
|
|
138
|
+
*/
|
|
139
|
+
export function coverageReport(input) {
|
|
140
|
+
const applicability = input.applicability || { runtime: false, merge: false, deploy: false, content: false };
|
|
141
|
+
const computed = {
|
|
142
|
+
runtime: computeRuntime(applicability.runtime === true, input.runtime),
|
|
143
|
+
merge: computeMerge(applicability.merge === true, input.merge),
|
|
144
|
+
deploy: computeDeploy(applicability.deploy === true, input.deploy),
|
|
145
|
+
content: computeContent(applicability.content === true, input.content),
|
|
146
|
+
};
|
|
147
|
+
const order = ['runtime', 'merge', 'deploy', 'content'];
|
|
148
|
+
const isApplicable = (p) => applicability[p] === true;
|
|
149
|
+
const applicableStrengths = order.filter(isApplicable).map((p) => computed[p].strength);
|
|
150
|
+
const contentApplicable = isApplicable('content');
|
|
151
|
+
const contentUnresolved = contentApplicable && input.content != null && input.content.coverage === 'UNRESOLVED';
|
|
152
|
+
const weakPlacements = order.filter((p) => isApplicable(p) && computed[p].strength === 'WEAK');
|
|
153
|
+
// §4.2 — mechanical overall aggregation (weakest applicable caps; fail-closed).
|
|
154
|
+
let overall;
|
|
155
|
+
if (applicableStrengths.length === 0) {
|
|
156
|
+
overall = 'NOT_APPLICABLE';
|
|
157
|
+
}
|
|
158
|
+
else if (applicableStrengths.every((s) => s === 'ENFORCING')) {
|
|
159
|
+
overall = 'FULLY_ENFORCED';
|
|
160
|
+
}
|
|
161
|
+
else if (applicableStrengths.some((s) => s === 'WEAK') && applicableStrengths.some((s) => s === 'ENFORCING')) {
|
|
162
|
+
overall = contentUnresolved ? 'CONTENT_BLOCKED' : 'PARTIALLY_ENFORCED';
|
|
163
|
+
}
|
|
164
|
+
else if (applicableStrengths.some((s) => s === 'WEAK')) { // no ENFORCING
|
|
165
|
+
overall = (contentUnresolved && weakPlacements.every((p) => p === 'content')) ? 'CONTENT_BLOCKED' : 'ADVISORY_ONLY';
|
|
166
|
+
}
|
|
167
|
+
else { // no WEAK, not all ENFORCING → some UNKNOWN
|
|
168
|
+
overall = 'UNKNOWN';
|
|
169
|
+
}
|
|
170
|
+
// §4.3 — residuals: union of applicable placements only, sorted unique (EXCLUDED contribute none).
|
|
171
|
+
const residualSet = new Set();
|
|
172
|
+
for (const p of order)
|
|
173
|
+
if (isApplicable(p))
|
|
174
|
+
for (const r of computed[p].residuals)
|
|
175
|
+
residualSet.add(r);
|
|
176
|
+
const residuals = [...residualSet].sort();
|
|
177
|
+
// §4.4 — claim key + deterministic honest language.
|
|
178
|
+
const honest_claim_key = OVERALL_TO_KEY[overall];
|
|
179
|
+
const honest_claim_language = TEMPLATES[honest_claim_key].replace('{residuals}', residuals.length ? residuals.join(', ') : 'none');
|
|
180
|
+
// §4.5 — flags (must not disagree with overall). RT-P-13: a per-placement inescapable claim tracks
|
|
181
|
+
// the COMPUTED strength (flag ∧ consistent enforcement), never the raw flag alone — so an
|
|
182
|
+
// inconsistent inescapable_* claim cannot leak into a may_claim_* true.
|
|
183
|
+
const flags = {
|
|
184
|
+
may_claim_inescapable_runtime: isApplicable('runtime') && computed.runtime.strength === 'ENFORCING',
|
|
185
|
+
may_claim_inescapable_merge: isApplicable('merge') && computed.merge.strength === 'ENFORCING',
|
|
186
|
+
may_claim_inescapable_deploy: isApplicable('deploy') && computed.deploy.strength === 'ENFORCING',
|
|
187
|
+
may_claim_full_tetrad: overall === 'FULLY_ENFORCED',
|
|
188
|
+
};
|
|
189
|
+
const per_placement = order.map((p) => ({
|
|
190
|
+
placement: p,
|
|
191
|
+
applicable: isApplicable(p),
|
|
192
|
+
strength: computed[p].strength,
|
|
193
|
+
summary: computed[p].summary,
|
|
194
|
+
residuals: isApplicable(p) ? [...new Set(computed[p].residuals)].sort() : [],
|
|
195
|
+
}));
|
|
196
|
+
return { overall_coverage: overall, per_placement, residuals, honest_claim_key, honest_claim_language, flags };
|
|
197
|
+
}
|
|
198
|
+
//# sourceMappingURL=coverage-report.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"coverage-report.js","sourceRoot":"","sources":["../../src/coverage-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqEH,yGAAyG;AACzG,MAAM,SAAS,GAAmC;IAChD,oBAAoB,EAClB,wFAAwF;UACtF,oEAAoE;IACxE,wBAAwB,EACtB,kFAAkF;IACpF,mBAAmB,EACjB,yFAAyF;IAC3F,qBAAqB,EACnB,qHAAqH;IACvH,aAAa,EACX,0GAA0G;IAC5G,oBAAoB,EAClB,uDAAuD;CAC1D,CAAC;AAEF,MAAM,cAAc,GAA4C;IAC9D,cAAc,EAAE,sBAAsB;IACtC,kBAAkB,EAAE,0BAA0B;IAC9C,aAAa,EAAE,qBAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,OAAO,EAAE,eAAe;IACxB,cAAc,EAAE,sBAAsB;CACvC,CAAC;AAIF,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI,EAAE,EAAE,CAAC;IACtL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAAE,QAAQ,GAAG,WAAW,CAAC;SAC3F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QACvD,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;QAAE,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;AACpI,CAAC;AAED,SAAS,YAAY,CAAC,UAAmB,EAAE,KAA6C;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC7L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAC/J,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACnG,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC7G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;aACjH,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;aACtF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;AAC3I,CAAC;AAED,SAAS,aAAa,CAAC,UAAmB,EAAE,KAA8C;IACxF,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9L,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IAChK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,2FAA2F;IAC3F,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW;QAAE,QAAQ,GAAG,WAAW,CAAC;SACpG,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;SAC9G,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;QAAE,QAAQ,GAAG,SAAS,CAAC;;QAChE,QAAQ,GAAG,MAAM,CAAC;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;aAC5G,IAAI,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;aAChF,IAAI,KAAK,CAAC,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,SAAS,cAAc,CAAC,UAAmB,EAAE,KAA+C;IAC1F,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;IAClL,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;IACjK,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,QAAQ,GAAG,WAAW,CAAC,CAAG,sCAAsC;SAC5H,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAAC,CAAC;SACjG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;;QAC3F,QAAQ,GAAG,SAAS,CAAC,CAAC,6DAA6D;IACxF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI,EAAE,EAAE,CAAC;AACxI,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,aAAa,GAAkB,KAAK,CAAC,aAAa,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5H,MAAM,QAAQ,GAAkC;QAC9C,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QACtE,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,KAAK,KAAK,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC;QAC9D,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QAClE,OAAO,EAAE,cAAc,CAAC,aAAa,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACnE,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,iBAAiB,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC;IAChH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE/F,gFAAgF;IAChF,IAAI,OAAwB,CAAC;IAC7B,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;QAC/G,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACzE,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe;QACzE,OAAO,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC;IACtH,CAAC;SAAM,CAAC,CAAC,4CAA4C;QACnD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAED,mGAAmG;IACnG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,YAAY,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAE1C,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEnI,mGAAmG;IACnG,0FAA0F;IAC1F,wEAAwE;IACxE,MAAM,KAAK,GAAG;QACZ,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,WAAW;QACnG,2BAA2B,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,WAAW;QAC7F,4BAA4B,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW;QAChG,qBAAqB,EAAE,OAAO,KAAK,gBAAgB;KACpD,CAAC;IAEF,MAAM,aAAa,GAAsB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC9B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO;QAC5B,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC7E,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AACjH,CAAC"}
|
package/dist/esm/index.d.ts
CHANGED
|
@@ -36,4 +36,6 @@ export { gateDecision } from './merge-gate.js';
|
|
|
36
36
|
export type { GateDecisionInput, GateDecision, ReceiptView, RequiredContext, ProtectionState, GateReason, GateStatusState, EnforcementState, } from './merge-gate.js';
|
|
37
37
|
export { deployGate } from './deploy-gate.js';
|
|
38
38
|
export type { DeployGateInput, DeployGateDecision, DeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, } from './deploy-gate.js';
|
|
39
|
+
export { coverageReport } from './coverage-report.js';
|
|
40
|
+
export type { CoverageReportInput, CoverageReport, Applicability, PlacementId, PlacementStrength, OverallCoverage, HonestClaimKey, PerPlacementRow, RuntimePlacementInput, MergePlacementInput, DeployPlacementInput, ContentPlacementInput, } from './coverage-report.js';
|
|
39
41
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/esm/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,GACT,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC"}
|
package/dist/esm/index.js
CHANGED
|
@@ -37,4 +37,6 @@ export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js
|
|
|
37
37
|
export { gateDecision } from './merge-gate.js';
|
|
38
38
|
// deploy-gate (#8) — the PURE deploy authorization decision. No I/O; pipeline enforcement is input.
|
|
39
39
|
export { deployGate } from './deploy-gate.js';
|
|
40
|
+
// enforcement-coverage report (#9) — the PURE tetrad aggregator. No I/O; reads the primitives' states.
|
|
41
|
+
export { coverageReport } from './coverage-report.js';
|
|
40
42
|
//# sourceMappingURL=index.js.map
|
package/dist/esm/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AA0B5B,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAKrE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AA0B5B,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAKrE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAM9C,uGAAuG;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;uGACuG;AACvG,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvF,CAAC;
|
|
1
|
+
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;uGACuG;AACvG,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvF,CAAC;AAwCF;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA+EnE"}
|
package/dist/esm/merge-gate.js
CHANGED
|
@@ -20,6 +20,11 @@
|
|
|
20
20
|
function normSha(s) {
|
|
21
21
|
return String(s == null ? '' : s).trim().toLowerCase();
|
|
22
22
|
}
|
|
23
|
+
/** Normalize an operation label for comparison (mirrors the deploy-gate): trim + lowercase, so a
|
|
24
|
+
* canonical 'merge' in any notation ('Merge', 'MERGE') is valid, while an absent/other op fails. */
|
|
25
|
+
function normOp(o) {
|
|
26
|
+
return String(o == null ? '' : o).trim().toLowerCase();
|
|
27
|
+
}
|
|
23
28
|
/** §1.2 — full lowercase SHA equality by default; prefix comparison is opt-in. */
|
|
24
29
|
function sameHead(a, b, allowPrefix) {
|
|
25
30
|
const na = normSha(a);
|
|
@@ -80,9 +85,11 @@ export function gateDecision(input) {
|
|
|
80
85
|
if (receipt.currently_authorized !== true) {
|
|
81
86
|
return fail('failure', 'receipt_not_authorized');
|
|
82
87
|
}
|
|
83
|
-
// 4) operation binding — a receipt for a different operation does not authorize
|
|
88
|
+
// 4) operation binding (RT-P-01 / RT-P-05) — a receipt for a different operation does not authorize
|
|
89
|
+
// this gate, and a MISSING operation also fails closed (mirrors the deploy-gate T7). Compared via
|
|
90
|
+
// normOp so casing is notation, not an attack: 'Merge' is a valid merge; only a real other op fails.
|
|
84
91
|
const op = rc.operation ?? 'merge';
|
|
85
|
-
if (receipt.operation
|
|
92
|
+
if (receipt.operation == null || normOp(receipt.operation) !== normOp(op)) {
|
|
86
93
|
return fail('failure', 'operation_mismatch');
|
|
87
94
|
}
|
|
88
95
|
// 5) STALE HEAD — the central invariant: a receipt bound to an old head never greens a new one (M1).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqFH,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAA4B;IAC3C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,SAAS,YAAY,CAAC,OAAoB,EAAE,cAAuB;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,cAAc,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1H,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAoB,KAAK,CAAC,eAAe,IAAK,EAAsB,CAAC;IAC7E,MAAM,UAAU,GAAoB,EAAE,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC7G,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;IAEjD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,cAAc,IAAI,KAAK,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KACpD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAkB,EAAgB,EAAE,CAAC,CAAC;QAC1E,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM;KACzF,CAAC,CAAC;IAEH,kFAAkF;IAClF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,
|
|
1
|
+
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqFH,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAA4B;IAC3C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;qGACqG;AACrG,SAAS,MAAM,CAAC,CAA4B;IAC1C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,SAAS,YAAY,CAAC,OAAoB,EAAE,cAAuB;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,cAAc,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1H,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAoB,KAAK,CAAC,eAAe,IAAK,EAAsB,CAAC;IAC7E,MAAM,UAAU,GAAoB,EAAE,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC7G,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;IAEjD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,cAAc,IAAI,KAAK,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KACpD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAkB,EAAgB,EAAE,CAAC,CAAC;QAC1E,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM;KACzF,CAAC,CAAC;IAEH,kFAAkF;IAClF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC;IACnC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qGAAqG;IACrG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,8EAA8E;IAC9E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,qFAAqF;IACrF,oGAAoG;IACpG,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,iBAAiB,KAAK,WAAW,IAAI,UAAU,CAAC,qBAAqB,KAAK,KAAK,CAAC;IAE1G,IAAI,QAAgC,CAAC;IACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,iBAAiB,KAAK,WAAW;YAAE,QAAQ,GAAG,mBAAmB,CAAC,CAAU,oCAAoC;aAC/G,IAAI,iBAAiB,KAAK,UAAU;YAAE,QAAQ,GAAG,0BAA0B,CAAC,CAAC,0BAA0B;;YACvG,QAAQ,GAAG,2BAA2B,CAAC,CAAqC,oCAAoC;IACvH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,oBAAoB;QAC5B,iBAAiB;QACjB,iBAAiB;QACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@coderifts/agent-guard",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.0",
|
|
4
4
|
"description": "Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded fail-closed, and enforced⟺executed (P0 client-enforcement pack).",
|
|
5
5
|
"main": "./dist/cjs/index.js",
|
|
6
6
|
"module": "./dist/esm/index.js",
|