@coderifts/agent-guard 11.0.1 → 13.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CodeRifts
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cjs/cas-adapters/fs-default-wire.d.ts

@@ -1,4 +1,6 @@
 import type { ExecuteIfUnchangedOutcome } from '../conditional-write.js';
+import type { VersionToken } from '../conditional-write.js';
+import type { FsObjectIdentity } from './fs.js';
 /** Unambiguous fs target: a non-empty `path` string on tool arguments (Write convention). */
 export declare function inferFsPathFromArgs(args: unknown): string | null;
 /**
@@ -6,10 +8,48 @@ export declare function inferFsPathFromArgs(args: unknown): string | null;
  * is not an Edit (no old_string/new_string). Fragments are not a whole-file CAS.
  */
 export declare function inferFullFileWriteContent(args: unknown): string | null;
+/**
+ * Options carrying the AUTHORIZATION-TIME measurement into the write.
+ */
+export type FsCasWireOptions = {
+    /**
+     * Token of the state the AUTHORIZATION examined, measured at T1 by the runner — before preflight,
+     * not at write time. This is the whole fix: see the note on wrapWriteWithFsCas.
+     */
+    expected_token?: VersionToken | null;
+    /** Identity (dev+ino) of that same T1 object. Catches an inode swap the token cannot see. */
+    expected_identity?: FsObjectIdentity | null;
+};
+/** The pair a runner measures at T1. Both halves describe the SAME observation. */
+export type FsAuthorizationMeasurement = {
+    expected_token: VersionToken;
+    expected_identity: FsObjectIdentity | null;
+};
 /**
  * Wire the FS adapter when path + full-file contents are both present.
  * Otherwise run the host write unchanged. If the host already returned an
  * ExecuteIfUnchangedOutcome, pass it through (do not wrap again).
+ *
+ * THE TOKEN MUST COME FROM T1. This function used to call createFsVersionToken HERE, inside
+ * executeFactory — after preflight (T1) and after the T2 recheck — and then condition the write on
+ * that self-fetched value. Measured on 12.0.0: with a writer landing between T2 and that read, the
+ * CAS adopted the interfering state as its legitimate starting point and still reported
+ * status:'committed' with enforced:true. It was a real check of a vacuous window — it asked whether
+ * the state had changed since a read a microsecond earlier, which is a question whose answer is
+ * always no and which says nothing about the state the authorization actually examined.
+ *
+ * Now the expected token is supplied by the caller from the T1 measurement. When it is ABSENT we do
+ * NOT fall back to self-fetching, because that is precisely the vacuous claim: the write runs
+ * unwrapped and the guarantee is NON_ATOMIC, which is the honest thing to report and which
+ * requireConditionalWrite will refuse. A weaker guarantee is reportable; a false one is not.
+ */
+export declare function wrapWriteWithFsCas<T>(args: unknown, write: () => Promise<T> | T, opts?: FsCasWireOptions): Promise<T | ExecuteIfUnchangedOutcome<unknown>>;
+/**
+ * The T1 measurement itself — call this in the RUNNER, before preflight, and pass the result to
+ * wrapWriteWithFsCas. Returns null when this call is not an inferable full-file FS write, or when
+ * the path is unsafe / unreadable (a token we could not measure is not a token we may claim).
  */
-export declare function wrapWriteWithFsCas<T>(args: unknown, write: () => Promise<T> | T): Promise<T | ExecuteIfUnchangedOutcome<unknown>>;
+export declare function measureFsAuthorization(args: unknown): Promise<FsAuthorizationMeasurement | null>;
+/** Convenience: the token half only. */
+export declare function measureFsAuthorizationToken(args: unknown): Promise<VersionToken | null>;
 //# sourceMappingURL=fs-default-wire.d.ts.map

package/dist/cjs/cas-adapters/fs-default-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-default-wire.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGzE,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC1B,OAAO,CAAC,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAmBjD"}
+{"version":3,"file":"fs-default-wire.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAGhD,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,mFAAmF;AACnF,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAC3B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAgBjD;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAetG;AAED,wCAAwC;AACxC,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG7F"}

package/dist/cjs/cas-adapters/fs-default-wire.js

@@ -15,6 +15,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.inferFsPathFromArgs = inferFsPathFromArgs;
 exports.inferFullFileWriteContent = inferFullFileWriteContent;
 exports.wrapWriteWithFsCas = wrapWriteWithFsCas;
+exports.measureFsAuthorization = measureFsAuthorization;
+exports.measureFsAuthorizationToken = measureFsAuthorizationToken;
 const cas_attestation_js_1 = require("../cas-attestation.js");
 const fs_js_1 = require("./fs.js");
 /** Unambiguous fs target: a non-empty `path` string on tool arguments (Write convention). */
@@ -50,22 +52,30 @@ function inferFullFileWriteContent(args) {
  * Wire the FS adapter when path + full-file contents are both present.
  * Otherwise run the host write unchanged. If the host already returned an
  * ExecuteIfUnchangedOutcome, pass it through (do not wrap again).
+ *
+ * THE TOKEN MUST COME FROM T1. This function used to call createFsVersionToken HERE, inside
+ * executeFactory — after preflight (T1) and after the T2 recheck — and then condition the write on
+ * that self-fetched value. Measured on 12.0.0: with a writer landing between T2 and that read, the
+ * CAS adopted the interfering state as its legitimate starting point and still reported
+ * status:'committed' with enforced:true. It was a real check of a vacuous window — it asked whether
+ * the state had changed since a read a microsecond earlier, which is a question whose answer is
+ * always no and which says nothing about the state the authorization actually examined.
+ *
+ * Now the expected token is supplied by the caller from the T1 measurement. When it is ABSENT we do
+ * NOT fall back to self-fetching, because that is precisely the vacuous claim: the write runs
+ * unwrapped and the guarantee is NON_ATOMIC, which is the honest thing to report and which
+ * requireConditionalWrite will refuse. A weaker guarantee is reportable; a false one is not.
  */
-async function wrapWriteWithFsCas(args, write) {
+async function wrapWriteWithFsCas(args, write, opts) {
     const filePath = inferFsPathFromArgs(args);
     const content = inferFullFileWriteContent(args);
-    if (filePath && content != null) {
-        let expected;
-        try {
-            expected = await (0, fs_js_1.createFsVersionToken)(filePath);
-        }
-        catch {
-            return write();
-        }
+    const expected = opts && typeof opts.expected_token === 'string' ? opts.expected_token : null;
+    if (filePath && content != null && expected !== null) {
         return (0, fs_js_1.writeFileIfUnchanged)({
             path: filePath,
             expected_token: expected,
             content,
+            ...(opts && 'expected_identity' in opts ? { expected_identity: opts.expected_identity ?? null } : {}),
         });
     }
     const raw = await write();
@@ -73,4 +83,32 @@ async function wrapWriteWithFsCas(args, write) {
         return raw;
     return raw;
 }
+/**
+ * The T1 measurement itself — call this in the RUNNER, before preflight, and pass the result to
+ * wrapWriteWithFsCas. Returns null when this call is not an inferable full-file FS write, or when
+ * the path is unsafe / unreadable (a token we could not measure is not a token we may claim).
+ */
+async function measureFsAuthorization(args) {
+    const filePath = inferFsPathFromArgs(args);
+    const content = inferFullFileWriteContent(args);
+    if (!filePath || content == null)
+        return null;
+    try {
+        const target = await (0, fs_js_1.assertSafeCasPath)(filePath);
+        // Identity FIRST, then the token: both must describe the same observation, and taking identity
+        // first means a swap between them makes the token the newer of the two, which the pre-rename
+        // re-check then catches rather than silently accepting.
+        const expected_identity = await (0, fs_js_1.fsObjectIdentity)(target);
+        const expected_token = await (0, fs_js_1.createFsVersionToken)(target);
+        return { expected_token, expected_identity };
+    }
+    catch {
+        return null;
+    }
+}
+/** Convenience: the token half only. */
+async function measureFsAuthorizationToken(args) {
+    const m = await measureFsAuthorization(args);
+    return m ? m.expected_token : null;
+}
 //# sourceMappingURL=fs-default-wire.js.map

package/dist/cjs/cas-adapters/fs-default-wire.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs-default-wire.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,YAAY,CAAC;;AAOb,kDAQC;AAMD,8DAQC;AAOD,gDAsBC;AAxDD,8DAAoE;AAEpE,mCAAqE;AAErE,6FAA6F;AAC7F,SAAgB,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAClF,OAAO,CAAC,CAAC,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,KAA2B;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAA,4BAAoB,EAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,4BAAoB,EAAC;YAC1B,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,QAAQ;YACxB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,IAAI,IAAA,gDAA2B,EAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"fs-default-wire.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs-default-wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,YAAY,CAAC;;AASb,kDAQC;AAMD,8DAQC;AAuCD,gDAoBC;AAOD,wDAeC;AAGD,kEAGC;AApHD,8DAAoE;AAIpE,mCAA0G;AAE1G,6FAA6F;AAC7F,SAAgB,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAAa;IACrD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAClF,OAAO,CAAC,CAAC,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAAa,EACb,KAA2B,EAC3B,IAAuB;IAEvB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9F,IAAI,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO,IAAA,4BAAoB,EAAC;YAC1B,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,QAAQ;YACxB,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,IAAI,IAAA,gDAA2B,EAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAAC,IAAa;IACxD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,QAAQ,CAAC,CAAC;QACjD,+FAA+F;QAC/F,6FAA6F;QAC7F,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,MAAM,IAAA,wBAAgB,EAAC,MAAM,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,MAAM,IAAA,4BAAoB,EAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wCAAwC;AACjC,KAAK,UAAU,2BAA2B,CAAC,IAAa;IAC7D,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC"}

package/dist/cjs/cas-adapters/fs.d.ts

@@ -21,6 +21,46 @@ export declare const FS_VERSION_TOKEN_PREFIX = "fs:v1:";
 export declare const FS_ABSENT_TOKEN: VersionToken;
 /** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
 export declare function fsTokenContentHash(token: VersionToken | null | undefined): string | null;
+/**
+ * Refuse a path this adapter must not treat as a CAS target.
+ *
+ * MEASURED ABSENT before this existed (2026-08-27): `..` was silently resolved and the write landed
+ * outside the intended directory, and a symlinked target was followed by stat/readFile while the
+ * rename replaced the LINK — so the check and the write referred to DIFFERENT objects. That object
+ * mismatch is the other half of the TOCTOU: a path interpreted twice can have a symlink swapped in
+ * between the two interpretations.
+ *
+ * Three refusals, each for a different escape:
+ *   - a literal `..` segment in the caller's own path (traversal, judged BEFORE resolution),
+ *   - a symlinked final component (lstat — the object we would check is not the one we would write).
+ *
+ * The parent directory is CANONICALISED rather than rejected. Requiring realpath(dir) === dir was
+ * written first and measured wrong within the hour: on macOS /var is itself a symlink, so every
+ * path under a normal temp directory was refused. A symlinked ancestor is not the danger — an
+ * ancestor that CHANGES between the check and the write is, and that is closed by the inode/device
+ * identity re-check in writeFileIfUnchanged, not by refusing ordinary filesystems. Resolving the
+ * parent once and building the target from it means both the check and the write name one object.
+ */
+export declare class UnsafeCasPathError extends Error {
+    readonly reason: 'path_traversal' | 'symlink_target';
+    readonly casPath: string;
+    constructor(reason: 'path_traversal' | 'symlink_target', casPath: string);
+}
+export declare function assertSafeCasPath(filePath: string): Promise<string>;
+/** Filesystem identity of the object a token was measured on. Evidence, not a comparison key. */
+export type FsObjectIdentity = {
+    dev: number;
+    ino: number;
+};
+/**
+ * Identity of the object CURRENTLY at a path, read through a FILE DESCRIPTOR.
+ *
+ * Opening once and fstat-ing the handle is what makes this an identity rather than another path
+ * interpretation: the fd names the object, so a symlink swapped in afterwards cannot redirect it.
+ * null when the path does not exist.
+ */
+export declare function fsObjectIdentity(filePath: string): Promise<FsObjectIdentity | null>;
+export declare function identitiesEqual(a: FsObjectIdentity | null | undefined, b: FsObjectIdentity | null | undefined): boolean;
 /**
  * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
  * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
@@ -36,6 +76,13 @@ export type WriteFileIfUnchangedArgs = {
     path: string;
     /** Token measured before the host decided to write (from createFsVersionToken). */
     expected_token: VersionToken;
+    /**
+     * Identity (dev+ino) of the object the AUTHORIZATION examined, from fsObjectIdentity at T1.
+     * Optional, and when omitted no identity claim is made. Supplying it is strictly stronger than
+     * the token alone: an inode swapped in carrying identical bytes and mtime produces an IDENTICAL
+     * token, so content equality cannot see it. null means "absent at T1" (create-if-absent).
+     */
+    expected_identity?: FsObjectIdentity | null;
     /** Full new file contents (utf8 string or Buffer). */
     content: string | Buffer;
 };
@@ -59,6 +106,8 @@ export declare function writeFileIfUnchanged(args: WriteFileIfUnchangedArgs): Pr
     path: string;
     bytes: number;
     written_content_hash: string;
+    checked_identity: FsObjectIdentity | null;
+    committed_identity: FsObjectIdentity | null;
 }>>;
 /**
  * Opt-in PriorContentResolver that reads a file path from tool arguments.

package/dist/cjs/cas-adapters/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,YAA6B,CAAC;AAM5D,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBlF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOnF;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,YAAY,CAAC;IAC7B,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAsDnG;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACrE,GAAG,oBAAoB,CAoBvB;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,YAA6B,CAAC;AAM5D,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACb,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAMzE;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCzE;AAED,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAazF;AAED,wBAAgB,eAAe,CAC7B,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EACtC,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACrC,OAAO,CAGT;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BlF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOnF;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,YAAY,CAAC;IAC7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,kBAAkB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC,CAAC,CAgGF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACrE,GAAG,oBAAoB,CAoBvB;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/cjs/cas-adapters/fs.js

@@ -45,8 +45,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.tokensEqual = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
+exports.tokensEqual = exports.UnsafeCasPathError = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
 exports.fsTokenContentHash = fsTokenContentHash;
+exports.assertSafeCasPath = assertSafeCasPath;
+exports.fsObjectIdentity = fsObjectIdentity;
+exports.identitiesEqual = identitiesEqual;
 exports.createFsVersionToken = createFsVersionToken;
 exports.readVersionedFile = readVersionedFile;
 exports.writeFileIfUnchanged = writeFileIfUnchanged;
@@ -79,15 +82,118 @@ function fsTokenContentHash(token) {
     const hash = rest.slice(colon + 1);
     return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
 }
+/**
+ * Refuse a path this adapter must not treat as a CAS target.
+ *
+ * MEASURED ABSENT before this existed (2026-08-27): `..` was silently resolved and the write landed
+ * outside the intended directory, and a symlinked target was followed by stat/readFile while the
+ * rename replaced the LINK — so the check and the write referred to DIFFERENT objects. That object
+ * mismatch is the other half of the TOCTOU: a path interpreted twice can have a symlink swapped in
+ * between the two interpretations.
+ *
+ * Three refusals, each for a different escape:
+ *   - a literal `..` segment in the caller's own path (traversal, judged BEFORE resolution),
+ *   - a symlinked final component (lstat — the object we would check is not the one we would write).
+ *
+ * The parent directory is CANONICALISED rather than rejected. Requiring realpath(dir) === dir was
+ * written first and measured wrong within the hour: on macOS /var is itself a symlink, so every
+ * path under a normal temp directory was refused. A symlinked ancestor is not the danger — an
+ * ancestor that CHANGES between the check and the write is, and that is closed by the inode/device
+ * identity re-check in writeFileIfUnchanged, not by refusing ordinary filesystems. Resolving the
+ * parent once and building the target from it means both the check and the write name one object.
+ */
+class UnsafeCasPathError extends Error {
+    reason;
+    casPath;
+    constructor(reason, casPath) {
+        super(`unsafe CAS path (${reason}): ${casPath}`);
+        this.name = 'UnsafeCasPathError';
+        this.reason = reason;
+        this.casPath = casPath;
+    }
+}
+exports.UnsafeCasPathError = UnsafeCasPathError;
+async function assertSafeCasPath(filePath) {
+    // 1. Traversal is judged on what the CALLER wrote, not on the resolved form — resolution is
+    //    exactly what makes `sub/../escaped` look innocent.
+    const segments = filePath.split(/[\\/]+/);
+    if (segments.includes('..'))
+        throw new UnsafeCasPathError('path_traversal', filePath);
+    const resolved = path.resolve(filePath);
+    // 2. Canonicalise the PARENT once, then rebuild the target from it, so every later use names the
+    //    same directory object. realpath on the parent only — never on the target itself, because
+    //    that would follow exactly the final-component symlink step 3 exists to refuse.
+    const dir = path.dirname(resolved);
+    let canonicalDir = dir;
+    try {
+        canonicalDir = await node_fs_1.promises.realpath(dir);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code !== 'ENOENT')
+            throw err;
+        // Parent does not exist yet — a create under mkdir -p. Keep the resolved form.
+    }
+    const target = path.join(canonicalDir, path.basename(resolved));
+    // 3. The final component must not be a symlink. lstat does NOT follow; stat would, which is the
+    //    whole bug: stat/readFile measured the TARGET while rename replaced the LINK, so the check
+    //    and the write referred to different objects. ENOENT is fine — create-if-absent is legitimate.
+    try {
+        const lst = await node_fs_1.promises.lstat(target);
+        if (lst.isSymbolicLink())
+            throw new UnsafeCasPathError('symlink_target', filePath);
+    }
+    catch (err) {
+        if (err instanceof UnsafeCasPathError)
+            throw err;
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code !== 'ENOENT')
+            throw err;
+    }
+    return target;
+}
+/**
+ * Identity of the object CURRENTLY at a path, read through a FILE DESCRIPTOR.
+ *
+ * Opening once and fstat-ing the handle is what makes this an identity rather than another path
+ * interpretation: the fd names the object, so a symlink swapped in afterwards cannot redirect it.
+ * null when the path does not exist.
+ */
+async function fsObjectIdentity(filePath) {
+    let fh;
+    try {
+        fh = await node_fs_1.promises.open(filePath, 'r');
+        const st = await fh.stat();
+        return { dev: st.dev, ino: st.ino };
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+        if (code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    finally {
+        if (fh)
+            await fh.close().catch(() => { });
+    }
+}
+function identitiesEqual(a, b) {
+    if (!a || !b)
+        return false;
+    return a.dev === b.dev && a.ino === b.ino;
+}
 /**
  * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
  * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
  * so hosts can CAS create vs create-raced.
  */
 async function createFsVersionToken(filePath) {
-    let st;
+    // ONE open, then stat AND read from the same handle. Previously this was stat(path) followed by
+    // readFile(path) — two interpretations of the same string, so a swap between them produced a
+    // token describing neither object exactly. The fd names the object for both reads.
+    let fh;
     try {
-        st = await node_fs_1.promises.stat(filePath);
+        fh = await node_fs_1.promises.open(filePath, 'r');
     }
     catch (err) {
         const code = err && typeof err === 'object' && 'code' in err
@@ -97,14 +203,20 @@ async function createFsVersionToken(filePath) {
             return exports.FS_ABSENT_TOKEN;
         throw err;
     }
-    if (!st.isFile()) {
-        // Directories / specials are not content CAS targets for this adapter.
-        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    try {
+        const st = await fh.stat();
+        if (!st.isFile()) {
+            // Directories / specials are not content CAS targets for this adapter.
+            throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+        }
+        const buf = await fh.readFile();
+        const hash = sha256hex(buf);
+        const mtimeMs = Math.trunc(st.mtimeMs);
+        return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+    }
+    finally {
+        await fh.close().catch(() => { });
     }
-    const buf = await node_fs_1.promises.readFile(filePath);
-    const hash = sha256hex(buf);
-    const mtimeMs = Math.trunc(st.mtimeMs);
-    return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
 }
 /**
  * Read file content + version token for VersionedContent (host reporting / preflight prior).
@@ -135,9 +247,29 @@ async function readVersionedFile(filePath) {
  * Wired through executeIfUnchanged — not a parallel path.
  */
 async function writeFileIfUnchanged(args) {
-    const target = path.resolve(args.path);
+    // Refuse traversal / symlink / mounted-over-parent BEFORE any token is measured. A CAS over an
+    // object the caller did not name is not a weaker guarantee, it is a wrong one.
+    const target = await assertSafeCasPath(args.path);
     const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
     const writtenHash = sha256hex(body);
+    // Identity of the object the CHECK is about, captured through an fd (null when creating).
+    const checkedIdentity = await fsObjectIdentity(target);
+    // T1 identity claim: if the caller measured one at authorization time, the object must still be
+    // that object BEFORE we do anything. Captured-here identity cannot see a swap that predates this
+    // call, which is exactly the case the token also cannot see.
+    const hasT1Identity = Object.prototype.hasOwnProperty.call(args, 'expected_identity');
+    if (hasT1Identity) {
+        const t1 = args.expected_identity ?? null;
+        const held = t1 === null ? checkedIdentity === null : identitiesEqual(t1, checkedIdentity);
+        if (!held) {
+            return {
+                status: 'refused',
+                reason: 'stale_version_token',
+                expected_token: args.expected_token,
+                current_token: await createFsVersionToken(target).catch(() => null),
+            };
+        }
+    }
     return (0, conditional_write_js_1.executeIfUnchanged)({
         expected_token: args.expected_token,
         current_token: () => createFsVersionToken(target),
@@ -160,7 +292,22 @@ async function writeFileIfUnchanged(args) {
             const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString('hex')}.tmp`);
             try {
                 await node_fs_1.promises.writeFile(tmp, body);
-                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                // Close pre-rename window on BOTH facts. Content equality alone cannot see an object swap:
+                // a symlink or a replaced inode with identical bytes passes a token check and is still a
+                // different object. Identity is checked first because it is the stronger statement.
+                const stillIdentity = await fsObjectIdentity(target);
+                const identityHeld = checkedIdentity === null
+                    ? stillIdentity === null // create-if-absent: nothing may have appeared
+                    : identitiesEqual(checkedIdentity, stillIdentity);
+                if (!identityHeld) {
+                    try {
+                        await node_fs_1.promises.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new conditional_write_js_1.StaleVersionTokenAbort(await createFsVersionToken(target).catch(() => null));
+                }
                 const still = await createFsVersionToken(target);
                 if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
                     try {
@@ -186,7 +333,14 @@ async function writeFileIfUnchanged(args) {
                 }
                 throw err;
             }
-            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+            // Evidence: which OBJECT was checked, not merely which path string.
+            return {
+                path: target,
+                bytes: body.length,
+                written_content_hash: writtenHash,
+                checked_identity: checkedIdentity,
+                committed_identity: await fsObjectIdentity(target),
+            };
         },
     });
 }

package/dist/cjs/cas-adapters/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAOD,oDAmBC;AAMD,8CAOC;AA0BD,oDAwDC;AASD,oEA0BC;AA/LD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AAwLxB,4FA5LP,kCAAW,OA4LO;AArLpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAiCD,8CAmCC;AAYD,4CAaC;AAED,0CAMC;AAOD,oDA2BC;AAMD,8CAOC;AAiCD,oDAwGC;AASD,oEA0BC;AAnWD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AA4VxB,4FAhWP,kCAAW,OAgWO;AAzVpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAsC;IAC5C,OAAO,CAAS;IACzB,YAAY,MAA2C,EAAE,OAAe;QACtE,KAAK,CAAC,oBAAoB,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AATD,gDASC;AAEM,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,4FAA4F;IAC5F,wDAAwD;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,iGAAiG;IACjG,8FAA8F;IAC9F,oFAAoF;IACpF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,YAAY,GAAG,GAAG,CAAC;IACvB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QACjC,+EAA+E;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhE,gGAAgG;IAChG,+FAA+F;IAC/F,mGAAmG;IACnG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,EAA8B,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE;YAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAC7B,CAAsC,EACtC,CAAsC;IAEtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,gGAAgG;IAChG,6FAA6F;IAC7F,mFAAmF;IACnF,IAAI,EAA8B,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,uEAAuE;YACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAQ9B,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,0FAA0F;IAC1F,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvD,gGAAgG;IAChG,iGAAiG;IACjG,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,2FAA2F;gBAC3F,yFAAyF;gBACzF,oFAAoF;gBACpF,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,YAAY,GAAG,eAAe,KAAK,IAAI;oBAC3C,CAAC,CAAC,aAAa,KAAK,IAAI,CAAY,8CAA8C;oBAClF,CAAC,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;gBACpD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oEAAoE;YACpE,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,oBAAoB,EAAE,WAAW;gBACjC,gBAAgB,EAAE,eAAe;gBACjC,kBAAkB,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC;aACnD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/cas-attestation.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ExecutorKeyRegistry } from '@coderifts/sdk';
 import type { GuardExecutionProof, ExecutionResultHash } from './execution-proof.js';
-import type { ExecuteIfUnchangedOutcome, VersionToken } from './conditional-write.js';
+import type { ExecuteIfUnchangedOutcome, IndeterminateReason, VersionToken } from './conditional-write.js';
 /** Machine-readable schema id — mirrors EXECUTION_PROOF_SPEC style. */
 export declare const CAS_ATTESTATION_SPEC: "cas-attestation.v1";
 /**
@@ -51,6 +51,16 @@ export type CasAttestationCas = {
     reason: 'stale_during_commit';
     expected_token: VersionToken;
     post_commit_token: VersionToken | null;
+} | {
+    status: 'indeterminate';
+    /**
+     * 'unknown' is a THIRD value, never a default to false. Collapsing it to false would say the
+     * write did not run, which is a claim we do not have; collapsing it to true would say it did.
+     */
+    write_ran: 'unknown';
+    reason: IndeterminateReason;
+    expected_token: VersionToken;
+    observed_token: VersionToken | null;
 };
 /**
  * Frozen cas-attestation.v1 record.
@@ -79,6 +89,11 @@ export type CasAttestation = {
         stale_during_commit: boolean;
         /** outcome.status === 'refused'. */
         refused: boolean;
+        /**
+         * outcome.status === 'indeterminate'. Downstream MUST block on this: it is not a pass, and it
+         * is not a failure either. Reconciliation is required before anything may proceed.
+         */
+        indeterminate: boolean;
     };
     /**
      * Observation-side CAS evidence class (S2-F2a R3). Never a verdict/preimage field.

package/dist/cjs/cas-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtF,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAClF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AAaF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAgB/F;AAiCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAkDhB"}
+{"version":3,"file":"cas-attestation.d.ts","sourceRoot":"","sources":["../../src/cas-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3G,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,iCAAiC,EAAE,IAAI,CAAC;IACxC,mGAAmG;IACnG,mDAAmD,EAAE,IAAI,CAAC;IAC1D,qGAAqG;IACrG,sCAAsC,EAAE,IAAI,CAAC;IAC7C,4FAA4F;IAC5F,qDAAqD,EAAE,IAAI,CAAC;IAC5D,yFAAyF;IACzF,iCAAiC,EAAE,IAAI,CAAC;IACxC,yFAAyF;IACzF,oCAAoC,EAAE,IAAI,CAAC;CAC5C,CAAC;AAWF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GACzB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,GACD;IACE,MAAM,EAAE,eAAe,CAAC;IACxB;;;OAGG;IACH,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;IAC9C,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,qBAAqB,EAAE,mBAAmB,CAAC;QAC3C,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,GAAG,EAAE,iBAAiB,CAAC;IACvB,OAAO,EAAE;QACP;;;WAGG;QACH,wBAAwB,EAAE,OAAO,CAAC;QAClC,iEAAiE;QACjE,SAAS,EAAE,OAAO,CAAC;QACnB,qDAAqD;QACrD,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oCAAoC;QACpC,OAAO,EAAE,OAAO,CAAC;QACjB;;;WAGG;QACH,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,WAAW,CAAC;IAC1B,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/E,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI,CAAC;IACT,0FAA0F;IAC1F,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,0BAA0B,GAAG,0BAA0B,CAAC;AAClF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CACzD,CAAC;AAaF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,IAAI,GAAE,uBAA4B,GACjC,uBAAuB,CAWzB;AAkBD,qFAAqF;AACrF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY/E;AAiBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,uBAA4B,GACjC,WAAW,CAsDb;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAQ1E;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAuB/F;AA0CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAC3C,IAAI,GAAE,uBAA4B,GACjC,cAAc,CAoDhB"}

package/dist/cjs/cas-attestation.js

@@ -195,6 +195,13 @@ function isExecuteIfUnchangedOutcome(x) {
         const s = x;
         return s.reason === 'stale_during_commit' && typeof s.expected_token === 'string';
     }
+    if (o.status === 'indeterminate') {
+        const i = x;
+        return (i.reason === 'response_lost'
+            || i.reason === 'ambiguous_provider_reply'
+            || i.reason === 'observation_failed')
+            && typeof i.expected_token === 'string';
+    }
     return false;
 }
 function freezeExecutionResultHash(h) {
@@ -217,6 +224,15 @@ function projectCas(outcome) {
             current_token: outcome.current_token == null ? null : outcome.current_token,
         });
     }
+    if (outcome.status === 'indeterminate') {
+        return Object.freeze({
+            status: 'indeterminate',
+            write_ran: 'unknown',
+            reason: outcome.reason,
+            expected_token: outcome.expected_token,
+            observed_token: outcome.observed_token == null ? null : outcome.observed_token,
+        });
+    }
     // committed_stale_detected
     return Object.freeze({
         status: 'committed_stale_detected',
@@ -246,6 +262,7 @@ function buildCasAttestation(proof, outcome, opts = {}) {
     const write_ran = cas.write_ran === true;
     const stale_during_commit = cas.status === 'committed_stale_detected';
     const refused = cas.status === 'refused';
+    const indeterminate = cas.status === 'indeterminate';
     const cas_evidence = evaluateCasEvidence(outcome, opts);
     let authorized_and_committed = receipt_verified && cas.status === 'committed';
     // ENFORCING_STRICT: the existing derived name now requires executor_attested + kernel
@@ -270,6 +287,7 @@ function buildCasAttestation(proof, outcome, opts = {}) {
             write_ran,
             stale_during_commit,
             refused,
+            indeterminate,
         }),
         cas_evidence,
         limits: LIMITS,