@coderifts/agent-guard 13.0.0 → 14.1.0

package/dist/esm/adapters/vercel.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Vercel AI SDK tool adapter over withCodeRifts (roadmap 129 / wave-2 —
+ * same thin pattern as OpenAI / Anthropic / LangGraph / Gemini).
+ *
+ * Thin converter. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → a dependency-free Vercel `tool()` object,
+ *   3. wraps `execute` so the guarded execute runs first, then bindVercelGuardOutcome,
+ *   4. returns those tools PLUS the untouched assurance objects.
+ *
+ * Measured Vercel AI SDK v4 `tool()` (no `ai` package in this repo; types from
+ * https://ai-sdk.dev/v4/docs/reference/ai-sdk-core/tool ):
+ *
+ *   import { tool } from 'ai';
+ *   tool({
+ *     description?: string,
+ *     parameters: Zod Schema | JSON Schema,
+ *     execute?: async (parameters: T, options: ToolExecutionOptions) => RESULT,
+ *   })
+ *   ToolExecutionOptions = { toolCallId: string, messages: CoreMessage[], abortSignal?: AbortSignal }
+ *
+ * generateText / streamText `tools` is a Record keyed by tool name (not an array).
+ * This package does NOT depend on `ai` or `zod`. `parameters` is JSON Schema from
+ * ProtectedTool.inputSchema (v4 accepts JSON Schema; hosts may wrap with `tool()` + Zod).
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned table.
+ *
+ * Honesty (do not "upgrade" assurance): composition_assurance is passed through
+ * EXACTLY as the core reported it.
+ */
+import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { CoverageObservedHandle } from '../coverage-observed.js';
+import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+import type { GuardOutcome } from '../types.js';
+/**
+ * Second argument of Vercel AI SDK v4 `execute` (ToolExecutionOptions).
+ * @see https://ai-sdk.dev/v4/docs/ai-sdk-core/tools-and-tool-calling#tool-execution-options
+ */
+export type VercelToolExecutionOptions = {
+    toolCallId: string;
+    messages?: unknown[];
+    abortSignal?: AbortSignal;
+};
+/**
+ * Dependency-free Vercel `tool()` object (no `ai` import).
+ * Name is the key in the generateText `tools` record, not a field on the object.
+ * @see https://ai-sdk.dev/v4/docs/reference/ai-sdk-core/tool
+ */
+export type VercelTool = {
+    description?: string;
+    /** JSON Schema — v4 `parameters` accepts Zod Schema | JSON Schema. */
+    parameters: Record<string, unknown>;
+    /**
+     * Guarded execute. Return is the Vercel RESULT (generateText puts it in ToolResultPart.result).
+     * Mutators: proof-bound string from bindVercelGuardOutcome (never a nested part, never raw GuardOutcome).
+     * Readonly passthrough may return the raw factory value.
+     */
+    execute: (args: unknown, options?: VercelToolExecutionOptions) => Promise<unknown>;
+};
+/**
+ * Result of withCodeRiftsVercel — Vercel tool record + core assurance, unflattened.
+ *
+ * `tools` is the ONLY bag intended for generateText / streamText. `protected_tools`
+ * is the same guarded list (with execute) for host dispatch — never the raw tools.
+ */
+export type WithCodeRiftsVercelResult = {
+    /** generateText `tools` record — only protected/guarded tools, keyed by name. */
+    tools: Record<string, VercelTool>;
+    /**
+     * Guarded ProtectedTool list from withCodeRifts (same tools as `tools`).
+     * Host may dispatch through these; never raw tools.
+     */
+    protected_tools: ProtectedTool[];
+    /** Untouched registry report — registry's own truth. */
+    registry_report: RegistryCoverageReport;
+    /**
+     * Product-level assurance — deliberately narrower than the registry.
+     * Passed through untouched; may still show inescapable_runtime:false and
+     * residual composition_call_policy_incomplete.
+     */
+    composition_assurance: CompositionAssurance;
+    /** Per-composition receipt cursor — NOT product-truth chain evidence. */
+    receipt_thread: ReceiptThreadHandle;
+    /** Observed coverage for this withCodeRifts run. Half A always; Half B via reportToolDispatch. */
+    coverage_observed: CoverageObservedHandle;
+    repository?: string;
+};
+/**
+ * Map one ProtectedTool → Vercel `tool()` object (description, parameters, execute).
+ * Binds guarded execute; mutator GuardOutcome is mapped through bindVercelGuardOutcome.
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export declare function protectedToolToVercel(tool: ProtectedTool): VercelTool;
+/**
+ * Convert a list of ProtectedTool into a Vercel generateText `tools` record.
+ * Does NOT call the guard — map over an already-protected list.
+ */
+export declare function toVercelTools(protectedTools: readonly ProtectedTool[]): Record<string, VercelTool>;
+/**
+ * Build Vercel-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — generateText record { [name]: { description?, parameters, execute } }
+ *   - `protected_tools` — same guarded tools
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export declare function withCodeRiftsVercel(input: WithCodeRiftsInput): WithCodeRiftsVercelResult;
+/**
+ * Shape adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsVercel when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export declare function vercelToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsVercelResult;
+/**
+ * Minimal Vercel AI SDK v4 tool-result part. No `ai` dependency.
+ * Id field is `toolCallId` (ToolExecutionOptions / ToolResultPart).
+ * @see https://ai-sdk.dev/v4/docs/ai-sdk-core/tools-and-tool-calling
+ */
+export type VercelToolResult = {
+    type: 'tool-result';
+    toolCallId: string;
+    toolName?: string;
+    result: string;
+};
+declare const __proofBoundVercelBrand: unique symbol;
+export type ProofBoundVercelToolResult = VercelToolResult & {
+    readonly __proofBound: typeof __proofBoundVercelBrand;
+};
+export type BindVercelGuardOutcomeArgs<T> = {
+    /** Vercel toolCallId this tool-result answers. */
+    toolCallId: string;
+    /** Optional tool name (ToolResultPart.toolName). */
+    toolName?: string;
+    serialize?: (result: T) => string;
+    /**
+     * Attach the rendered GuardExecutionProof (S4). Default ON.
+     * Pass `false` to opt out.
+     */
+    attachProof?: boolean;
+};
+export declare function defaultSerializeVercelToolResult<T>(result: T): string;
+/**
+ * Map a full GuardOutcome into a Vercel tool-result part with proof embedded.
+ * Same arm mapping as bindOpenAIGuardOutcome; id field is toolCallId.
+ */
+export declare function bindVercelGuardOutcome<T>(outcome: GuardOutcome<T>, args: BindVercelGuardOutcomeArgs<T>): ProofBoundVercelToolResult;
+export {};
+//# sourceMappingURL=vercel.d.ts.map

package/dist/esm/adapters/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAC;AAS9D;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,0BAA0B,KACjC,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,kGAAkG;IAClG,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAoFF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,CAqCrE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,cAAc,EAAE,SAAS,aAAa,EAAE,GACvC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAM5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAexF;AAID;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AACrD,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IAC1D,QAAQ,CAAC,YAAY,EAAE,OAAO,uBAAuB,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBrE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,0BAA0B,CA4B5B"}

package/dist/esm/adapters/vercel.js

@@ -0,0 +1,247 @@
+/**
+ * Vercel AI SDK tool adapter over withCodeRifts (roadmap 129 / wave-2 —
+ * same thin pattern as OpenAI / Anthropic / LangGraph / Gemini).
+ *
+ * Thin converter. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → a dependency-free Vercel `tool()` object,
+ *   3. wraps `execute` so the guarded execute runs first, then bindVercelGuardOutcome,
+ *   4. returns those tools PLUS the untouched assurance objects.
+ *
+ * Measured Vercel AI SDK v4 `tool()` (no `ai` package in this repo; types from
+ * https://ai-sdk.dev/v4/docs/reference/ai-sdk-core/tool ):
+ *
+ *   import { tool } from 'ai';
+ *   tool({
+ *     description?: string,
+ *     parameters: Zod Schema | JSON Schema,
+ *     execute?: async (parameters: T, options: ToolExecutionOptions) => RESULT,
+ *   })
+ *   ToolExecutionOptions = { toolCallId: string, messages: CoreMessage[], abortSignal?: AbortSignal }
+ *
+ * generateText / streamText `tools` is a Record keyed by tool name (not an array).
+ * This package does NOT depend on `ai` or `zod`. `parameters` is JSON Schema from
+ * ProtectedTool.inputSchema (v4 accepts JSON Schema; hosts may wrap with `tool()` + Zod).
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned table.
+ *
+ * Honesty (do not "upgrade" assurance): composition_assurance is passed through
+ * EXACTLY as the core reported it.
+ */
+import { withCodeRifts } from '../with-coderifts.js';
+import { buildExecutionProof } from '../execution-proof.js';
+import { attachProofToAgentResponse } from '../final-answer-proof.js';
+import { formatGateRefusalBody, formatGuardError, verdictKind, } from '../gate-refusal.js';
+/** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
+const EMPTY_PARAMETERS = Object.freeze({
+    type: 'object',
+    properties: {},
+});
+/**
+ * Local GuardOutcome duck-type. Do not import execute-tool-call (that module
+ * imports this binder — a cycle). Same fields as isGuardOutcome.
+ */
+function looksLikeGuardOutcome(x) {
+    if (!x || typeof x !== 'object')
+        return false;
+    const o = x;
+    return (typeof o.executed === 'boolean'
+        && typeof o.executionAttempted === 'boolean'
+        && o.proof != null
+        && typeof o.proof === 'object'
+        && o.verdict != null
+        && typeof o.verdict === 'object');
+}
+function toolCallIdFromOptions(options) {
+    if (options && typeof options.toolCallId === 'string')
+        return options.toolCallId;
+    return '';
+}
+const FRESHNESS_NOT_CONFIGURED = Object.freeze({
+    wiring: 'NOT_CONFIGURED',
+    write_style: false,
+    require_freshness: false,
+});
+const CW_NOT_REPORTED = Object.freeze({
+    conditional_write: 'not_reported',
+    require_conditional_write: false,
+    write_style: false,
+    mutating: false,
+});
+/**
+ * Guarded mutator returned a non-outcome — never forward the raw value to generateText.
+ * Same CONFIG_ERROR / UNAVAILABLE arm as execute-tool-call unknownToolOutcome (no cycle).
+ */
+function guardedNonOutcomeRefusal(toolName) {
+    const verdict = {
+        kind: 'UNAVAILABLE',
+        cause: 'CONFIG_ERROR',
+        failPolicy: 'closed',
+        resolution: 'CLOSED',
+        action: 'STOP',
+        decisionMissing: true,
+        unavailableCount: 1,
+    };
+    const commit_observation = {
+        status: 'not_observed',
+        observed_at: new Date().toISOString(),
+        host_attestation: 'absent',
+    };
+    const proof = buildExecutionProof({
+        preflighted: false,
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        commitObservation: commit_observation,
+    });
+    void toolName;
+    return {
+        executionAttempted: false,
+        executed: false,
+        enforced: false,
+        verdict,
+        preflighted: false,
+        proof,
+        freshness: FRESHNESS_NOT_CONFIGURED,
+        conditional_write: CW_NOT_REPORTED,
+        commit_observation,
+    };
+}
+/**
+ * Map one ProtectedTool → Vercel `tool()` object (description, parameters, execute).
+ * Binds guarded execute; mutator GuardOutcome is mapped through bindVercelGuardOutcome.
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export function protectedToolToVercel(tool) {
+    const parameters = tool.inputSchema != null
+        && typeof tool.inputSchema === 'object'
+        && !Array.isArray(tool.inputSchema)
+        ? tool.inputSchema
+        : { ...EMPTY_PARAMETERS };
+    const execute = async (args, options) => {
+        const raw = await Promise.resolve().then(() => tool.execute(args));
+        const bindArgs = {
+            toolCallId: toolCallIdFromOptions(options),
+            toolName: tool.name,
+        };
+        // generateText treats execute's return as RESULT (the `result` field of a
+        // tool-result part). Return the bound body, not the part — otherwise the
+        // SDK nests { type:'tool-result', result: { type:'tool-result', ... } }.
+        if (looksLikeGuardOutcome(raw)) {
+            return bindVercelGuardOutcome(raw, bindArgs).result;
+        }
+        if (tool._coderifts && tool._coderifts.guarded) {
+            return bindVercelGuardOutcome(guardedNonOutcomeRefusal(tool.name), bindArgs).result;
+        }
+        return raw;
+    };
+    const out = {
+        parameters,
+        execute,
+    };
+    if (tool.description != null && tool.description !== '') {
+        out.description = tool.description;
+    }
+    return out;
+}
+/**
+ * Convert a list of ProtectedTool into a Vercel generateText `tools` record.
+ * Does NOT call the guard — map over an already-protected list.
+ */
+export function toVercelTools(protectedTools) {
+    const out = {};
+    for (const t of protectedTools) {
+        out[t.name] = protectedToolToVercel(t);
+    }
+    return out;
+}
+/**
+ * Build Vercel-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — generateText record { [name]: { description?, parameters, execute } }
+ *   - `protected_tools` — same guarded tools
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export function withCodeRiftsVercel(input) {
+    const core = withCodeRifts(input);
+    return vercelToolAdapter(core);
+}
+/**
+ * Shape adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsVercel when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export function vercelToolAdapter(result) {
+    const protected_tools = result.tools;
+    const tools = toVercelTools(protected_tools);
+    const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+        coverage_observed: result.coverage_observed,
+    };
+    if (result.repository !== undefined) {
+        out.repository = result.repository;
+    }
+    return out;
+}
+export function defaultSerializeVercelToolResult(result) {
+    if (typeof result === 'string')
+        return result;
+    if (typeof result === 'number'
+        || typeof result === 'boolean'
+        || typeof result === 'bigint'
+        || result === null
+        || result === undefined) {
+        return String(result);
+    }
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+/**
+ * Map a full GuardOutcome into a Vercel tool-result part with proof embedded.
+ * Same arm mapping as bindOpenAIGuardOutcome; id field is toolCallId.
+ */
+export function bindVercelGuardOutcome(outcome, args) {
+    const toolCallId = args.toolCallId;
+    const serialize = args.serialize ?? defaultSerializeVercelToolResult;
+    let body;
+    if (outcome.executed === true) {
+        body = serialize(outcome.result);
+    }
+    else if (outcome.executionAttempted === false) {
+        body = formatGateRefusalBody(outcome);
+    }
+    else {
+        const err = 'error' in outcome ? outcome.error : undefined;
+        const kind = verdictKind(outcome);
+        body =
+            `Tool execution failed after gate decision (verdict: ${kind}): ${formatGuardError(err)}`;
+    }
+    const result = args.attachProof === false
+        ? body
+        : attachProofToAgentResponse(body, outcome.proof);
+    const part = {
+        type: 'tool-result',
+        toolCallId,
+        result,
+    };
+    if (args.toolName != null && args.toolName !== '') {
+        part.toolName = args.toolName;
+    }
+    return part;
+}
+//# sourceMappingURL=vercel.js.map

package/dist/esm/adapters/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../../src/adapters/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAUrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,GACZ,MAAM,oBAAoB,CAAC;AA6D5B,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,qBAAqB,CAAC,CAAU;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;WAC5B,OAAO,CAAC,CAAC,kBAAkB,KAAK,SAAS;WACzC,CAAC,CAAC,KAAK,IAAI,IAAI;WACf,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;WAC3B,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAoC;IACjE,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACjF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,gBAAyB;IACjC,WAAW,EAAE,KAAK;IAClB,iBAAiB,EAAE,KAAK;CACzB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,iBAAiB,EAAE,cAAuB;IAC1C,yBAAyB,EAAE,KAAK;IAChC,WAAW,EAAE,KAAK;IAClB,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAiB;QAC5B,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,cAAc;QACrB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,CAAC;KACpB,CAAC;IACF,MAAM,kBAAkB,GAAG;QACzB,MAAM,EAAE,cAAuB;QAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,gBAAgB,EAAE,QAAiB;KACpC,CAAC;IACF,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,kBAAkB,EAAE,KAAK;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO;QACP,iBAAiB,EAAE,kBAAkB;KACtC,CAAC,CAAC;IACH,KAAK,QAAQ,CAAC;IACd,OAAO;QACL,kBAAkB,EAAE,KAAK;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO;QACP,WAAW,EAAE,KAAK;QAClB,KAAK;QACL,SAAS,EAAE,wBAAwB;QACnC,iBAAiB,EAAE,eAAe;QAClC,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAa,EACb,OAAoC,EAClB,EAAE;QACpB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG;YACf,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC;YAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,OAAO,sBAAsB,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,GAAG,GAAe;QACtB,UAAU;QACV,OAAO;KACR,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,cAAwC;IAExC,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAkCD,MAAM,UAAU,gCAAgC,CAAI,MAAS;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,IAAmC;IAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gCAAgC,CAAC;IAErE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,uDAAuD,IAAI,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAC9D,MAAM,IAAI,GAAqB;QAC7B,IAAI,EAAE,aAAa;QACnB,UAAU;QACV,MAAM;KACP,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,IAAkC,CAAC;AAC5C,CAAC"}

package/dist/esm/atomic-profile.d.ts

@@ -0,0 +1,112 @@
+import type { PostureVerifyInput } from './posture-receipt.js';
+export declare const PROFILE_ENFORCING_ATOMIC_V1: "ENFORCING_ATOMIC_V1";
+/**
+ * ENFORCING_ATOMIC_V2 (roadmap 1167) — V1 plus a VERIFIED credential boundary.
+ *
+ * WHY A NEW NAME RATHER THAN A STRICTER _V1. with-coderifts.ts:228 states the
+ * rule this package learned from its own 10.0.0 and 12.0.0 releases: "The next
+ * tightening MUST be `_V2`; adding a condition to `_V1` reintroduces the defect
+ * this type exists to remove." A caller who wrote `_V1` keeps exactly the
+ * contract they asked for; the stricter check costs them nothing.
+ *
+ * WHAT V2's credential_boundary PROVES:
+ *   A signed `cr.posture.receipt.v1` verified against a caller-supplied key
+ *   (registry or pinned PEM) asserts `verdict: 'PASS'` — the credential
+ *   boundary was read back out of the live catalog at `measured_at`, that
+ *   reading is inside the caller's freshness window, and the receipt is bound
+ *   to this `deployment_id`.
+ *
+ * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
+ *   · NOT executor_id, adapter_id, target_uri or policy_hash binding. The
+ *     producer does not sign those fields — measured 2026-08-29 against
+ *     capability-demo demo/src/posture.js:427-435, whose signed body is exactly
+ *     { v, executor_kid, deployment_id, measured_at, verdict, facts, drift }.
+ *     Verifying a field the producer never signed would be the same overclaim
+ *     the audit found, inverted. Deferred to roadmap 1174; until the producer
+ *     signs them, V2 must not imply the receipt binds them.
+ *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
+ *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
+ *     A guard-side default would present our policy as the receipt's statement.
+ *   · NOT executor behaviour. Same honest limit as every other invariant here:
+ *     construction demands wiring, and a read-back at `measured_at` is a fact
+ *     about that moment, not about the write that happens afterwards.
+ */
+export declare const PROFILE_ENFORCING_ATOMIC_V2: "ENFORCING_ATOMIC_V2";
+/**
+ * The unsuffixed wire value stays pinned to V1 FOREVER (with-coderifts.ts:231-233).
+ * Re-pointing it at V2 would silently move every existing caller — the migration
+ * the versioned names exist to refuse.
+ */
+export declare const GUARD_ATOMIC_WIRE_VALUE: "ENFORCING_ATOMIC";
+export type AtomicProfileSpelling = 'ENFORCING_ATOMIC' | 'ENFORCING_ATOMIC_V1' | 'ENFORCING_ATOMIC_V2';
+export declare const ATOMIC_PROFILE_UNSATISFIED: "ATOMIC_PROFILE_UNSATISFIED";
+export type AtomicOutcome = 'AUTHORIZED_COMMITTED' | 'REFUSED' | 'INDETERMINATE';
+/** Frozen invariant names — adding one is ATOMIC_V2, not an edit here. */
+export declare const ATOMIC_INVARIANTS: readonly ["verified_receipt", "verified_grant_v2", "exact_executor", "exact_target", "after_payload_hash", "fresh_nonce", "nonce_consumed_once", "target_CAS", "read_back", "executor_attestation", "credential_boundary"];
+export type MutatorRegister = {
+    registerMutator: (name: string) => MutatorRegister;
+    has: (name: string) => boolean;
+    list: () => readonly string[];
+};
+export declare function createMutatorRegister(): MutatorRegister;
+export declare function isEnforcingAtomic(profile: unknown): profile is AtomicProfileSpelling;
+/** V2 only. The unsuffixed alias is V1 and must never answer true here. */
+export declare function isEnforcingAtomicV2(profile: unknown): boolean;
+export type AtomicConstructionInput = {
+    executionGrant?: {
+        enabled?: boolean;
+        resolveStateNonce?: unknown;
+        grantVersion?: string;
+    } | null;
+    executorId?: string;
+    adapterId?: string;
+    targetUri?: string;
+    executorAttestation?: {
+        registry?: unknown;
+    } | null;
+    mutatorRegister?: MutatorRegister | null;
+    casAdapter?: unknown;
+    readBack?: unknown;
+    credentialBoundary?: unknown;
+    /** V2 ONLY. Ignored on V1, whose credential_boundary check is frozen. */
+    profile?: AtomicProfileSpelling;
+};
+/**
+ * V2 caller-supplied freshness window must be finite, positive, and ≤ 24h.
+ * A larger value is not a freshness check (the receipt has no expires_at).
+ */
+export declare const ATOMIC_V2_MAX_AGE_MS_CAP = 86400000;
+/**
+ * V2 credential_boundary input. A bare `true` is deliberately NOT assignable.
+ */
+export type VerifiedCredentialBoundary = {
+    postureReceipt: string;
+    registry?: PostureVerifyInput['registry'];
+    pinnedKeyPem?: string;
+    deploymentId?: string;
+    maxAgeMs?: number;
+    now?: () => number;
+};
+export declare const CREDENTIAL_BOUNDARY_BARE_REJECTED: string;
+export declare function atomicConstructionProblems(input: AtomicConstructionInput): string[];
+export declare function throwAtomicUnsatisfied(problems: string[]): never;
+/**
+ * Per-call outcome union. Host-claimed commit never AUTHORIZED_COMMITTED.
+ */
+export declare function atomicOutcome(input: {
+    receiptVerified: boolean;
+    grantV2Valid: boolean;
+    executorMatch: boolean;
+    targetMatch: boolean;
+    nonceFresh: boolean;
+    nonceConsumedOnce: boolean;
+    casCommitted: boolean;
+    readBackOk: boolean;
+    executorAttested: boolean;
+    mutatorRegistered: boolean;
+    authUnavailable?: boolean;
+    nonceStoreUnavailable?: boolean;
+    readBackUnavailable?: boolean;
+    signerUnavailableAfterCommit?: boolean;
+}): AtomicOutcome;
+//# sourceMappingURL=atomic-profile.d.ts.map

package/dist/esm/atomic-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-profile.d.ts","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEvG,eAAO,MAAM,0BAA0B,EAAG,4BAAqC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,4NAYnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAkBvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAIpF;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAGlB,CAAC;AAE7B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAuGnF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAOhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,GAAG,aAAa,CAahB"}