@coderifts/agent-guard 1.8.0 → 2.0.0

package/dist/esm/with-coderifts.js

@@ -15,106 +15,88 @@
  * `composition_assurance` so the trace survives into any later coverageReport consumer. S2 adds NO
  * enforcement at call time.
  *
- * COMPOSITION OBSERVATION (this slice): optional `onEvent` is forwarded UNCHANGED onto the guard
- * config the composition builds (the same surface guardToolRegistry already spreads into
- * guardToolCall). Optional `onOutcome` is a composition-level hook: after each GUARDED tool's
- * execute returns a GuardOutcome, the composition invokes onOutcome then returns that outcome to the
- * host byte-identical. Observation is NOT enforcement — it does not change COMPOSITION_CALL_POLICY_COMPLETE,
- * coverage, residuals, or whether any tool runs.
+ * COMPOSITION OBSERVATION: optional `onEvent` is forwarded UNCHANGED onto the guard config.
+ * Optional `onSettledCall` is a composition-level hook: it fires EXACTLY ONCE for every SETTLED
+ * call through the RETURNED tool table (GUARDED | PASSTHROUGH | BYPASSED × RETURNED | THREW).
+ * Discriminant is an EXPLICIT TAG (`kind: 'settled_call'` plus route/terminal), never the absence of
+ * a field. On the GUARDED+RETURNED arm, `outcome` is non-optional. Observation is NOT enforcement —
+ * it does not change COMPOSITION_CALL_POLICY_COMPLETE, coverage, residuals, or whether any tool runs.
+ * The package holds NO counters and computes NO ratios at runtime; pure fold helpers are optional
+ * host-side tools (see foldTableSettledCalls / guardedFractionAmongRoutes).
  *
  * TELEMETRY GAPS (honest boundaries — read before claiming "every mutation was checked"):
  *   - onEvent does NOT emit a dedicated event for BLOCK or REQUIRE_APPROVAL; after preflight_result
- *     those paths return blocked with no further emit. Those outcomes ARE visible via onOutcome
- *     (outcome.executed === false, outcome.verdict.kind === 'BLOCK' | 'APPROVAL'), not via onEvent.
+ *     those paths return blocked with no further emit. Those outcomes ARE visible via onSettledCall
+ *     on the GUARDED arm (outcome.executed === false, outcome.verdict.kind === 'BLOCK' | 'APPROVAL').
  *   - The GuardEvent payload carries no envelope, receipt, or fingerprint — only optional decisionId
- *     (and action/cause/signals/…). onOutcome carries the full GuardOutcome, including
- *     outcome.verdict.envelope where the frozen path attached one (BLOCK / APPROVAL / ALLOW / MONITOR).
- *   - onOutcome fires ONLY for guarded tools (_coderifts.guarded === true). Readonly passthrough
- *     tools never enter guardToolCall and produce no GuardOutcome; they are not wrapped and never
- *     fire onOutcome.
+ *     (and action/cause/signals/…). GUARDED+RETURNED onSettledCall carries the full GuardOutcome,
+ *     including outcome.verdict.envelope where the frozen path attached one.
+ *   - onSettledCall sees ONLY calls through the table withCodeRifts returned. Host-invoked raw tools
+ *     outside that table are invisible. Never treat observation as "total operations" or "100%
+ *     enforcement coverage".
  *   - onEvent is partial even for other branches (e.g. closed-availability stops may emit only
  *     preflight_start; the declared type 'execution_skipped' is never emitted by the frozen core).
  *   - Neither hook alone is a complete substrate for receipt carry-forward: onEvent lacks the
- *     envelope/receipt; onOutcome exposes them when present but does not retain or re-inject them
- *     across calls (that is a later slice).
+ *     envelope/receipt; onSettledCall exposes them when present on the GUARDED+RETURNED arm but does
+ *     not retain or re-inject them across calls (that is a later slice).
  *
  * S2 does NOT re-guard what the registry already fails closed on. A `forceReadonly`/`classify`
  * downgrade of a heuristic mutator is, under the registry's default `failOnUnguardedMutator:true`,
  * already a thrown `FORCE_READONLY_MUTATOR` (no report exists); when the caller passes
  * `failOnUnguardedMutator:false` it is already registry coverage 'BYPASSED', which fails any
- * `requireCoverage` above BYPASSED by the ordering alone. So there is deliberately NO second
- * composition-level abort for weakening overrides — that would create two places that must agree. The
- * composition merely RECORDS the residual (composition_forced_readonly_on_heuristic_mutator /
- * composition_unknown_treated_as_readonly) so the reason the composition is narrower than it looks is
- * preserved on the assurance object. Registry-thrown errors propagate UNCHANGED (never wrapped or
- * swallowed).
- *
- * How the weakening residuals are derived, and their KNOWN LIMITATION (a frozen-registry property, not
- * a composition property): both residuals are read SOLELY from `registry_report.warnings` — the
- * composition never recomputes classification. The registry emits `force_readonly_on_mutator_heuristic`
- * ONLY for the downgrade of a HEURISTIC-classified mutator (a tool with no `classify` entry and no
- * `mutationClass`, whose NAME heuristic is mutating), reached via `forceReadonly` OR a `classify`
- * entry. Crucially, `forceReadonly` has NO effect on a tool the caller declared with an explicit
- * `mutationClass`: `resolveClass` (tool-registry.ts:154-165) returns on `tool.mutationClass` at :157,
- * BEFORE `forceReadonly` is consulted at :158 — so such a tool resolves `mutating`, stays guarded,
- * yields coverage 'COMPLETE', and emits NO warning. The composition therefore produces NO residual in
- * that case and CANNOT detect it: the caller's `forceReadonly` was silently ignored by the frozen
- * registry. This is a limitation of the frozen registry surface, recorded (not worked around) here and
- * pinned by a "documented limitation" test. The residual is named
- * `composition_forced_readonly_on_heuristic_mutator` so it does not promise coverage of the case it
- * cannot see.
+ * `requireCoverage` above BYPASSED by the ordering alone. The composition RECORDS residuals from
+ * registry warnings. When forceReadonly lists a tool that declared explicit mutationClass, the
+ * registry emits `force_readonly_ignored_explicit_mutation_class:<name>` (break-glass ignored).
  *
  * COMPOSITION_CALL_POLICY_COMPLETE (when the composition may claim product-level runtime
  * inescapability) requires ALL of the following — do not flip the constant when only a subset lands:
  *   (1) Automatic binders for call shapes that ALREADY carry both sides of the change (old_string/
- *       new_string, edits[]) — DONE (commit 582504a / defaultBinder lift). Not the same as covering
- *       every real agent edit shape.
+ *       new_string, edits[]) — DONE. Not the same as covering every real agent edit shape.
  *   (2) Receipt carry-forward (S5) — host-threaded chaining is POSSIBLE (optional previousReceipt +
- *       verifyReceiptChainLinkage; commit 588a376). NOT met for this constant: the composition holds
- *       no cursor (decision, not omission — 3/5 design reviews against a package-held prior).
- *   (3) A freshness-safe source of prior content for write-style calls (path + new content only),
- *       where the host never supplied `before` — NOT done. The package performs no IO, so a prior it
- *       was not given cannot be obtained; inventing one (including empty-string before) would send a
- *       fabricated artifact to the oracle. That needs a host/guard freshness protocol, not another
- *       binder rename. Flipping this constant on (1)+(2) alone is incorrect.
- *
- * STILL DELIBERATELY OUT OF SCOPE (later slices; not stubbed, not implied here): receipt carry-forward;
- * freshness-safe prior content for write-style calls; call-time STOP re-implementation (already
- * complete in the frozen guardToolCall path); WARN monitoring policy beyond the frozen sink gate;
- * framework adapters. (Both-sides edit-side lifting in defaultBinder is landed — see (1) above.)
+ *       verifyReceiptChainLinkage). NOT met for this constant: the composition holds no cursor.
+ *   (3) A freshness-safe source of prior content for write-style calls (path + new content only) —
+ *       NOT done.
  *
  * THE TWO-SCOPE RULE (never merged):
- *   - `registry_report` is EXACTLY what `guardToolRegistry` returned, passed through untouched. It may
- *     legitimately state coverage 'COMPLETE' and claim.inescapable_runtime true — that is the runtime
- *     tool-boundary's own honest truth (Placement A).
- *   - `composition_assurance` is the narrower PRODUCT-level statement — what withCodeRifts as a whole
- *     is willing to claim today. It is computed SEPARATELY and never rewrites the registry's verdict.
- *     Its S1 semantics are UNCHANGED in S2 and under observation: coverage stays 'PARTIAL',
- *     inescapable_runtime stays false via the same COMPOSITION_CALL_POLICY_COMPLETE conjunction.
- * The two truths coexist; neither is derived by mutating the other.
- *
- * `requireCoverage` scope (read this before trusting a green construction): it constrains the
- * REGISTRY-level coverage ONLY. It CANNOT be used to demand composition-level runtime inescapability —
- * that remains unreachable while COMPOSITION_CALL_POLICY_COMPLETE is false (see the three conditions
- * above, not merely "binders + receipts"). A caller passing `requireCoverage:'COMPLETE'` is asserting
- * an expectation about the registry tool-boundary surface — NOT a product-level guarantee. The abort
- * text and this doc say so explicitly so nobody reads a green construction as product-level
- * enforcement.
+ *   - `registry_report` is EXACTLY what `guardToolRegistry` returned, passed through untouched.
+ *   - `composition_assurance` is the narrower PRODUCT-level statement, computed SEPARATELY.
+ */
+import { guardToolRegistry } from './tool-registry.js';
+/**
+ * Pure fold: count routes in a host-owned list of settled-call observations.
+ * The package never accumulates these at runtime.
+ */
+export function foldTableSettledCalls(events) {
+    const counts = { GUARDED: 0, PASSTHROUGH: 0, BYPASSED: 0 };
+    for (const e of events) {
+        if (e.kind !== 'settled_call')
+            continue;
+        counts[e.route] += 1;
+    }
+    return counts;
+}
+/**
+ * Fraction of GUARDED among observed routes, or ABSENT when a ratio would be misleading.
  *
- * Operation semantics (accurate scope): `operationForClass` (tool-registry.ts) already derives a
- * per-tool operation from the tool's mutation class, OVERRIDING the guard config for specialised
- * classes (deploy→'deploy', publish→'publish', vcs-merge→'merge', …). The mandatory `operation` here
- * therefore governs generic mutating tools and acts as the session-level default; it does NOT override
- * a deploy-class tool's 'deploy'. It is mandatory because receipts bind to an operation and
- * merge != deploy: a silent default would risk evaluating a deploy under merge semantics.
+ * Returns `kind: 'absent'` (not zero) when:
+ *   - no settled calls were observed, or
+ *   - only a single route tag has a non-zero count (one-sided observation).
  *
- * Abort discipline: pre-registry input problems (missing/empty operation, missing client, an invalid
- * requireCoverage value) are collected and thrown as ONE error listing ALL of them. The
- * requireCoverage-vs-actual check is necessarily sequenced AFTER the registry call (it needs the
- * registry's coverage), so it is its own abort; it cannot be batched with the pre-registry problems
- * because a valid operation+client are required even to reach the registry.
+ * Never returns a number that could be read as "0% enforcement" or "100% coverage" from partial data.
+ * The package does not call this automatically.
  */
-import { guardToolRegistry } from './tool-registry.js';
+export function guardedFractionAmongRoutes(counts) {
+    const routesWithCalls = ['GUARDED', 'PASSTHROUGH', 'BYPASSED']
+        .filter((r) => counts[r] > 0);
+    if (routesWithCalls.length === 0) {
+        return { kind: 'absent', why: 'no_settled_calls' };
+    }
+    if (routesWithCalls.length === 1) {
+        return { kind: 'absent', why: 'one_route_only' };
+    }
+    const sum = counts.GUARDED + counts.PASSTHROUGH + counts.BYPASSED;
+    return { kind: 'present', fraction: counts.GUARDED / sum };
+}
 /**
  * Whether the composition's call-time / content policy is complete enough to claim product-level
  * runtime inescapability. Stays FALSE until EVERY condition below is delivered — later slices ADD
@@ -122,23 +104,15 @@ import { guardToolRegistry } from './tool-registry.js';
  *
  * Conditions (all required; do NOT flip this constant because a subset landed):
  *   (1) DONE — automatic binders for shapes that already carry both edit sides (old_string/new_string,
- *       edits[] → artifacts). Commit 582504a. Does NOT cover write-style path+new-content-only calls.
+ *       edits[] → artifacts). Does NOT cover write-style path+new-content-only calls.
  *   (2) NOT DONE — receipt carry-forward (S5).
- *   (3) NOT DONE — freshness-safe prior content for write-style calls. The package does no IO, so a
- *       `before` the host never supplied cannot be obtained; inventing one (including empty string)
- *       fabricates an oracle input. Needs a host/guard freshness protocol, not binder renaming.
- *
- * Historically this comment named only (1) and (2). That wording is narrower than reality: after (1)
- * shipped, a reader could think "binders + S5" was enough and flip the flag incorrectly. Do not.
+ *   (3) NOT DONE — freshness-safe prior content for write-style calls.
  *
  * UNCHANGED by S2 / composition observation (observing ≠ enforcing). Value stays false until all three.
  */
 const COMPOSITION_CALL_POLICY_COMPLETE = false;
 const RESIDUAL_CALL_POLICY_INCOMPLETE = 'composition_call_policy_incomplete';
 // S2 weakening-override residuals — derived SOLELY from registry report.warnings (never recomputed).
-// The name says "heuristic_mutator" on purpose: the registry only emits the underlying warning for a
-// downgrade of a HEURISTIC-classified mutator (see the header limitation), so the residual must not
-// promise coverage of a downgrade it cannot see (an explicit-mutationClass tool).
 const RESIDUAL_FORCED_READONLY = 'composition_forced_readonly_on_heuristic_mutator';
 const RESIDUAL_UNKNOWN_READONLY = 'composition_unknown_treated_as_readonly';
 /**
@@ -161,25 +135,23 @@ function coverageRank(coverage) {
         : undefined;
 }
 /**
- * Invoke onOutcome without affecting the host call. Swallows synchronous throws AND rejected
+ * Invoke onSettledCall without affecting the host call. Swallows synchronous throws AND rejected
  * promises (unlike the frozen emit hook, which only try/catches sync throws and ignores returned
  * promises — that host-side footgun is deliberately not reproduced here).
  */
-async function safeOnOutcome(onOutcome, payload) {
+async function safeOnSettledCall(onSettledCall, payload) {
     try {
-        await Promise.resolve(onOutcome(payload));
+        await Promise.resolve(onSettledCall(payload));
     }
     catch {
         /* observation never changes execution */
     }
 }
 /**
- * Build a NEW ProtectedTool shell around a frozen guarded tool so we can replace execute without
- * mutating the frozen registry object. name / description / inputSchema / meta / _coderifts are
- * copied by reference (the _coderifts bag is already frozen by the registry). The new shell is
- * frozen for parity with registry tools.
+ * Build a NEW ProtectedTool shell so we can observe settle without mutating the frozen registry object.
+ * name / description / inputSchema / meta / _coderifts are copied by reference.
  */
-function wrapGuardedForObservation(tool, onOutcome) {
+function wrapForSettledCallObservation(tool, route, onSettledCall) {
     const innerExecute = tool.execute;
     const toolName = tool.name;
     const shell = {
@@ -189,22 +161,63 @@ function wrapGuardedForObservation(tool, onOutcome) {
         meta: tool.meta,
         _coderifts: tool._coderifts,
         execute: async (args) => {
-            // If the inner execute rejects, do NOT invent an outcome — propagate the rejection unchanged.
-            const outcome = await innerExecute(args);
-            await safeOnOutcome(onOutcome, {
-                toolName,
-                // Guarded execute always returns a GuardOutcome from guardToolCall; assert the type for callers.
-                outcome: outcome,
-            });
-            // Host must receive the same object the unwrapped tool returned (reference-identical).
-            return outcome;
+            try {
+                const result = await innerExecute(args);
+                if (route === 'GUARDED') {
+                    await safeOnSettledCall(onSettledCall, {
+                        kind: 'settled_call',
+                        route: 'GUARDED',
+                        terminal: 'RETURNED',
+                        toolName,
+                        // Guarded execute always returns a GuardOutcome from guardToolCall.
+                        outcome: result,
+                    });
+                }
+                else {
+                    await safeOnSettledCall(onSettledCall, {
+                        kind: 'settled_call',
+                        route,
+                        terminal: 'RETURNED',
+                        toolName,
+                        result,
+                    });
+                }
+                // Host must receive the same object/value the unwrapped tool returned (reference-identical for objects).
+                return result;
+            }
+            catch (error) {
+                await safeOnSettledCall(onSettledCall, {
+                    kind: 'settled_call',
+                    route,
+                    terminal: 'THREW',
+                    toolName,
+                    error,
+                });
+                throw error;
+            }
         },
     };
-    // Match registry freeze discipline: freeze _coderifts if not already, freeze the shell.
     if (!Object.isFrozen(shell._coderifts))
         Object.freeze(shell._coderifts);
     return Object.freeze(shell);
 }
+/** Tools forced to readonly via heuristic break-glass — observed as BYPASSED, not true PASSTHROUGH. */
+function bypassedToolNames(report) {
+    const names = new Set();
+    for (const w of report.warnings) {
+        const prefix = 'force_readonly_on_mutator_heuristic:';
+        if (w.startsWith(prefix))
+            names.add(w.slice(prefix.length));
+    }
+    return names;
+}
+function routeForTool(tool, bypassed) {
+    if (tool._coderifts.guarded)
+        return 'GUARDED';
+    if (bypassed.has(tool.name))
+        return 'BYPASSED';
+    return 'PASSTHROUGH';
+}
 /**
  * Wrap guardToolRegistry with a mandatory operation and a separately-computed composition assurance.
  * Fails at CONSTRUCTION (never at first tool call) for a missing client, a missing/empty operation, an
@@ -294,14 +307,14 @@ export function withCodeRifts(input) {
         inescapable_runtime: compositionInescapableRuntime,
         residuals,
     };
-    // Outcome observation: registry returns FROZEN ProtectedTool objects (and a frozen tools array).
-    // We cannot reassign execute on a frozen tool, so we build NEW shells for guarded tools only when
-    // onOutcome is provided. Readonly tools are left as the same object references (no GuardOutcome).
-    // The tools ARRAY is also frozen by the registry — always return a fresh array when we wrap.
+    // Settled-call observation: registry returns FROZEN ProtectedTool objects (and a frozen tools array).
+    // We cannot reassign execute on a frozen tool, so we build NEW shells for EVERY tool in the table
+    // when onSettledCall is provided — including passthrough and forced-bypass (readonly) tools.
     let toolsOut = tools;
-    if (input.onOutcome) {
-        const onOutcome = input.onOutcome;
-        toolsOut = Object.freeze(tools.map((t) => (t._coderifts.guarded ? wrapGuardedForObservation(t, onOutcome) : t)));
+    if (input.onSettledCall) {
+        const onSettledCall = input.onSettledCall;
+        const bypassed = bypassedToolNames(report);
+        toolsOut = Object.freeze(tools.map((t) => wrapForSettledCallObservation(t, routeForTool(t, bypassed), onSettledCall)));
     }
     const result = {
         tools: toolsOut,

package/dist/esm/with-coderifts.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-coderifts.js","sourceRoot":"","sources":["../../src/with-coderifts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA0FvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAE/C,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AAC7E,qGAAqG;AACrG,qGAAqG;AACrG,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,kDAAkD,CAAC;AACpF,MAAM,yBAAyB,GAAG,yCAAyC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwC;IAC7D,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,+GAA+G;AAC/G,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,iBAAiB,CAAC,QAA+B,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,SAA2D,EAC3D,OAAwB;IAExB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,IAAmB,EACnB,SAA2D;IAE3D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAkB;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;YAC/B,8FAA8F;YAC9F,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,aAAa,CAAC,SAAS,EAAE;gBAC7B,QAAQ;gBACR,iGAAiG;gBACjG,OAAO,EAAE,OAAgC;aAC1C,CAAC,CAAC;YACH,uFAAuF;YACvF,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,wFAAwF;IACxF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,sIAAsI,CAAC,CAAC;IACxJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC,mFAAmF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,kBAAkB;cACxE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACjC,+DAA+D;IAC/D,oGAAoG;IACpG,uGAAuG;IACvG,oGAAoG;IACpG,6DAA6D;IAC7D,oGAAoG;IACpG,8EAA8E;IAC9E,gGAAgG;IAChG,+DAA+D;IAC/D,MAAM,KAAK,GAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAChF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAA4B;QACtC,KAAK;QACL,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,UAAU;QACtD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;KACnD,CAAC;IAEF,wFAAwF;IACxF,gGAAgG;IAChG,4FAA4F;IAC5F,2BAA2B;IAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEjE,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,uCAAuC;QACjG,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAG,kDAAkD;QAC5G,IAAI,YAAY,KAAK,SAAS,IAAI,UAAU,GAAG,YAAY,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,QAAQ,8BAA8B,KAAK,CAAC,eAAe,IAAI;kBACnI,mIAAmI;kBACnI,8NAA8N,CACjO,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,qGAAqG;IACrG,iGAAiG;IACjG,MAAM,6BAA6B,GACjC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,CAAC;IAEvE,iGAAiG;IACjG,+FAA+F;IAC/F,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,sCAAsC,CAAC,CAAC,EAAE,CAAC;QACtF,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IAED,qGAAqG;IACrG,0GAA0G;IAC1G,MAAM,qBAAqB,GAAyB;QAClD,QAAQ,EAAE,SAAS;QACnB,mBAAmB,EAAE,6BAA6B;QAClD,SAAS;KACV,CAAC;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,QAAQ,GAAoB,KAAwB,CAAC;IACzD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,QAAQ,GAAG,MAAM,CAAC,MAAM,CACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAwB;QAClC,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,MAAM;QACvB,qBAAqB;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"with-coderifts.js","sourceRoot":"","sources":["../../src/with-coderifts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA2FvD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAyC;IAEzC,MAAM,MAAM,GAAgC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QACxC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAmC;IAInC,MAAM,eAAe,GAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAW;SACtE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;AAC7D,CAAC;AA8DD;;;;;;;;;;;;GAYG;AACH,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAE/C,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AAC7E,qGAAqG;AACrG,MAAM,wBAAwB,GAAG,kDAAkD,CAAC;AACpF,MAAM,yBAAyB,GAAG,yCAAyC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwC;IAC7D,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,+GAA+G;AAC/G,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QACtE,CAAC,CAAC,iBAAiB,CAAC,QAA+B,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,aAAsE,EACtE,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CACpC,IAAmB,EACnB,KAAgB,EAChB,aAAsE;IAEtE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAkB;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,iBAAiB,CAAC,aAAa,EAAE;wBACrC,IAAI,EAAE,cAAc;wBACpB,KAAK,EAAE,SAAS;wBAChB,QAAQ,EAAE,UAAU;wBACpB,QAAQ;wBACR,oEAAoE;wBACpE,OAAO,EAAE,MAA+B;qBACzC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,iBAAiB,CAAC,aAAa,EAAE;wBACrC,IAAI,EAAE,cAAc;wBACpB,KAAK;wBACL,QAAQ,EAAE,UAAU;wBACpB,QAAQ;wBACR,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;gBACD,yGAAyG;gBACzG,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,aAAa,EAAE;oBACrC,IAAI,EAAE,cAAc;oBACpB,KAAK;oBACL,QAAQ,EAAE,OAAO;oBACjB,QAAQ;oBACR,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,uGAAuG;AACvG,SAAS,iBAAiB,CAAC,MAA8B;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,sCAAsC,CAAC;QACtD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,QAAqB;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/C,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,sIAAsI,CAAC,CAAC;IACxJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC,mFAAmF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,kBAAkB;cACxE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACjC,+DAA+D;IAC/D,oGAAoG;IACpG,uGAAuG;IACvG,oGAAoG;IACpG,6DAA6D;IAC7D,oGAAoG;IACpG,8EAA8E;IAC9E,gGAAgG;IAChG,+DAA+D;IAC/D,MAAM,KAAK,GAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAChF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAA4B;QACtC,KAAK;QACL,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,UAAU;QACtD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;KACnD,CAAC;IAEF,wFAAwF;IACxF,gGAAgG;IAChG,4FAA4F;IAC5F,2BAA2B;IAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEjE,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,uCAAuC;QACjG,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAG,kDAAkD;QAC5G,IAAI,YAAY,KAAK,SAAS,IAAI,UAAU,GAAG,YAAY,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,QAAQ,8BAA8B,KAAK,CAAC,eAAe,IAAI;kBACnI,mIAAmI;kBACnI,8NAA8N,CACjO,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,qGAAqG;IACrG,iGAAiG;IACjG,MAAM,6BAA6B,GACjC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,gCAAgC,CAAC;IAEvE,iGAAiG;IACjG,+FAA+F;IAC/F,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,sCAAsC,CAAC,CAAC,EAAE,CAAC;QACtF,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IAED,qGAAqG;IACrG,0GAA0G;IAC1G,MAAM,qBAAqB,GAAyB;QAClD,QAAQ,EAAE,SAAS;QACnB,mBAAmB,EAAE,6BAA6B;QAClD,SAAS;KACV,CAAC;IAEF,sGAAsG;IACtG,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,QAAQ,GAAoB,KAAwB,CAAC;IACzD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,QAAQ,GAAG,MAAM,CAAC,MAAM,CACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC,CAC1E,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAwB;QAClC,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,MAAM;QACvB,qBAAqB;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACzE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderifts/agent-guard",
-  "version": "1.8.0",
+  "version": "2.0.0",
   "description": "Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded fail-closed, and enforced⟺executed (P0 client-enforcement pack).",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",