@coderifts/agent-guard 14.1.0 → 15.1.0

package/README.md

@@ -340,8 +340,10 @@ message — not only in a human final answer.
 | `bindAnthropicGuardOutcome(outcome, { tool_use_id })` | `tool_use_id` | Anthropic `tool_result` `content` (string) |
 | `bindGeminiGuardOutcome(outcome, { name })` | function `name` | Gemini `functionResponse.response` — a **structured object** `{ result, final_answer_proof, … }` (not a text field) |
 | `bindLangGraphGuardOutcome(outcome, { tool_call_id, name? })` | `tool_call_id` (+ optional `name`) | LangGraph/LangChain ToolMessage `content` (string) |
+| `bindLangChainToolOutcome(outcome, { tool_call_id, name? })` | `tool_call_id` (+ optional `name`) | LangChain **`content_and_artifact`** — `content` (string, to the model) + `artifact` (structured proof, kept OUT of the model's context) |
+| `bindCrewAIToolOutcome(outcome, { tool_name })` | `tool_name` | CrewAI `result` (string) + **`result_as_answer`** — `true` on every arm the guard did not permit |
 
-**Behaviour (all four):** take the full `GuardOutcome` (ALLOW / BLOCK / APPROVAL / SKIPPED / error
+**Behaviour (all six):** take the full `GuardOutcome` (ALLOW / BLOCK / APPROVAL / SKIPPED / error
 arms); **auto-attach** `outcome.proof` by default (S4; `{ attachProof: false }` opts out); on a
 blocked arm state that the gate did not permit execution with **no fabricated tool result**; on
 factory-error arms report the failure + proof. Pure and non-mutating. No framework SDK dependency

package/dist/cjs/adapters/crewai.d.ts

@@ -0,0 +1,88 @@
+/**
+ * CrewAI tool-result proof binder (I-1272).
+ *
+ * MEASURED SHAPE. CrewAI tools are Python (`crewai_tools.BaseTool`), and a tool's
+ * `_run` return value is placed into the agent's context as the tool's observation.
+ * The one structural control CrewAI gives a tool over that observation is
+ * `result_as_answer`:
+ *
+ *   class MyTool(BaseTool):
+ *       name: str = "..."
+ *       result_as_answer: bool = True   # this tool's output IS the agent's final answer
+ *
+ * With `result_as_answer=True` the agent does not keep reasoning around the output —
+ * it is returned as the answer.
+ *
+ * SOURCES (docs, no package imported — this repo is TypeScript and CrewAI is Python;
+ * the host serialises this object into its tool's return, exactly as with every other
+ * adapter here, which never import their framework either):
+ *   - CrewAI "Create your own tools" / `BaseTool` — `_run` return, `result_as_answer`.
+ *     https://docs.crewai.com/concepts/tools
+ *   - CrewAI "Agents" — tool output handling and final-answer forcing.
+ *     https://docs.crewai.com/concepts/agents
+ *
+ * WHY THAT FLAG IS THE MAPPING THAT MATTERS. A gate refusal is not an observation to
+ * reason around; it is the end of that path. Setting `result_as_answer: true` on the
+ * blocked arm is the CrewAI-native way of saying so, and it is the same statement the
+ * other binders make by refusing to fabricate a result. An executed result is an
+ * ordinary observation, so the flag is false there — the agent goes on working.
+ *
+ * INVARIANTS, identical to the four shipped binders:
+ *   - PURE and non-mutating; no CrewAI dependency (a plain JSON-serialisable object).
+ *   - Type-level ProofBound brand.
+ *   - The blocked arm carries NO fabricated tool result — only the gate's own message.
+ *   - `result` is byte-identical to what attachProofToAgentResponse produces for the
+ *     same outcome, so this binder cannot drift from the others (asserted in tests).
+ */
+import type { GuardOutcome } from '../types.js';
+import type { GuardExecutionProof } from '../execution-proof.js';
+/**
+ * Minimal CrewAI tool result (no crewai dependency).
+ *
+ * Host wiring (Python side receives this as JSON):
+ *   bound = bindCrewAIToolOutcome(outcome, { tool_name: 'apply_openapi' });
+ *   # tool._run returns bound["result"]; the tool declares
+ *   # result_as_answer = bound["result_as_answer"]
+ */
+export type CrewAIToolResult = {
+    /** The observation string CrewAI places in the agent's context. */
+    result: string;
+    /**
+     * True when this output IS the agent's final answer and must not be reasoned
+     * around — every arm where the guard did not permit execution.
+     */
+    result_as_answer: boolean;
+    /** The tool this result answers for. */
+    tool_name: string;
+    /**
+     * Structured proof, alongside the string. CrewAI itself only reads `result`;
+     * this rides for the host's audit path and is never required by the framework.
+     */
+    final_answer_proof: GuardExecutionProof;
+};
+declare const __proofBoundCrewAIBrand: unique symbol;
+export type ProofBoundCrewAIToolResult = CrewAIToolResult & {
+    readonly __proofBound: typeof __proofBoundCrewAIBrand;
+};
+export type BindCrewAIToolOutcomeArgs<T> = {
+    /** CrewAI tool name this result answers for. */
+    tool_name: string;
+    serialize?: (result: T) => string;
+    /**
+     * Append the rendered GuardExecutionProof to `result` (S4). Default ON.
+     * The structured `final_answer_proof` field is present either way.
+     */
+    attachProof?: boolean;
+};
+export declare function defaultSerializeCrewAIToolResult<T>(result: T): string;
+/**
+ * Map a full GuardOutcome into a CrewAI tool result.
+ *
+ * Arm mapping is the shipped one (same as bindOpenAIGuardOutcome):
+ *   executed          → serialized result, result_as_answer: false
+ *   gate refusal      → formatGateRefusalBody, result_as_answer: TRUE, no fabricated result
+ *   factory error     → the failure named with its verdict, result_as_answer: TRUE
+ */
+export declare function bindCrewAIToolOutcome<T>(outcome: GuardOutcome<T>, args: BindCrewAIToolOutcomeArgs<T>): ProofBoundCrewAIToolResult;
+export {};
+//# sourceMappingURL=crewai.d.ts.map

package/dist/cjs/adapters/crewai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crewai.d.ts","sourceRoot":"","sources":["../../../src/adapters/crewai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAQjE;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,kBAAkB,EAAE,mBAAmB,CAAC;CACzC,CAAC;AAEF,OAAO,CAAC,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;AACrD,MAAM,MAAM,0BAA0B,GAAG,gBAAgB,GAAG;IAC1D,QAAQ,CAAC,YAAY,EAAE,OAAO,uBAAuB,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IACzC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,GACjC,0BAA0B,CA+B5B"}

package/dist/cjs/adapters/crewai.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * CrewAI tool-result proof binder (I-1272).
+ *
+ * MEASURED SHAPE. CrewAI tools are Python (`crewai_tools.BaseTool`), and a tool's
+ * `_run` return value is placed into the agent's context as the tool's observation.
+ * The one structural control CrewAI gives a tool over that observation is
+ * `result_as_answer`:
+ *
+ *   class MyTool(BaseTool):
+ *       name: str = "..."
+ *       result_as_answer: bool = True   # this tool's output IS the agent's final answer
+ *
+ * With `result_as_answer=True` the agent does not keep reasoning around the output —
+ * it is returned as the answer.
+ *
+ * SOURCES (docs, no package imported — this repo is TypeScript and CrewAI is Python;
+ * the host serialises this object into its tool's return, exactly as with every other
+ * adapter here, which never import their framework either):
+ *   - CrewAI "Create your own tools" / `BaseTool` — `_run` return, `result_as_answer`.
+ *     https://docs.crewai.com/concepts/tools
+ *   - CrewAI "Agents" — tool output handling and final-answer forcing.
+ *     https://docs.crewai.com/concepts/agents
+ *
+ * WHY THAT FLAG IS THE MAPPING THAT MATTERS. A gate refusal is not an observation to
+ * reason around; it is the end of that path. Setting `result_as_answer: true` on the
+ * blocked arm is the CrewAI-native way of saying so, and it is the same statement the
+ * other binders make by refusing to fabricate a result. An executed result is an
+ * ordinary observation, so the flag is false there — the agent goes on working.
+ *
+ * INVARIANTS, identical to the four shipped binders:
+ *   - PURE and non-mutating; no CrewAI dependency (a plain JSON-serialisable object).
+ *   - Type-level ProofBound brand.
+ *   - The blocked arm carries NO fabricated tool result — only the gate's own message.
+ *   - `result` is byte-identical to what attachProofToAgentResponse produces for the
+ *     same outcome, so this binder cannot drift from the others (asserted in tests).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultSerializeCrewAIToolResult = defaultSerializeCrewAIToolResult;
+exports.bindCrewAIToolOutcome = bindCrewAIToolOutcome;
+const final_answer_proof_js_1 = require("../final-answer-proof.js");
+const gate_refusal_js_1 = require("../gate-refusal.js");
+function defaultSerializeCrewAIToolResult(result) {
+    if (typeof result === 'string')
+        return result;
+    if (typeof result === 'number'
+        || typeof result === 'boolean'
+        || typeof result === 'bigint'
+        || result === null
+        || result === undefined) {
+        return String(result);
+    }
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+/**
+ * Map a full GuardOutcome into a CrewAI tool result.
+ *
+ * Arm mapping is the shipped one (same as bindOpenAIGuardOutcome):
+ *   executed          → serialized result, result_as_answer: false
+ *   gate refusal      → formatGateRefusalBody, result_as_answer: TRUE, no fabricated result
+ *   factory error     → the failure named with its verdict, result_as_answer: TRUE
+ */
+function bindCrewAIToolOutcome(outcome, args) {
+    const serialize = args.serialize ?? defaultSerializeCrewAIToolResult;
+    let body;
+    let resultAsAnswer;
+    if (outcome.executed === true) {
+        body = serialize(outcome.result);
+        resultAsAnswer = false;
+    }
+    else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+        // The gate said no. There is nothing for the agent to reason around.
+        resultAsAnswer = true;
+    }
+    else {
+        const err = 'error' in outcome ? outcome.error : undefined;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+        // The factory ran and threw: the agent must not invent a success from a failure.
+        resultAsAnswer = true;
+    }
+    const result = args.attachProof === false
+        ? body
+        : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+    const out = {
+        result,
+        result_as_answer: resultAsAnswer,
+        tool_name: args.tool_name,
+        final_answer_proof: outcome.proof,
+    };
+    return out;
+}
+//# sourceMappingURL=crewai.js.map

package/dist/cjs/adapters/crewai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crewai.js","sourceRoot":"","sources":["../../../src/adapters/crewai.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;AAoDH,4EAgBC;AAUD,sDAkCC;AA5GD,oEAAsE;AACtE,wDAI4B;AA2C5B,SAAgB,gCAAgC,CAAI,MAAS;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,OAAwB,EACxB,IAAkC;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gCAAgC,CAAC;IAErE,IAAI,IAAY,CAAC;IACjB,IAAI,cAAuB,CAAC;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,GAAG,IAAA,uCAAqB,EAAC,OAAO,CAAC,CAAC;QACtC,qEAAqE;QACrE,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,uDAAuD,IAAI,MAAM,IAAA,kCAAgB,EAAC,GAAG,CAAC,EAAE,CAAC;QAChG,iFAAiF;QACjF,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAA,kDAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAE9D,MAAM,GAAG,GAAqB;QAC5B,MAAM;QACN,gBAAgB,EAAE,cAAc;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,kBAAkB,EAAE,OAAO,CAAC,KAAK;KAClC,CAAC;IACF,OAAO,GAAiC,CAAC;AAC3C,CAAC"}

package/dist/cjs/adapters/langchain.d.ts

@@ -0,0 +1,93 @@
+/**
+ * LangChain `content_and_artifact` proof binder (I-1272).
+ *
+ * WHY THIS IS NOT bindLangGraphGuardOutcome. That binder answers a ToolMessage:
+ * everything it carries — refusal body AND rendered proof — is a string that lands
+ * in the model's context. LangChain has a second, documented return contract for
+ * exactly the case where part of a tool's output should NOT reach the model:
+ *
+ *   const t = tool(fn, { name, schema, responseFormat: 'content_and_artifact' });
+ *   // fn returns the tuple [content, artifact]
+ *   // → ToolMessage { content, artifact }: `content` goes to the model,
+ *   //   `artifact` is preserved on the message and stays out of the prompt.
+ *
+ * MEASURED SOURCES (docs + types, no package imported):
+ *   - LangChain JS "How to return artifacts from a tool" — `responseFormat:
+ *     "content_and_artifact"`, tool returns `[content, artifact]`.
+ *     https://js.langchain.com/docs/how_to/tool_artifacts/
+ *   - `ToolMessage` fields `content` / `artifact` / `tool_call_id` / `name`
+ *     (@langchain/core `messages/tool`).
+ *     https://js.langchain.com/docs/concepts/messages/
+ *
+ * A GuardExecutionProof is precisely an artifact: a downstream auditor wants every
+ * field of it, and a model wants none of them. Putting the structured proof in
+ * `artifact` keeps it verifiable without spending context on it.
+ *
+ * INVARIANTS, identical to the four shipped binders:
+ *   - PURE and non-mutating; no @langchain/* dependency (minimal local types only).
+ *   - Type-level ProofBound brand, so the compiler can tell a bound result from a raw one.
+ *   - The blocked arm carries NO fabricated tool result — only the gate's own message.
+ *   - `content` is byte-identical to what attachProofToAgentResponse produces for the
+ *     same outcome, so this binder cannot drift from the others (asserted in tests).
+ */
+import type { GuardOutcome } from '../types.js';
+import type { GuardExecutionProof } from '../execution-proof.js';
+/**
+ * Minimal LangChain content-and-artifact tool output (no @langchain/* dependency).
+ *
+ * Host wiring:
+ *   const bound = bindLangChainToolOutcome(outcome, { tool_call_id });
+ *   return [bound.content, bound.artifact];        // inside a content_and_artifact tool
+ *   // or: new ToolMessage({ ...bound })
+ */
+export type LangChainToolOutput = {
+    /** Goes to the model. */
+    content: string;
+    /** Preserved on the ToolMessage, kept OUT of the model's context. */
+    artifact: LangChainToolArtifact;
+    tool_call_id: string;
+    name?: string;
+};
+/** What rides in `artifact`. Structured on purpose — an auditor reads this, not a model. */
+export type LangChainToolArtifact = {
+    /** Guard-defined provenance marker, same idiom as proof_spec / view_spec. */
+    artifact_spec: 'coderifts-guard-artifact.v1';
+    /** The full proof object, untouched. */
+    final_answer_proof: GuardExecutionProof;
+    /** Whether the guarded factory ran. Mirrors outcome.executed; never re-derived. */
+    executed: boolean;
+    /** Whether this run was enforcing. Mirrors outcome.enforced. */
+    enforced: boolean;
+    /** Verdict kind (ALLOW / MONITOR / BLOCK / APPROVAL / SKIPPED / UNAVAILABLE). */
+    verdict: string;
+};
+declare const __proofBoundLangChainBrand: unique symbol;
+export type ProofBoundLangChainToolOutput = LangChainToolOutput & {
+    readonly __proofBound: typeof __proofBoundLangChainBrand;
+};
+export type BindLangChainToolOutcomeArgs<T> = {
+    /** The tool_call_id this output answers. */
+    tool_call_id: string;
+    /** Optional tool name (ToolMessage.name). */
+    name?: string;
+    serialize?: (result: T) => string;
+    /**
+     * Append the RENDERED proof text to `content` (S4). Default ON, matching every
+     * other binder. `false` leaves `content` as the bare body — the artifact still
+     * carries the structured proof, which is the reason to opt out.
+     */
+    attachProof?: boolean;
+};
+export declare function defaultSerializeLangChainToolResult<T>(result: T): string;
+export declare const LANGCHAIN_ARTIFACT_SPEC: "coderifts-guard-artifact.v1";
+/**
+ * Map a full GuardOutcome into a LangChain content_and_artifact tool output.
+ *
+ * Arm mapping is the shipped one (same as bindOpenAIGuardOutcome):
+ *   executed          → serialized result
+ *   gate refusal      → formatGateRefusalBody, NO fabricated result
+ *   factory error     → the failure, named, with the verdict that preceded it
+ */
+export declare function bindLangChainToolOutcome<T>(outcome: GuardOutcome<T>, args: BindLangChainToolOutcomeArgs<T>): ProofBoundLangChainToolOutput;
+export {};
+//# sourceMappingURL=langchain.d.ts.map

package/dist/cjs/adapters/langchain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.d.ts","sourceRoot":"","sources":["../../../src/adapters/langchain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAQjE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,QAAQ,EAAE,qBAAqB,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,qBAAqB,GAAG;IAClC,6EAA6E;IAC7E,aAAa,EAAE,6BAA6B,CAAC;IAC7C,wCAAwC;IACxC,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,OAAO,CAAC,MAAM,0BAA0B,EAAE,OAAO,MAAM,CAAC;AACxD,MAAM,MAAM,6BAA6B,GAAG,mBAAmB,GAAG;IAChE,QAAQ,CAAC,YAAY,EAAE,OAAO,0BAA0B,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,4BAA4B,CAAC,CAAC,IAAI;IAC5C,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,mCAAmC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBxE;AAED,eAAO,MAAM,uBAAuB,EAAG,6BAAsC,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EACxC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACpC,6BAA6B,CAiC/B"}

package/dist/cjs/adapters/langchain.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * LangChain `content_and_artifact` proof binder (I-1272).
+ *
+ * WHY THIS IS NOT bindLangGraphGuardOutcome. That binder answers a ToolMessage:
+ * everything it carries — refusal body AND rendered proof — is a string that lands
+ * in the model's context. LangChain has a second, documented return contract for
+ * exactly the case where part of a tool's output should NOT reach the model:
+ *
+ *   const t = tool(fn, { name, schema, responseFormat: 'content_and_artifact' });
+ *   // fn returns the tuple [content, artifact]
+ *   // → ToolMessage { content, artifact }: `content` goes to the model,
+ *   //   `artifact` is preserved on the message and stays out of the prompt.
+ *
+ * MEASURED SOURCES (docs + types, no package imported):
+ *   - LangChain JS "How to return artifacts from a tool" — `responseFormat:
+ *     "content_and_artifact"`, tool returns `[content, artifact]`.
+ *     https://js.langchain.com/docs/how_to/tool_artifacts/
+ *   - `ToolMessage` fields `content` / `artifact` / `tool_call_id` / `name`
+ *     (@langchain/core `messages/tool`).
+ *     https://js.langchain.com/docs/concepts/messages/
+ *
+ * A GuardExecutionProof is precisely an artifact: a downstream auditor wants every
+ * field of it, and a model wants none of them. Putting the structured proof in
+ * `artifact` keeps it verifiable without spending context on it.
+ *
+ * INVARIANTS, identical to the four shipped binders:
+ *   - PURE and non-mutating; no @langchain/* dependency (minimal local types only).
+ *   - Type-level ProofBound brand, so the compiler can tell a bound result from a raw one.
+ *   - The blocked arm carries NO fabricated tool result — only the gate's own message.
+ *   - `content` is byte-identical to what attachProofToAgentResponse produces for the
+ *     same outcome, so this binder cannot drift from the others (asserted in tests).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LANGCHAIN_ARTIFACT_SPEC = void 0;
+exports.defaultSerializeLangChainToolResult = defaultSerializeLangChainToolResult;
+exports.bindLangChainToolOutcome = bindLangChainToolOutcome;
+const final_answer_proof_js_1 = require("../final-answer-proof.js");
+const gate_refusal_js_1 = require("../gate-refusal.js");
+function defaultSerializeLangChainToolResult(result) {
+    if (typeof result === 'string')
+        return result;
+    if (typeof result === 'number'
+        || typeof result === 'boolean'
+        || typeof result === 'bigint'
+        || result === null
+        || result === undefined) {
+        return String(result);
+    }
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+exports.LANGCHAIN_ARTIFACT_SPEC = 'coderifts-guard-artifact.v1';
+/**
+ * Map a full GuardOutcome into a LangChain content_and_artifact tool output.
+ *
+ * Arm mapping is the shipped one (same as bindOpenAIGuardOutcome):
+ *   executed          → serialized result
+ *   gate refusal      → formatGateRefusalBody, NO fabricated result
+ *   factory error     → the failure, named, with the verdict that preceded it
+ */
+function bindLangChainToolOutcome(outcome, args) {
+    const serialize = args.serialize ?? defaultSerializeLangChainToolResult;
+    let body;
+    if (outcome.executed === true) {
+        body = serialize(outcome.result);
+    }
+    else if (outcome.executionAttempted === false) {
+        body = (0, gate_refusal_js_1.formatGateRefusalBody)(outcome);
+    }
+    else {
+        const err = 'error' in outcome ? outcome.error : undefined;
+        const kind = (0, gate_refusal_js_1.verdictKind)(outcome);
+        body = `Tool execution failed after gate decision (verdict: ${kind}): ${(0, gate_refusal_js_1.formatGuardError)(err)}`;
+    }
+    const content = args.attachProof === false
+        ? body
+        : (0, final_answer_proof_js_1.attachProofToAgentResponse)(body, outcome.proof);
+    const out = {
+        content,
+        artifact: {
+            artifact_spec: exports.LANGCHAIN_ARTIFACT_SPEC,
+            final_answer_proof: outcome.proof,
+            executed: outcome.executed === true,
+            enforced: outcome.enforced === true,
+            verdict: (0, gate_refusal_js_1.verdictKind)(outcome),
+        },
+        tool_call_id: args.tool_call_id,
+    };
+    if (args.name != null && args.name !== '') {
+        out.name = args.name;
+    }
+    return out;
+}
+//# sourceMappingURL=langchain.js.map

package/dist/cjs/adapters/langchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.js","sourceRoot":"","sources":["../../../src/adapters/langchain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AA6DH,kFAgBC;AAYD,4DAoCC;AAzHD,oEAAsE;AACtE,wDAI4B;AAoD5B,SAAgB,mCAAmC,CAAI,MAAS;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAEY,QAAA,uBAAuB,GAAG,6BAAsC,CAAC;AAE9E;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,OAAwB,EACxB,IAAqC;IAErC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAExE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,IAAI,GAAG,IAAA,uCAAqB,EAAC,OAAO,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC;QAClC,IAAI,GAAG,uDAAuD,IAAI,MAAM,IAAA,kCAAgB,EAAC,GAAG,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,KAAK,KAAK;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAA,kDAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAE9D,MAAM,GAAG,GAAwB;QAC/B,OAAO;QACP,QAAQ,EAAE;YACR,aAAa,EAAE,+BAAuB;YACtC,kBAAkB,EAAE,OAAO,CAAC,KAAK;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI;YACnC,OAAO,EAAE,IAAA,6BAAW,EAAC,OAAO,CAAC;SAC9B;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,GAAoC,CAAC;AAC9C,CAAC"}

package/dist/cjs/atomic-profile.d.ts

@@ -17,13 +17,15 @@ export declare const PROFILE_ENFORCING_ATOMIC_V1: "ENFORCING_ATOMIC_V1";
  *   to this `deployment_id`.
  *
  * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
- *   · NOT executor_id, adapter_id, target_uri or policy_hash binding. The
- *     producer does not sign those fields — measured 2026-08-29 against
- *     capability-demo demo/src/posture.js:427-435, whose signed body is exactly
- *     { v, executor_kid, deployment_id, measured_at, verdict, facts, drift }.
- *     Verifying a field the producer never signed would be the same overclaim
- *     the audit found, inverted. Deferred to roadmap 1174; until the producer
- *     signs them, V2 must not imply the receipt binds them.
+ *   · NOT a tuple the CALLER did not name. executor_id, adapter_id, target_uri
+ *     and policy_hash ARE now bound (AUDIT P1 / RES-3) — but each only when the
+ *     construction configures it. The earlier text here said the producer does
+ *     not sign those fields; re-measured 2026-08-29 against capability-demo
+ *     demo/src/posture.js, the issuer spreads them into the SIGNED canonical
+ *     body whenever they carry real content, so binding them is backed by the
+ *     producer rather than asserted over it. What has NOT changed is the rule
+ *     underneath: a field nobody configured is reported in the verifier's
+ *     `not_bound` list, never defaulted into looking checked.
  *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
  *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
  *     A guard-side default would present our policy as the receipt's statement.
@@ -61,6 +63,13 @@ export type AtomicConstructionInput = {
     executorId?: string;
     adapterId?: string;
     targetUri?: string;
+    /**
+     * MEASURED: executorId/adapterId/targetUri already existed here; policyHash
+     * did not exist anywhere in this package — its only mention was the comment
+     * above saying it was not bound. Added so the tuple can be STATED, not so it
+     * can be assumed: leaving it unset binds nothing, and says so.
+     */
+    policyHash?: string;
     executorAttestation?: {
         registry?: unknown;
     } | null;

package/dist/cjs/atomic-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-profile.d.ts","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEvG,eAAO,MAAM,0BAA0B,EAAG,4BAAqC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,4NAYnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAkBvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAIpF;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAGlB,CAAC;AAE7B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAuGnF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAOhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,GAAG,aAAa,CAahB"}
+{"version":3,"file":"atomic-profile.d.ts","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,2BAA2B,EAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEvG,eAAO,MAAM,0BAA0B,EAAG,4BAAqC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,sBAAsB,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,4NAYnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAkBvD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAIpF;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACpD,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,WAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,iCAAiC,QAGlB,CAAC;AAE7B,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,EAAE,CAgHnF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAOhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC,GAAG,aAAa,CAahB"}

package/dist/cjs/atomic-profile.js

@@ -34,13 +34,15 @@ exports.PROFILE_ENFORCING_ATOMIC_V1 = 'ENFORCING_ATOMIC_V1';
  *   to this `deployment_id`.
  *
  * WHAT IT DOES NOT PROVE, and this list is the point rather than a caveat:
- *   · NOT executor_id, adapter_id, target_uri or policy_hash binding. The
- *     producer does not sign those fields — measured 2026-08-29 against
- *     capability-demo demo/src/posture.js:427-435, whose signed body is exactly
- *     { v, executor_kid, deployment_id, measured_at, verdict, facts, drift }.
- *     Verifying a field the producer never signed would be the same overclaim
- *     the audit found, inverted. Deferred to roadmap 1174; until the producer
- *     signs them, V2 must not imply the receipt binds them.
+ *   · NOT a tuple the CALLER did not name. executor_id, adapter_id, target_uri
+ *     and policy_hash ARE now bound (AUDIT P1 / RES-3) — but each only when the
+ *     construction configures it. The earlier text here said the producer does
+ *     not sign those fields; re-measured 2026-08-29 against capability-demo
+ *     demo/src/posture.js, the issuer spreads them into the SIGNED canonical
+ *     body whenever they carry real content, so binding them is backed by the
+ *     producer rather than asserted over it. What has NOT changed is the rule
+ *     underneath: a field nobody configured is reported in the verifier's
+ *     `not_bound` list, never defaulted into looking checked.
  *   · NOT an expiry. The receipt carries `measured_at` and no `expires_at`, so
  *     the age check is a FRESHNESS window the CALLER supplies via `maxAgeMs`.
  *     A guard-side default would present our policy as the receipt's statement.
@@ -178,10 +180,19 @@ function atomicConstructionProblems(input) {
             // V2 calls the verifier only with both mandatory args present — a call with neither
             // is itself a construction problem (the verifier stays permissive when invoked directly).
             if (deploymentId.length > 0 && maxAgeOk) {
+                // The credential-boundary tuple, from the construction input rather than
+                // from anywhere this function could invent it. Each is passed ONLY when
+                // configured: an absent one reaches the verifier as undefined and comes
+                // back named in `not_bound` — the honest record of a boundary this
+                // deployment never stated.
                 const r = (0, posture_receipt_js_1.verifyPostureReceipt)(cb.postureReceipt, {
                     registry: cb.registry,
                     pinnedKeyPem: cb.pinnedKeyPem,
                     expectedDeploymentId: deploymentId,
+                    expectedExecutorId: input.executorId,
+                    expectedAdapterId: input.adapterId,
+                    expectedTargetUri: input.targetUri,
+                    expectedPolicyHash: input.policyHash,
                     maxAgeMs,
                     now: cb.now,
                 });

package/dist/cjs/atomic-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":";;;AA+EA,sDAkBC;AAED,8CAIC;AAGD,kDAEC;AAuCD,gEAuGC;AAED,wDAOC;AAKD,sCA4BC;AApSD;;;;;;;GAOG;AACH,6DAA4D;AAG/C,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACU,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,kBAA2B,CAAC;AAGtD,QAAA,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC7D,QAAA,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,SAAgB,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB;WAChC,OAAO,KAAK,mCAA2B;WACvC,OAAO,KAAK,mCAA2B,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,KAAK,mCAA2B,CAAC;AACjD,CAAC;AAgBD;;;GAGG;AACU,QAAA,wBAAwB,GAAG,UAAU,CAAC;AActC,QAAA,iCAAiC,GAC5C,4FAA4F;MAC1F,2FAA2F;MAC3F,wBAAwB,CAAC;AAE7B,SAAgB,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAA4E,CAAC;QAC9F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,yCAAiC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,2FAA2F;kBACzF,oFAAoF,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;sBAC1F,uDAAuD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ;mBACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBACzB,QAAQ,GAAG,CAAC;mBACZ,QAAQ,IAAI,gCAAwB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CACX,wFAAwF;sBACtF,sFAAsF,CACzF,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,GAAG,gCAAwB,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,gEAAgE,gCAAwB,KAAK;sBAC3F,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,oFAAoF;YACpF,0FAA0F;YAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,IAAA,yCAAoB,EAAC,EAAE,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,oBAAoB,EAAE,YAAY;oBAClC,QAAQ;oBACR,GAAG,EAAE,EAAE,CAAC,GAAG;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CACX,uDAAuD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;0BAC/E,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;4BAC7B,CAAC,CAAC,iFAAiF;kCAC/E,oEAAoE;4BACxE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc;gCAC3B,CAAC,CAAC,mFAAmF;sCACjF,gDAAgD;gCACpD,CAAC,CAAC,0EAA0E;sCACxE,mCAAmC,CAAC,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,kCAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,kCAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"atomic-profile.js","sourceRoot":"","sources":["../../src/atomic-profile.ts"],"names":[],"mappings":";;;AAiFA,sDAkBC;AAED,8CAIC;AAGD,kDAEC;AA8CD,gEAgHC;AAED,wDAOC;AAKD,sCA4BC;AAtTD;;;;;;;GAOG;AACH,6DAA4D;AAG/C,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACU,QAAA,2BAA2B,GAAG,qBAA8B,CAAC;AAE1E;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,kBAA2B,CAAC;AAGtD,QAAA,0BAA0B,GAAG,4BAAqC,CAAC;AAIhF,0EAA0E;AAC7D,QAAA,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,WAAW;IACX,sBAAsB;IACtB,qBAAqB;CACb,CAAC,CAAC;AAQZ,SAAgB,qBAAqB;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAoB;QAC3B,eAAe,CAAC,IAAY;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,KAAK,kBAAkB;WAChC,OAAO,KAAK,mCAA2B;WACvC,OAAO,KAAK,mCAA2B,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO,OAAO,KAAK,mCAA2B,CAAC;AACjD,CAAC;AAuBD;;;GAGG;AACU,QAAA,wBAAwB,GAAG,UAAU,CAAC;AActC,QAAA,iCAAiC,GAC5C,4FAA4F;MAC1F,2FAA2F;MAC3F,wBAAwB,CAAC;AAE7B,SAAgB,0BAA0B,CAAC,KAA8B;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,EAAE,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,CAAC,eAAe,KAAK,UAAU;WAClF,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACtF,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,kBAA4E,CAAC;QAC9F,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,yCAAiC,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,2FAA2F;kBACzF,oFAAoF,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;sBAC1F,uDAAuD,CAC1D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,QAAQ,KAAK,QAAQ;mBACxC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBACzB,QAAQ,GAAG,CAAC;mBACZ,QAAQ,IAAI,gCAAwB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAChF,QAAQ,CAAC,IAAI,CACX,wFAAwF;sBACtF,sFAAsF,CACzF,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,GAAG,gCAAwB,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CACX,gEAAgE,gCAAwB,KAAK;sBAC3F,sDAAsD,CACzD,CAAC;YACJ,CAAC;YACD,oFAAoF;YACpF,0FAA0F;YAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACxC,yEAAyE;gBACzE,wEAAwE;gBACxE,wEAAwE;gBACxE,mEAAmE;gBACnE,2BAA2B;gBAC3B,MAAM,CAAC,GAAG,IAAA,yCAAoB,EAAC,EAAE,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,oBAAoB,EAAE,YAAY;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,iBAAiB,EAAE,KAAK,CAAC,SAAS;oBAClC,kBAAkB,EAAE,KAAK,CAAC,UAAU;oBACpC,QAAQ;oBACR,GAAG,EAAE,EAAE,CAAC,GAAG;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CACX,uDAAuD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,KAAK;0BAC/E,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;4BAC7B,CAAC,CAAC,iFAAiF;kCAC/E,oEAAoE;4BACxE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc;gCAC3B,CAAC,CAAC,mFAAmF;sCACjF,gDAAgD;gCACpD,CAAC,CAAC,0EAA0E;sCACxE,mCAAmC,CAAC,CAC7C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kBAAkB,kCAA0B,MAAM,QAAQ,CAAC,MAAM,kBAAkB;UACjF,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACD,GAAgC,CAAC,IAAI,GAAG,kCAA0B,CAAC;IACpE,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAe7B;IACC,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,aAAa;WACxE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,iBAAiB;WAChE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB;WAChE,KAAK,CAAC,iBAAiB,CAAC;IAC7B,IAAI,EAAE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,sBAAsB,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cjs/deny-remedy.d.ts

@@ -0,0 +1,74 @@
+/**
+ * deny-remedy.v1 — the machine-readable next step attached to a refusal.
+ *
+ * CANONICAL SCHEMA: capability-demo/docs/deny-remedy.v1.json
+ *   sha256 3f51c5afd1708a9185075a4f19f6386ea7d63ad39b0104e31f0e4e887b6e167f
+ *
+ * This builder is the TypeScript transliteration of the copy carried by the
+ * JavaScript deny surfaces — same three classes, same refusal to invent a
+ * fourth, same schema. It is a copy rather than a shared package on purpose:
+ * these repos are installed independently and a shared
+ * dependency would make one of them unable to refuse a request because another
+ * failed to resolve.
+ *
+ * WHERE IT SITS IN THE FLOW. The remedy is attached AFTER a verdict is reached,
+ * never inside verification. Nothing here reads a key, checks a signature, or
+ * can change allow into deny. A surface that emits a remedy has already refused.
+ *
+ * WHAT IT REFUSES TO EMIT. Three error classes exist and no more. A refusal
+ * whose reason does not map to one of them gets NO remedy — an unmapped reason
+ * is a refusal we cannot yet describe as a next step, and inventing a fourth
+ * class, or defaulting to the nearest one, would send a caller to a step that
+ * does not address why they were refused.
+ */
+/** The closed set from the schema. */
+export declare const DENY_ERROR: Readonly<{
+    GRANT_REQUIRED: "CODERIFTS_GRANT_REQUIRED";
+    GRANT_INVALID: "CODERIFTS_GRANT_INVALID";
+    GRANT_MISMATCH: "CODERIFTS_GRANT_MISMATCH";
+}>;
+/** Carried verbatim from the schema so it cannot be softened in rendering. */
+export declare const DOES_NOT_PROMISE = "a grant does not guarantee execution (CAS may still fail)";
+export declare const ARGS_SHAPE: Readonly<{
+    artifacts: "Array<{ id, type, before, after }> — the change set being authorized";
+    context: "{ operation, environment?, repository?, branch?, pull_request? } — operation is required for authorize";
+}>;
+/** The three classes, as a type. */
+export type DenyError = (typeof DENY_ERROR)[keyof typeof DENY_ERROR];
+/** The emitted object — exactly the shape the schema describes. */
+export interface DenyRemedy {
+    error: DenyError;
+    target: string | null;
+    fingerprint: string | null;
+    action_required: {
+        tool: 'preflight_change_set';
+        mode: 'authorize';
+        args_shape: Record<string, string>;
+    };
+    does_not_promise: string;
+    observed?: Record<string, unknown>;
+}
+/**
+ * Build the remedy object, or return null when this refusal has no remedy.
+ *
+ * @param {string}  o.error        one of DENY_ERROR; anything else returns null
+ * @param {string}  [o.target]     the surface's own addressing for what was refused
+ * @param {string}  [o.fingerprint] the change-set fingerprint the deny was evaluated
+ *                                 against, when the surface has one
+ * @param {object}  [o.observed]   free-form, for an operator reading a log
+ * @returns {object|null}
+ */
+export declare function buildDenyRemedy({ error, target, fingerprint, observed }: {
+    error: DenyError | null;
+    target?: string | null;
+    fingerprint?: string | null;
+    observed?: Record<string, unknown> | null;
+}): DenyRemedy | null;
+/**
+ * Map a surface's own refusal reason to an error class.
+ *
+ * The mapping is explicit and closed. An unlisted reason returns null, which
+ * means no remedy — see the note at the top of this file.
+ */
+export declare function denyErrorForReason(reason: unknown): DenyError | null;
+//# sourceMappingURL=deny-remedy.d.ts.map

package/dist/cjs/deny-remedy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-remedy.d.ts","sourceRoot":"","sources":["../../src/deny-remedy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,8DAA8D,CAAC;AAE5F,eAAO,MAAM,UAAU;;;EAGrB,CAAC;AAIH,oCAAoC;AACpC,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACzG,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,EAAE,KAAK,EAAE,MAAa,EAAE,WAAkB,EAAE,QAAe,EAAE,EAAE;IAC7D,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C,GACA,UAAU,GAAG,IAAI,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CA+CpE"}