@coderifts/agent-guard 14.1.0 → 15.1.0

package/dist/cjs/index.js

@@ -25,9 +25,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.monitorAttestSigningInput = exports.kidFromMonitoringAttestation = exports.tryIssueMonitoringAttestation = exports.DEFAULT_MONITORING_SINK_TIMEOUT_MS = exports.ackBytes = exports.verifyAckHmac = exports.monitoringDeliveryFailClosed = exports.formatMonitoringDeliveryLine = exports.deliverMonitoring = exports.hashObservedContent = exports.observeCommit = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.EXECUTION_TIME_FP_REASONS = exports.EXECUTION_STATE_UNMEASURABLE_NOTE = exports.isUnmeasurableExecutionStateReason = exports.computeCanonicalBundleFingerprint = exports.authorizedFingerprintFromEnvelope = exports.checkExecutionTimeFingerprint = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.RECEIPT_PREV_NULL = exports.decodeReceiptBodyPrev = exports.previousReceiptCommitment = exports.verifyReceiptChainLinkage = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.resetPolicyWarnForTests = exports.warnPolicyAbsentOnce = exports.observePolicyPresence = exports.detectPolicyPresence = exports.policyPresenceOf = exports.withPolicy = exports.POLICY_ABSENT_WARN = exports.POLICY_MARKER = exports.CODERIFTS_POLICY = exports.guardToolCall = void 0;
 exports.createDbVersionToken = exports.API_ABSENT_TOKEN = exports.API_VERSION_TOKEN_PREFIX = exports.apiTokenRaw = exports.writeApiIfUnchanged = exports.createApiVersionToken = exports.identitiesEqual = exports.fsObjectIdentity = exports.UnsafeCasPathError = exports.assertSafeCasPath = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = exports.fsTokenContentHash = exports.createFsPriorContentResolver = exports.writeFileIfUnchanged = exports.readVersionedFile = exports.createFsVersionToken = exports.StaleVersionTokenAbort = exports.executeIfUnchanged = exports.RESIDUAL_UNCONDITIONAL_WRITE = exports.conditionalWriteResidual = exports.tokensEqual = exports.buildConditionalWriteBasis = exports.buildFreshnessBasis = exports.collectFreshnessCallContext = exports.artifactIdsForResolve = exports.isMutatingCall = exports.isWriteStyleCall = exports.freshnessAllowsEnforce = exports.computePathSetTreeHash = exports.contentByteIdentical = exports.assessWriteStylePrior = exports.assessFreshness = exports.deriveProofBanner = exports.attachProofToAgentResponse = exports.renderFinalAnswerProof = exports.EXECUTION_PROOF_SPEC = exports.assertEnforcedReceiptInvariant = exports.hashExecutionResult = exports.buildExecutionProof = exports.COVERAGE_ATTEST_ENVELOPE_TAG = exports.COVERAGE_ATTEST_SIGNING_PREFIX = exports.COVERAGE_ATTEST_VERSION = exports.coverageAttestSigningInput = exports.kidFromCoverageAttestation = exports.tryIssueCoverageAttestation = exports.MONITOR_ATTEST_ENVELOPE_TAG = exports.MONITOR_ATTEST_SIGNING_PREFIX = exports.MONITOR_ATTEST_VERSION = exports.receiptDigestOfToken = void 0;
-exports.guardedFractionAmongRoutes = exports.foldTableSettledCalls = exports.withCodeRifts = exports.AUTO_DERIVE_READ_TIMEOUT_MS = exports.AUTO_DERIVE_SOURCE = exports.defaultFsReader = exports.normalizeAutoDerive = exports.runAutoDerive = exports.AUTO_RECHECK_MAX_CAP = exports.clampMaxAttempts = exports.normalizeAutoRecheck = exports.runAutoRecheckLoop = exports.coverageReport = exports.DEPLOY_REPAIRABLE_REASONS = exports.bindDeploy = exports.verifyDeployReceiptToken = exports.DEPLOY_RECEIPT_VIEW_SPEC = exports.isVerifiedDeployReceiptView = exports.asVerifiedDeployReceiptView = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.blobMapKey = exports.classifyByName = exports.resolveArtifacts = exports.REMEDIATION_LOOP_ATTESTATION_SPEC = exports.isCasAttestation = exports.readPriorBlockRemediation = exports.readRemediationTransaction = exports.buildRemediationLoopAttestation = exports.COMMIT_EVIDENCE_MISSING = exports.CAS_ATTESTATION_SPEC = exports.strictCommitObservation = exports.extractExecutorAttestationToken = exports.evaluateCasEvidence = exports.isExecuteIfUnchangedOutcome = exports.isGuardExecutionProof = exports.buildCasAttestation = exports.REGISTRY_ABSENT_TOKEN = exports.REGISTRY_VERSION_TOKEN_PREFIX = exports.registryTokenRaw = exports.writeRegistryIfUnchanged = exports.createRegistryVersionToken = exports.DB_ABSENT_TOKEN = exports.DB_VERSION_TOKEN_PREFIX = exports.dbTokenRaw = exports.writeDbIfUnchanged = void 0;
-exports.withCodeRiftsGemini = exports.measureFsAuthorizationToken = exports.measureFsAuthorization = exports.wrapWriteWithFsCas = exports.inferFullFileWriteContent = exports.inferFsPathFromArgs = exports.FRESHNESS_RESOLVER_FIX = exports.freshnessRefusalTeaching = exports.formatGateRefusalBody = exports.defaultSerializeLangGraphToolResult = exports.bindLangGraphGuardOutcome = exports.LangGraphToolsNotStructuredError = exports.isLangGraphReactAgentTool = exports.bindLangGraphTools = exports.protectedToolToLangGraph = exports.toLangGraphTools = exports.langGraphToolAdapter = exports.withCodeRiftsLangGraph = exports.defaultSerializeAnthropicToolResult = exports.bindAnthropicGuardOutcome = exports.protectedToolToAnthropic = exports.toAnthropicTools = exports.anthropicToolAdapter = exports.withCodeRiftsAnthropic = exports.defaultSerializeOpenAIToolResult = exports.bindOpenAIGuardOutcome = exports.protectedToolToOpenAI = exports.toOpenAITools = exports.openAIToolAdapter = exports.withCodeRiftsOpenAI = exports.formatCoverageObservedLine = exports.freezeCoverageObserved = exports.createCoverageObserver = exports.readExecutionGrantToken = exports.isExecutionGrantEnabled = exports.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports.POSTURE_RECEIPT_V = exports.verifyPostureReceipt = exports.ATOMIC_V2_MAX_AGE_MS_CAP = exports.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports.atomicConstructionProblems = exports.isEnforcingAtomicV2 = exports.PROFILE_ENFORCING_ATOMIC_V2 = exports.isEnforcingAtomic = exports.atomicOutcome = exports.ATOMIC_PROFILE_UNSATISFIED = exports.ATOMIC_INVARIANTS = exports.createMutatorRegister = exports.PROFILE_ENFORCING_ATOMIC_V1 = exports.PROFILE_ENFORCING_STRICT_V1 = void 0;
-exports.kidFromToolsetAttestation = exports.tryIssueToolsetAttestation = exports.toolsetAttestSigningInput = exports.declarationEntriesFromTools = exports.computeToolsetDigest = exports.TOOLSET_ATTEST_STATEMENT = exports.TOOLSET_ATTEST_ENVELOPE_TAG = exports.TOOLSET_ATTEST_SIGNING_PREFIX = exports.TOOLSET_ATTEST_VERSION = exports.surfaceEnvelopeFields = exports.isGuardOutcome = exports.executeVercelToolCall = exports.executeLangGraphToolCall = exports.executeGeminiToolCall = exports.executeAnthropicToolCall = exports.executeOpenAIToolCall = exports.executeProtectedTool = exports.defaultSerializeVercelToolResult = exports.bindVercelGuardOutcome = exports.protectedToolToVercel = exports.toVercelTools = exports.vercelToolAdapter = exports.withCodeRiftsVercel = exports.defaultSerializeGeminiToolResult = exports.bindGeminiGuardOutcome = exports.protectedToolToFunctionDeclaration = exports.toGeminiTools = exports.geminiToolAdapter = void 0;
+exports.AUTO_DERIVE_READ_TIMEOUT_MS = exports.AUTO_DERIVE_SOURCE = exports.defaultFsReader = exports.normalizeAutoDerive = exports.runAutoDerive = exports.AUTO_RECHECK_MAX_CAP = exports.clampMaxAttempts = exports.normalizeAutoRecheck = exports.runAutoRecheckLoop = exports.coverageReport = exports.DEPLOY_REPAIRABLE_REASONS = exports.bindDeploy = exports.NEXT_STEP_NOTE = exports.NEXT_AGENT_ACTIONS = exports.readNextAgentStep = exports.verifyDeployReceiptToken = exports.DEPLOY_RECEIPT_VIEW_SPEC = exports.isVerifiedDeployReceiptView = exports.asVerifiedDeployReceiptView = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.blobMapKey = exports.classifyByName = exports.resolveArtifacts = exports.REMEDIATION_LOOP_ATTESTATION_SPEC = exports.isCasAttestation = exports.readPriorBlockRemediation = exports.readRemediationTransaction = exports.buildRemediationLoopAttestation = exports.COMMIT_EVIDENCE_MISSING = exports.CAS_ATTESTATION_SPEC = exports.strictCommitObservation = exports.extractExecutorAttestationToken = exports.evaluateCasEvidence = exports.isExecuteIfUnchangedOutcome = exports.isGuardExecutionProof = exports.buildCasAttestation = exports.REGISTRY_ABSENT_TOKEN = exports.REGISTRY_VERSION_TOKEN_PREFIX = exports.registryTokenRaw = exports.writeRegistryIfUnchanged = exports.createRegistryVersionToken = exports.DB_ABSENT_TOKEN = exports.DB_VERSION_TOKEN_PREFIX = exports.dbTokenRaw = exports.writeDbIfUnchanged = void 0;
+exports.inferFsPathFromArgs = exports.FRESHNESS_RESOLVER_FIX = exports.freshnessRefusalTeaching = exports.formatGateRefusalBody = exports.defaultSerializeLangGraphToolResult = exports.bindLangGraphGuardOutcome = exports.LangGraphToolsNotStructuredError = exports.isLangGraphReactAgentTool = exports.bindLangGraphTools = exports.protectedToolToLangGraph = exports.toLangGraphTools = exports.langGraphToolAdapter = exports.withCodeRiftsLangGraph = exports.defaultSerializeAnthropicToolResult = exports.bindAnthropicGuardOutcome = exports.protectedToolToAnthropic = exports.toAnthropicTools = exports.anthropicToolAdapter = exports.withCodeRiftsAnthropic = exports.defaultSerializeOpenAIToolResult = exports.bindOpenAIGuardOutcome = exports.protectedToolToOpenAI = exports.toOpenAITools = exports.openAIToolAdapter = exports.withCodeRiftsOpenAI = exports.formatCoverageObservedLine = exports.freezeCoverageObserved = exports.createCoverageObserver = exports.readExecutionGrantToken = exports.isExecutionGrantEnabled = exports.POSTURE_CLOCK_SKEW_TOLERANCE_MS = exports.POSTURE_RECEIPT_V = exports.verifyPostureReceipt = exports.ATOMIC_V2_MAX_AGE_MS_CAP = exports.CREDENTIAL_BOUNDARY_BARE_REJECTED = exports.atomicConstructionProblems = exports.isEnforcingAtomicV2 = exports.PROFILE_ENFORCING_ATOMIC_V2 = exports.isEnforcingAtomic = exports.atomicOutcome = exports.ATOMIC_PROFILE_UNSATISFIED = exports.ATOMIC_INVARIANTS = exports.createMutatorRegister = exports._resetUnversionedProfileNoticeForTest = exports.UNVERSIONED_PROFILE_NOTICE = exports.PROFILE_ENFORCING_ATOMIC_V1 = exports.PROFILE_ENFORCING_STRICT_V1 = exports.guardedFractionAmongRoutes = exports.foldTableSettledCalls = exports.withCodeRifts = void 0;
+exports.kidFromToolsetAttestation = exports.tryIssueToolsetAttestation = exports.toolsetAttestSigningInput = exports.declarationEntriesFromTools = exports.computeToolsetDigest = exports.TOOLSET_ATTEST_STATEMENT = exports.TOOLSET_ATTEST_ENVELOPE_TAG = exports.TOOLSET_ATTEST_SIGNING_PREFIX = exports.TOOLSET_ATTEST_VERSION = exports.surfaceEnvelopeFields = exports.isGuardOutcome = exports.executeVercelToolCall = exports.executeLangGraphToolCall = exports.executeGeminiToolCall = exports.executeAnthropicToolCall = exports.executeOpenAIToolCall = exports.executeProtectedTool = exports.defaultSerializeVercelToolResult = exports.bindVercelGuardOutcome = exports.protectedToolToVercel = exports.toVercelTools = exports.vercelToolAdapter = exports.withCodeRiftsVercel = exports.defaultSerializeCrewAIToolResult = exports.bindCrewAIToolOutcome = exports.LANGCHAIN_ARTIFACT_SPEC = exports.defaultSerializeLangChainToolResult = exports.bindLangChainToolOutcome = exports.defaultSerializeGeminiToolResult = exports.bindGeminiGuardOutcome = exports.protectedToolToFunctionDeclaration = exports.toGeminiTools = exports.geminiToolAdapter = exports.withCodeRiftsGemini = exports.measureFsAuthorizationToken = exports.measureFsAuthorization = exports.wrapWriteWithFsCas = exports.inferFullFileWriteContent = void 0;
 var guard_js_1 = require("./guard.js");
 Object.defineProperty(exports, "guardToolCall", { enumerable: true, get: function () { return guard_js_1.guardToolCall; } });
 var policy_js_1 = require("./policy.js");
@@ -220,6 +220,13 @@ Object.defineProperty(exports, "isVerifiedDeployReceiptView", { enumerable: true
 Object.defineProperty(exports, "DEPLOY_RECEIPT_VIEW_SPEC", { enumerable: true, get: function () { return deploy_gate_js_1.DEPLOY_RECEIPT_VIEW_SPEC; } });
 var deploy_receipt_token_js_1 = require("./deploy-receipt-token.js");
 Object.defineProperty(exports, "verifyDeployReceiptToken", { enumerable: true, get: function () { return deploy_receipt_token_js_1.verifyDeployReceiptToken; } });
+// I-1288f — the decision's own remediation suggestion, read from a SIGNED envelope.
+// Not permission; branch on execution_action. NEXT_STEP_NOTE is the one fixed sentence
+// every CodeRifts surface prints beside a rendered step (byte-identical to contract-gate).
+var next_agent_step_js_1 = require("./next-agent-step.js");
+Object.defineProperty(exports, "readNextAgentStep", { enumerable: true, get: function () { return next_agent_step_js_1.readNextAgentStep; } });
+Object.defineProperty(exports, "NEXT_AGENT_ACTIONS", { enumerable: true, get: function () { return next_agent_step_js_1.NEXT_AGENT_ACTIONS; } });
+Object.defineProperty(exports, "NEXT_STEP_NOTE", { enumerable: true, get: function () { return next_agent_step_js_1.NEXT_STEP_NOTE; } });
 // bindDeploy — pure deploy-TIME caller over deployGate (host asserts env; pipeline action not observed).
 var deploy_bind_js_1 = require("./deploy-bind.js");
 Object.defineProperty(exports, "bindDeploy", { enumerable: true, get: function () { return deploy_bind_js_1.bindDeploy; } });
@@ -249,6 +256,10 @@ Object.defineProperty(exports, "foldTableSettledCalls", { enumerable: true, get:
 Object.defineProperty(exports, "guardedFractionAmongRoutes", { enumerable: true, get: function () { return with_coderifts_js_1.guardedFractionAmongRoutes; } });
 Object.defineProperty(exports, "PROFILE_ENFORCING_STRICT_V1", { enumerable: true, get: function () { return with_coderifts_js_1.PROFILE_ENFORCING_STRICT_V1; } });
 Object.defineProperty(exports, "PROFILE_ENFORCING_ATOMIC_V1", { enumerable: true, get: function () { return with_coderifts_js_1.PROFILE_ENFORCING_ATOMIC_V1; } });
+// The notice text, exported so a consumer's log filter can match on the constant rather than
+// on a string copied out of a release note.
+Object.defineProperty(exports, "UNVERSIONED_PROFILE_NOTICE", { enumerable: true, get: function () { return with_coderifts_js_1.UNVERSIONED_PROFILE_NOTICE; } });
+Object.defineProperty(exports, "_resetUnversionedProfileNoticeForTest", { enumerable: true, get: function () { return with_coderifts_js_1._resetUnversionedProfileNoticeForTest; } });
 var atomic_profile_js_1 = require("./atomic-profile.js");
 Object.defineProperty(exports, "createMutatorRegister", { enumerable: true, get: function () { return atomic_profile_js_1.createMutatorRegister; } });
 Object.defineProperty(exports, "ATOMIC_INVARIANTS", { enumerable: true, get: function () { return atomic_profile_js_1.ATOMIC_INVARIANTS; } });
@@ -324,6 +335,15 @@ Object.defineProperty(exports, "protectedToolToFunctionDeclaration", { enumerabl
 Object.defineProperty(exports, "bindGeminiGuardOutcome", { enumerable: true, get: function () { return gemini_js_1.bindGeminiGuardOutcome; } });
 Object.defineProperty(exports, "defaultSerializeGeminiToolResult", { enumerable: true, get: function () { return gemini_js_1.defaultSerializeGeminiToolResult; } });
 // Roadmap 129 — thin Vercel AI SDK tool adapter (generateText tools record; no `ai` dep).
+// I-1272 — bindLangChainToolOutcome (content_and_artifact: proof off the model's context).
+var langchain_js_1 = require("./adapters/langchain.js");
+Object.defineProperty(exports, "bindLangChainToolOutcome", { enumerable: true, get: function () { return langchain_js_1.bindLangChainToolOutcome; } });
+Object.defineProperty(exports, "defaultSerializeLangChainToolResult", { enumerable: true, get: function () { return langchain_js_1.defaultSerializeLangChainToolResult; } });
+Object.defineProperty(exports, "LANGCHAIN_ARTIFACT_SPEC", { enumerable: true, get: function () { return langchain_js_1.LANGCHAIN_ARTIFACT_SPEC; } });
+// I-1272 — bindCrewAIToolOutcome (result + result_as_answer: a refusal is the final answer).
+var crewai_js_1 = require("./adapters/crewai.js");
+Object.defineProperty(exports, "bindCrewAIToolOutcome", { enumerable: true, get: function () { return crewai_js_1.bindCrewAIToolOutcome; } });
+Object.defineProperty(exports, "defaultSerializeCrewAIToolResult", { enumerable: true, get: function () { return crewai_js_1.defaultSerializeCrewAIToolResult; } });
 // bindVercelGuardOutcome (Option B proof binder; id field is toolCallId).
 var vercel_js_1 = require("./adapters/vercel.js");
 Object.defineProperty(exports, "withCodeRiftsVercel", { enumerable: true, get: function () { return vercel_js_1.withCodeRiftsVercel; } });

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,yCAUqB;AATnB,6GAAA,gBAAgB,OAAA;AAChB,0GAAA,aAAa,OAAA;AACb,+GAAA,kBAAkB,OAAA;AAClB,uGAAA,UAAU,OAAA;AACV,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AAOzB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,wGAAwG;AACxG,uDAK4B;AAJ1B,6HAAA,yBAAyB,OAAA;AACzB,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,qHAAA,iBAAiB,OAAA;AAMnB,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,uFAAuF;AACvF,iFAOyC;AANvC,8IAAA,6BAA6B,OAAA;AAC7B,kJAAA,iCAAiC,OAAA;AACjC,kJAAA,iCAAiC,OAAA;AACjC,mJAAA,kCAAkC,OAAA;AAClC,kJAAA,iCAAiC,OAAA;AACjC,0IAAA,yBAAyB,OAAA;AAQ3B,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AACnF,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AAkC9E,iEAA6E;AAApE,sHAAA,aAAa,OAAA;AAAE,4HAAA,mBAAmB,OAAA;AAE3C,mEAOkC;AANhC,2HAAA,iBAAiB,OAAA;AACjB,sIAAA,4BAA4B,OAAA;AAC5B,sIAAA,4BAA4B,OAAA;AAC5B,uHAAA,aAAa,OAAA;AACb,kHAAA,QAAQ,OAAA;AACR,4IAAA,kCAAkC,OAAA;AAEpC,yEAQqC;AAPnC,0IAAA,6BAA6B,OAAA;AAC7B,yIAAA,4BAA4B,OAAA;AAC5B,sIAAA,yBAAyB,OAAA;AACzB,iIAAA,oBAAoB,OAAA;AACpB,mIAAA,sBAAsB,OAAA;AACtB,0IAAA,6BAA6B,OAAA;AAC7B,wIAAA,2BAA2B,OAAA;AAM7B,qEAOmC;AANjC,sIAAA,2BAA2B,OAAA;AAC3B,qIAAA,0BAA0B,OAAA;AAC1B,qIAAA,0BAA0B,OAAA;AAC1B,kIAAA,uBAAuB,OAAA;AACvB,yIAAA,8BAA8B,OAAA;AAC9B,uIAAA,4BAA4B,OAAA;AAgB9B,8FAA8F;AAC9F,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,yHAAA,mBAAmB,OAAA;AACnB,oIAAA,8BAA8B,OAAA;AAC9B,0HAAA,oBAAoB,OAAA;AAGtB,2FAA2F;AAC3F,sFAAsF;AACtF,iEAIiC;AAH/B,+HAAA,sBAAsB,OAAA;AACtB,mIAAA,0BAA0B,OAAA;AAC1B,0HAAA,iBAAiB,OAAA;AASnB,mGAAmG;AACnG,+CAWwB;AAVtB,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,oHAAA,oBAAoB,OAAA;AACpB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,gHAAA,gBAAgB,OAAA;AAChB,8GAAA,cAAc,OAAA;AACd,qHAAA,qBAAqB,OAAA;AACrB,2HAAA,2BAA2B,OAAA;AAC3B,mHAAA,mBAAmB,OAAA;AAgBrB,0GAA0G;AAC1G,2FAA2F;AAC3F,+DAOgC;AAN9B,kIAAA,0BAA0B,OAAA;AAC1B,mHAAA,WAAW,OAAA;AACX,gIAAA,wBAAwB,OAAA;AACxB,oIAAA,4BAA4B,OAAA;AAC5B,0HAAA,kBAAkB,OAAA;AAClB,8HAAA,sBAAsB,OAAA;AAcxB,yGAAyG;AACzG,8CAY8B;AAX5B,6GAAA,oBAAoB,OAAA;AACpB,0GAAA,iBAAiB,OAAA;AACjB,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AACjB,2GAAA,kBAAkB,OAAA;AAClB,yGAAA,gBAAgB,OAAA;AAChB,wGAAA,eAAe,OAAA;AAIjB,sFAAsF;AACtF,gDAM+B;AAL7B,+GAAA,qBAAqB,OAAA;AACrB,6GAAA,mBAAmB,OAAA;AACnB,qGAAA,WAAW,OAAA;AACX,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAQlB,uGAAuG;AACvG,8CAM8B;AAL5B,6GAAA,oBAAoB,OAAA;AACpB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AAQjB,mFAAmF;AACnF,0DAMoC;AALlC,yHAAA,0BAA0B,OAAA;AAC1B,uHAAA,wBAAwB,OAAA;AACxB,+GAAA,gBAAgB,OAAA;AAChB,4HAAA,6BAA6B,OAAA;AAC7B,oHAAA,qBAAqB,OAAA;AAQvB,4FAA4F;AAC5F,yFAAyF;AACzF,2DAS8B;AAR5B,yHAAA,mBAAmB,OAAA;AACnB,2HAAA,qBAAqB,OAAA;AACrB,iIAAA,2BAA2B,OAAA;AAC3B,yHAAA,mBAAmB,OAAA;AACnB,qIAAA,+BAA+B,OAAA;AAC/B,6HAAA,uBAAuB,OAAA;AACvB,0HAAA,oBAAoB,OAAA;AACpB,6HAAA,uBAAuB,OAAA;AAczB,+FAA+F;AAC/F,0FAA0F;AAC1F,qFAM2C;AALzC,kJAAA,+BAA+B,OAAA;AAC/B,6IAAA,0BAA0B,OAAA;AAC1B,4IAAA,yBAAyB,OAAA;AACzB,mIAAA,gBAAgB,OAAA;AAChB,oJAAA,iCAAiC,OAAA;AAQnC,kGAAkG;AAClG,wFAAwF;AACxF,+DAAiG;AAAxF,wHAAA,OAAO,OAAoB;AAAE,sHAAA,cAAc,OAAA;AAAE,kHAAA,UAAU,OAAA;AAKhE,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAK0B;AAJxB,4GAAA,UAAU,OAAA;AACV,6HAAA,2BAA2B,OAAA;AAC3B,6HAAA,2BAA2B,OAAA;AAC3B,0HAAA,wBAAwB,OAAA;AAO1B,qEAAqE;AAA5D,mIAAA,wBAAwB,OAAA;AAEjC,yGAAyG;AACzG,mDAAyE;AAAhE,4GAAA,UAAU,OAAA;AAAE,2HAAA,yBAAyB,OAAA;AAK9C,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA;AAOvB,2EAA2E;AAC3E,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,uHAAA,oBAAoB,OAAA;AACpB,mHAAA,gBAAgB,OAAA;AAChB,uHAAA,oBAAoB,OAAA;AAUtB,oFAAoF;AACpF,mDAM0B;AALxB,+GAAA,aAAa,OAAA;AACb,qHAAA,mBAAmB,OAAA;AACnB,iHAAA,eAAe,OAAA;AACf,oHAAA,kBAAkB,OAAA;AAClB,6HAAA,2BAA2B,OAAA;AAY7B,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,yDAM6B;AAL3B,kHAAA,aAAa,OAAA;AACb,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAC1B,gIAAA,2BAA2B,OAAA;AAC3B,gIAAA,2BAA2B,OAAA;AAE7B,yDAY6B;AAX3B,0HAAA,qBAAqB,OAAA;AACrB,sHAAA,iBAAiB,OAAA;AACjB,+HAAA,0BAA0B,OAAA;AAC1B,kHAAA,aAAa,OAAA;AACb,sHAAA,iBAAiB,OAAA;AACjB,2DAA2D;AAC3D,gIAAA,2BAA2B,OAAA;AAC3B,wHAAA,mBAAmB,OAAA;AACnB,+HAAA,0BAA0B,OAAA;AAC1B,sIAAA,iCAAiC,OAAA;AACjC,6HAAA,wBAAwB,OAAA;AAG1B,2DAI8B;AAH5B,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AACjB,qIAAA,+BAA+B,OAAA;AAWjC,2DAG8B;AAF5B,6HAAA,uBAAuB,OAAA;AACvB,6HAAA,uBAAuB,OAAA;AAQzB,gGAAgG;AAChG,+DAIgC;AAH9B,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,kIAAA,0BAA0B,OAAA;AAa5B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAUlC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAUiC;AAT/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,kHAAA,kBAAkB,OAAA;AAClB,yHAAA,yBAAyB,OAAA;AACzB,gIAAA,gCAAgC,OAAA;AAChC,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AASrC,qDAI2B;AAHzB,wHAAA,qBAAqB,OAAA;AACrB,2HAAA,wBAAwB,OAAA;AACxB,yHAAA,sBAAsB,OAAA;AAExB,wEAM2C;AALzC,yHAAA,mBAAmB,OAAA;AACnB,+HAAA,yBAAyB,OAAA;AACzB,wHAAA,kBAAkB,OAAA;AAClB,4HAAA,sBAAsB,OAAA;AACtB,iIAAA,2BAA2B,OAAA;AAI7B,8FAA8F;AAC9F,wGAAwG;AACxG,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,+HAAA,kCAAkC,OAAA;AAClC,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAWlC,0FAA0F;AAC1F,0EAA0E;AAC1E,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAWlC,2FAA2F;AAC3F,iGAAiG;AACjG,+DASgC;AAR9B,4HAAA,oBAAoB,OAAA;AACpB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,6HAAA,qBAAqB,OAAA;AACrB,sHAAA,cAAc,OAAA;AACd,6HAAA,qBAAqB,OAAA;AAYvB,mEAUkC;AAThC,gIAAA,sBAAsB,OAAA;AACtB,uIAAA,6BAA6B,OAAA;AAC7B,qIAAA,2BAA2B,OAAA;AAC3B,kIAAA,wBAAwB,OAAA;AACxB,8HAAA,oBAAoB,OAAA;AACpB,qIAAA,2BAA2B,OAAA;AAC3B,mIAAA,yBAAyB,OAAA;AACzB,oIAAA,0BAA0B,OAAA;AAC1B,mIAAA,yBAAyB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,yCAUqB;AATnB,6GAAA,gBAAgB,OAAA;AAChB,0GAAA,aAAa,OAAA;AACb,+GAAA,kBAAkB,OAAA;AAClB,uGAAA,UAAU,OAAA;AACV,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AAOzB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,wGAAwG;AACxG,uDAK4B;AAJ1B,6HAAA,yBAAyB,OAAA;AACzB,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,qHAAA,iBAAiB,OAAA;AAMnB,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,uFAAuF;AACvF,iFAOyC;AANvC,8IAAA,6BAA6B,OAAA;AAC7B,kJAAA,iCAAiC,OAAA;AACjC,kJAAA,iCAAiC,OAAA;AACjC,mJAAA,kCAAkC,OAAA;AAClC,kJAAA,iCAAiC,OAAA;AACjC,0IAAA,yBAAyB,OAAA;AAQ3B,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AACnF,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AAkC9E,iEAA6E;AAApE,sHAAA,aAAa,OAAA;AAAE,4HAAA,mBAAmB,OAAA;AAE3C,mEAOkC;AANhC,2HAAA,iBAAiB,OAAA;AACjB,sIAAA,4BAA4B,OAAA;AAC5B,sIAAA,4BAA4B,OAAA;AAC5B,uHAAA,aAAa,OAAA;AACb,kHAAA,QAAQ,OAAA;AACR,4IAAA,kCAAkC,OAAA;AAEpC,yEAQqC;AAPnC,0IAAA,6BAA6B,OAAA;AAC7B,yIAAA,4BAA4B,OAAA;AAC5B,sIAAA,yBAAyB,OAAA;AACzB,iIAAA,oBAAoB,OAAA;AACpB,mIAAA,sBAAsB,OAAA;AACtB,0IAAA,6BAA6B,OAAA;AAC7B,wIAAA,2BAA2B,OAAA;AAM7B,qEAOmC;AANjC,sIAAA,2BAA2B,OAAA;AAC3B,qIAAA,0BAA0B,OAAA;AAC1B,qIAAA,0BAA0B,OAAA;AAC1B,kIAAA,uBAAuB,OAAA;AACvB,yIAAA,8BAA8B,OAAA;AAC9B,uIAAA,4BAA4B,OAAA;AAgB9B,8FAA8F;AAC9F,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,yHAAA,mBAAmB,OAAA;AACnB,oIAAA,8BAA8B,OAAA;AAC9B,0HAAA,oBAAoB,OAAA;AAGtB,2FAA2F;AAC3F,sFAAsF;AACtF,iEAIiC;AAH/B,+HAAA,sBAAsB,OAAA;AACtB,mIAAA,0BAA0B,OAAA;AAC1B,0HAAA,iBAAiB,OAAA;AASnB,mGAAmG;AACnG,+CAWwB;AAVtB,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,oHAAA,oBAAoB,OAAA;AACpB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,gHAAA,gBAAgB,OAAA;AAChB,8GAAA,cAAc,OAAA;AACd,qHAAA,qBAAqB,OAAA;AACrB,2HAAA,2BAA2B,OAAA;AAC3B,mHAAA,mBAAmB,OAAA;AAgBrB,0GAA0G;AAC1G,2FAA2F;AAC3F,+DAOgC;AAN9B,kIAAA,0BAA0B,OAAA;AAC1B,mHAAA,WAAW,OAAA;AACX,gIAAA,wBAAwB,OAAA;AACxB,oIAAA,4BAA4B,OAAA;AAC5B,0HAAA,kBAAkB,OAAA;AAClB,8HAAA,sBAAsB,OAAA;AAcxB,yGAAyG;AACzG,8CAY8B;AAX5B,6GAAA,oBAAoB,OAAA;AACpB,0GAAA,iBAAiB,OAAA;AACjB,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AACf,0GAAA,iBAAiB,OAAA;AACjB,2GAAA,kBAAkB,OAAA;AAClB,yGAAA,gBAAgB,OAAA;AAChB,wGAAA,eAAe,OAAA;AAIjB,sFAAsF;AACtF,gDAM+B;AAL7B,+GAAA,qBAAqB,OAAA;AACrB,6GAAA,mBAAmB,OAAA;AACnB,qGAAA,WAAW,OAAA;AACX,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAQlB,uGAAuG;AACvG,8CAM8B;AAL5B,6GAAA,oBAAoB,OAAA;AACpB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AAQjB,mFAAmF;AACnF,0DAMoC;AALlC,yHAAA,0BAA0B,OAAA;AAC1B,uHAAA,wBAAwB,OAAA;AACxB,+GAAA,gBAAgB,OAAA;AAChB,4HAAA,6BAA6B,OAAA;AAC7B,oHAAA,qBAAqB,OAAA;AAQvB,4FAA4F;AAC5F,yFAAyF;AACzF,2DAS8B;AAR5B,yHAAA,mBAAmB,OAAA;AACnB,2HAAA,qBAAqB,OAAA;AACrB,iIAAA,2BAA2B,OAAA;AAC3B,yHAAA,mBAAmB,OAAA;AACnB,qIAAA,+BAA+B,OAAA;AAC/B,6HAAA,uBAAuB,OAAA;AACvB,0HAAA,oBAAoB,OAAA;AACpB,6HAAA,uBAAuB,OAAA;AAczB,+FAA+F;AAC/F,0FAA0F;AAC1F,qFAM2C;AALzC,kJAAA,+BAA+B,OAAA;AAC/B,6IAAA,0BAA0B,OAAA;AAC1B,4IAAA,yBAAyB,OAAA;AACzB,mIAAA,gBAAgB,OAAA;AAChB,oJAAA,iCAAiC,OAAA;AAQnC,kGAAkG;AAClG,wFAAwF;AACxF,+DAAiG;AAAxF,wHAAA,OAAO,OAAoB;AAAE,sHAAA,cAAc,OAAA;AAAE,kHAAA,UAAU,OAAA;AAKhE,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAK0B;AAJxB,4GAAA,UAAU,OAAA;AACV,6HAAA,2BAA2B,OAAA;AAC3B,6HAAA,2BAA2B,OAAA;AAC3B,0HAAA,wBAAwB,OAAA;AAO1B,qEAAqE;AAA5D,mIAAA,wBAAwB,OAAA;AAEjC,oFAAoF;AACpF,uFAAuF;AACvF,2FAA2F;AAC3F,2DAA6F;AAApF,uHAAA,iBAAiB,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAAE,oHAAA,cAAc,OAAA;AAE9D,yGAAyG;AACzG,mDAAyE;AAAhE,4GAAA,UAAU,OAAA;AAAE,2HAAA,yBAAyB,OAAA;AAK9C,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA;AAOvB,2EAA2E;AAC3E,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,uHAAA,oBAAoB,OAAA;AACpB,mHAAA,gBAAgB,OAAA;AAChB,uHAAA,oBAAoB,OAAA;AAUtB,oFAAoF;AACpF,mDAM0B;AALxB,+GAAA,aAAa,OAAA;AACb,qHAAA,mBAAmB,OAAA;AACnB,iHAAA,eAAe,OAAA;AACf,oHAAA,kBAAkB,OAAA;AAClB,6HAAA,2BAA2B,OAAA;AAY7B,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,yDAU6B;AAT3B,kHAAA,aAAa,OAAA;AACb,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAC1B,gIAAA,2BAA2B,OAAA;AAC3B,gIAAA,2BAA2B,OAAA;AAC3B,6FAA6F;AAC7F,4CAA4C;AAC5C,+HAAA,0BAA0B,OAAA;AAC1B,0IAAA,qCAAqC,OAAA;AAEvC,yDAY6B;AAX3B,0HAAA,qBAAqB,OAAA;AACrB,sHAAA,iBAAiB,OAAA;AACjB,+HAAA,0BAA0B,OAAA;AAC1B,kHAAA,aAAa,OAAA;AACb,sHAAA,iBAAiB,OAAA;AACjB,2DAA2D;AAC3D,gIAAA,2BAA2B,OAAA;AAC3B,wHAAA,mBAAmB,OAAA;AACnB,+HAAA,0BAA0B,OAAA;AAC1B,sIAAA,iCAAiC,OAAA;AACjC,6HAAA,wBAAwB,OAAA;AAG1B,2DAI8B;AAH5B,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AACjB,qIAAA,+BAA+B,OAAA;AAWjC,2DAG8B;AAF5B,6HAAA,uBAAuB,OAAA;AACvB,6HAAA,uBAAuB,OAAA;AAQzB,gGAAgG;AAChG,+DAIgC;AAH9B,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,kIAAA,0BAA0B,OAAA;AAa5B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAUlC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAUiC;AAT/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,kHAAA,kBAAkB,OAAA;AAClB,yHAAA,yBAAyB,OAAA;AACzB,gIAAA,gCAAgC,OAAA;AAChC,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AASrC,qDAI2B;AAHzB,wHAAA,qBAAqB,OAAA;AACrB,2HAAA,wBAAwB,OAAA;AACxB,yHAAA,sBAAsB,OAAA;AAExB,wEAM2C;AALzC,yHAAA,mBAAmB,OAAA;AACnB,+HAAA,yBAAyB,OAAA;AACzB,wHAAA,kBAAkB,OAAA;AAClB,4HAAA,sBAAsB,OAAA;AACtB,iIAAA,2BAA2B,OAAA;AAI7B,8FAA8F;AAC9F,wGAAwG;AACxG,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,+HAAA,kCAAkC,OAAA;AAClC,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAWlC,0FAA0F;AAC1F,2FAA2F;AAC3F,wDAIiC;AAH/B,wHAAA,wBAAwB,OAAA;AACxB,mIAAA,mCAAmC,OAAA;AACnC,uHAAA,uBAAuB,OAAA;AASzB,6FAA6F;AAC7F,kDAG8B;AAF5B,kHAAA,qBAAqB,OAAA;AACrB,6HAAA,gCAAgC,OAAA;AAQlC,0EAA0E;AAC1E,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAWlC,2FAA2F;AAC3F,iGAAiG;AACjG,+DASgC;AAR9B,4HAAA,oBAAoB,OAAA;AACpB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,6HAAA,qBAAqB,OAAA;AACrB,sHAAA,cAAc,OAAA;AACd,6HAAA,qBAAqB,OAAA;AAYvB,mEAUkC;AAThC,gIAAA,sBAAsB,OAAA;AACtB,uIAAA,6BAA6B,OAAA;AAC7B,qIAAA,2BAA2B,OAAA;AAC3B,kIAAA,wBAAwB,OAAA;AACxB,8HAAA,oBAAoB,OAAA;AACpB,qIAAA,2BAA2B,OAAA;AAC3B,mIAAA,yBAAyB,OAAA;AACzB,oIAAA,0BAA0B,OAAA;AAC1B,mIAAA,yBAAyB,OAAA"}

package/dist/cjs/next-agent-step.d.ts

@@ -0,0 +1,50 @@
+/**
+ * next_agent_step — the DECISION's own remediation SUGGESTION, read from a SIGNED envelope.
+ *
+ * WHY THIS FILE EXISTS (I-1288f). The app moved the field inside `decision_result`, where
+ * `decision_body_hash` covers it and the receipt signs it. That is what makes it safe for a
+ * consumer holding only the envelope — deployGate, and the two verifier services — to render
+ * it without a second call to the issuer.
+ *
+ * The corollary is the rule every caller here obeys: read it ONLY off an envelope whose
+ * signature this process already checked. `receiptVerified` on a GuardVerdict and
+ * `verification.mode === 'token'` on a deploy outcome are the two places that is true. An
+ * unsigned step is an attacker-supplied instruction wearing the issuer's voice.
+ *
+ * Shape and closed action set: coderifts-app schemas/decision-result.v1.producer.json,
+ * properties.next_agent_step (required action / reason / resume_condition / then_call;
+ * additionalProperties false). Mirrors contract-gate 0.8.0 `readNextAgentStep`.
+ *
+ * NOT PERMISSION: this is the decision's remediation suggestion, not permission; branch on
+ * execution_action.
+ */
+/** The closed action set the issuer projects (producer schema enum). */
+export declare const NEXT_AGENT_ACTIONS: readonly ["re_preflight", "revert", "migrate", "escalate", "await_approval"];
+export type NextAgentAction = typeof NEXT_AGENT_ACTIONS[number];
+/**
+ * The step as the issuer signs it. `action` is typed as the closed set plus `string`
+ * so an action added by a newer issuer is carried through rather than dropped — the
+ * same fail-open-for-DATA / fail-closed-for-CONTROL split the guard uses elsewhere.
+ * Nothing here is a control input.
+ */
+export type NextAgentStep = {
+    action: NextAgentAction | string;
+    reason?: string;
+    resume_condition?: string;
+    then_call?: string | null;
+};
+/**
+ * Read the step from a decision envelope. A step without a non-empty `action` is not a
+ * step (same rule as contract-gate): the action is the only field a reader can act on,
+ * so a step missing it would render as guidance that says nothing.
+ *
+ * Pure. Never throws. Returns null for anything that is not an object with an action.
+ */
+export declare function readNextAgentStep(envelope: unknown): NextAgentStep | null;
+/**
+ * The one fixed sentence every CodeRifts surface prints beside a rendered step.
+ * Byte-identical to contract-gate 0.8.0 `nextStepBlock`. It is not from the server:
+ * the step is a suggestion, and execution_action remains the thing to branch on.
+ */
+export declare const NEXT_STEP_NOTE = "This is the decision's remediation suggestion, not permission; branch on execution_action.";
+//# sourceMappingURL=next-agent-step.d.ts.map

package/dist/cjs/next-agent-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-agent-step.d.ts","sourceRoot":"","sources":["../../src/next-agent-step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,8EAErB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAOzE;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,+FACmE,CAAC"}

package/dist/cjs/next-agent-step.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * next_agent_step — the DECISION's own remediation SUGGESTION, read from a SIGNED envelope.
+ *
+ * WHY THIS FILE EXISTS (I-1288f). The app moved the field inside `decision_result`, where
+ * `decision_body_hash` covers it and the receipt signs it. That is what makes it safe for a
+ * consumer holding only the envelope — deployGate, and the two verifier services — to render
+ * it without a second call to the issuer.
+ *
+ * The corollary is the rule every caller here obeys: read it ONLY off an envelope whose
+ * signature this process already checked. `receiptVerified` on a GuardVerdict and
+ * `verification.mode === 'token'` on a deploy outcome are the two places that is true. An
+ * unsigned step is an attacker-supplied instruction wearing the issuer's voice.
+ *
+ * Shape and closed action set: coderifts-app schemas/decision-result.v1.producer.json,
+ * properties.next_agent_step (required action / reason / resume_condition / then_call;
+ * additionalProperties false). Mirrors contract-gate 0.8.0 `readNextAgentStep`.
+ *
+ * NOT PERMISSION: this is the decision's remediation suggestion, not permission; branch on
+ * execution_action.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NEXT_STEP_NOTE = exports.NEXT_AGENT_ACTIONS = void 0;
+exports.readNextAgentStep = readNextAgentStep;
+/** The closed action set the issuer projects (producer schema enum). */
+exports.NEXT_AGENT_ACTIONS = [
+    're_preflight', 'revert', 'migrate', 'escalate', 'await_approval',
+];
+/**
+ * Read the step from a decision envelope. A step without a non-empty `action` is not a
+ * step (same rule as contract-gate): the action is the only field a reader can act on,
+ * so a step missing it would render as guidance that says nothing.
+ *
+ * Pure. Never throws. Returns null for anything that is not an object with an action.
+ */
+function readNextAgentStep(envelope) {
+    if (!envelope || typeof envelope !== 'object')
+        return null;
+    const raw = envelope.next_agent_step;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const step = raw;
+    if (typeof step.action !== 'string' || step.action.length === 0)
+        return null;
+    return step;
+}
+/**
+ * The one fixed sentence every CodeRifts surface prints beside a rendered step.
+ * Byte-identical to contract-gate 0.8.0 `nextStepBlock`. It is not from the server:
+ * the step is a suggestion, and execution_action remains the thing to branch on.
+ */
+exports.NEXT_STEP_NOTE = "This is the decision's remediation suggestion, not permission; branch on execution_action.";
+//# sourceMappingURL=next-agent-step.js.map

package/dist/cjs/next-agent-step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-agent-step.js","sourceRoot":"","sources":["../../src/next-agent-step.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AA6BH,8CAOC;AAlCD,wEAAwE;AAC3D,QAAA,kBAAkB,GAAG;IAChC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB;CACzD,CAAC;AAiBX;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,QAAiB;IACjD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAI,QAA0C,CAAC,eAAe,CAAC;IACxE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,IAAI,GAAG,GAA8B,CAAC;IAC5C,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACU,QAAA,cAAc,GACzB,4FAA4F,CAAC"}

package/dist/cjs/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,kMAAkM;AAClM,eAAO,MAAM,aAAa,qFAC0D,CAAC;AAErF,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,EAAE,MAAg3I,CAAC;AAEh5I,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,sPACsN,CAAC;AAEtP,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAiBF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAEpF;AAQD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC;AAC5E,wBAAgB,UAAU,CAAC,CAAC,SAAS,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,CAAC,EAAE,CAAC;AAgCxG,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,IAAI,CAI3C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAIrF;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,kMAAkM;AAClM,eAAO,MAAM,aAAa,qFAC0D,CAAC;AAErF,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,EAAE,MAAqkJ,CAAC;AAErmJ,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,sPACsN,CAAC;AAEtP,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAiBF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAGhF;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAEpF;AAQD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC;AAC5E,wBAAgB,UAAU,CAAC,CAAC,SAAS,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,CAAC,EAAE,CAAC;AAgCxG,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,IAAI,CAI3C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAIrF;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/cjs/policy.js

@@ -20,7 +20,7 @@ exports.resetPolicyWarnForTests = resetPolicyWarnForTests;
 /** Phrase present in ALL seven generated host formats (AGENTS.md, CLAUDE.md, cursor rules, Copilot instructions, LangGraph policy, OpenAI agent instructions, skills/api-governance/SKILL.md). */
 exports.POLICY_MARKER = "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy.";
 /** Canonical policy body (paragraphs joined by blank lines). */
-exports.CODERIFTS_POLICY = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \"proceed with caution\" without monitoring.\n\nDo not call CodeRifts tools for a documentation-only change (README, guides, comments) with no contract artifact content change.\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent's tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational (`may_execute` is always false) and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:\"server\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \"authorized, commit not proven\".";
+exports.CODERIFTS_POLICY = "Call `preflight_change_set` before merge, deploy, publish, or tool registration when a contract artifact changed (OpenAPI/Swagger, GraphQL, gRPC/protobuf, AsyncAPI, MCP manifest, or agent tool schemas).\n\nSend the complete base-to-head change set: every changed contract artifact with full before and after content. Do not send a single-file subset when other contract files also change.\n\nBranch on `execution_action` only. Do not branch on `decision` and do not branch on `safe_for_agent` (not_for_control_flow_use_execution_action). Canonical `execution_action` values: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP.\n\nAn unrecognised `execution_action` is not permission: fail closed (halt or re-preflight). Well-known code: `not_permission_fail_closed`.\n\nWhen `execution_action` is REQUEST_APPROVAL or STOP, surface the detected patterns and the blast radius, and propose the safer path \u2014 deprecate-then-remove, an additive change, or a new version \u2014 rather than shipping the break.\n\n`CONTINUE_WITH_MONITORING` requires a wired monitoring sink (`monitoringSinkWired`). It is not \"proceed with caution\" without monitoring.\n\nDo not call `preflight_change_set` for: a documentation-only change (README, guides, comments) with no contract artifact content change; a static readiness score (a different capability, not a change-set decision); or to verify a receipt you already hold (that is `verify_receipt` \u2014 see the companion-tools rule).\n\nIf you already hold a chain receipt and only need authenticity/lifecycle: `verify_receipt`. If you need a past decision by id: `get_decision_details`. Neither replaces preflight for a new change set.\n\nThe CodeRifts MCP server exposes exactly three tools \u2014 `preflight_change_set`, `verify_receipt`, `get_decision_details`. Do not invent or assume others.\n\nA receipt authorizes ONE operation: a merge receipt does not authorize a deploy. Before a different operation (deploy, publish), call `preflight_change_set` with `context.operation` set to that operation \u2014 reusing a differently-scoped receipt is not permitted and will fail at the gate.\n\nA stale or superseded receipt on a changed head requires a NEW preflight \u2014 `verify_receipt` cannot re-diff.\n\nFor mutating tools, put only the guarded version in the agent's tool table; keep the raw handler host-only and unreachable from that table. How you name tools is yours \u2014 this is a reachability property, not a product rename of host tools. CodeRifts cannot see or stop a raw call the host makes outside the table it returns; adopt this as a host convention, not as a guarantee from the package.\n\nCodeRifts reports a governance decision and `execution_action`; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.\n\nTo act (mutate a contract, merge, deploy, or publish): call `preflight_change_set` with `preflight_mode` authorize. Analyze is informational \u2014 risk only, `may_execute` is always false \u2014 and is not permission. Read `execution_action` on the `decision_result` envelope.\n\nBefore acting under a held receipt: call `verify_receipt` with the intended `context` (operation, environment, repository, branch, pull_request) for THIS attempt. Do not act on a receipt whose scope does not match.\n\nAct only when `currently_authorized` is true (`control_envelope.receipt_view.currently_authorized`). A valid-looking token is not permission if `currently_authorized` is false or omitted.\n\nCommit / CAS evidence is a separate measurement (`commit_observation` on GuardOutcome). It is not a substitute for authorize + `currently_authorized`. Production hosts that want the fail-closed conjunction lock it with `profile: ENFORCING_STRICT` on withCodeRifts.\n\nIf the host requests an execution grant (opt-in `include_execution_grant`), the grant is bound to operation + target + after-payload (`scope_hash`) and is short-lived \u2014 never reuse it after the after-payload changes.\n\nAn ATOMIC-profile grant carries `state_nonce` and is single-use at the executor \u2014 if the executor has consumed the nonce, re-preflight; do not retry the same grant.\n\nWith a proven tenant\u2194repo binding you may request `derivation:\"server\"` instead of assembling `artifacts[]` yourself (`context.repository` + `context.base` + `context.head` required; caller-supplied artifacts are rejected on that path).\n\nA commit is only proven when an executor attestation verifies (customer-held executor key, `cas_evidence: executor_attested`); otherwise say \"authorized, commit not proven\".";
 /** Once-per-process warning when the host supplied a prompt that lacks the marker. */
 exports.POLICY_ABSENT_WARN = "CodeRifts policy text not detected in the system prompt. The agent will still see the tools, but measured evidence shows operation-scope misuse is markedly more likely without it. See https://github.com/coderifts/agent-guard#policy-delivery.";
 function textHasMarker(text) {

package/dist/cjs/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAkDH,4CAGC;AAGD,oDAEC;AAeD,gCAuBC;AASD,oDAIC;AAMD,sDAIC;AAGD,0DAEC;AA1HD,kMAAkM;AACrL,QAAA,aAAa,GACxB,kFAAkF,CAAC;AAErF,gEAAgE;AACnD,QAAA,gBAAgB,GAAW,u2IAAu2I,CAAC;AAEh5I,sFAAsF;AACzE,QAAA,kBAAkB,GAC7B,mPAAmP,CAAC;AAmBtP,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAa,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,OAAkC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAA+B;IAC9D,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,wBAAgB,CAAC;IACpD,OAAO,QAAQ,GAAG,MAAM,GAAG,wBAAgB,CAAC;AAC9C,CAAC;AASD,SAAgB,UAAU,CACxB,KAAwC,EACxC,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,KAAK,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yFAAyF;QACzF,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAgB,oBAAoB;IAClC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,0BAAkB,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAA+B;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,QAAQ;QAAE,oBAAoB,EAAE,CAAC;IAClD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oDAAoD;AACpD,SAAgB,uBAAuB;IACrC,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAkDH,4CAGC;AAGD,oDAEC;AAeD,gCAuBC;AASD,oDAIC;AAMD,sDAIC;AAGD,0DAEC;AA1HD,kMAAkM;AACrL,QAAA,aAAa,GACxB,kFAAkF,CAAC;AAErF,gEAAgE;AACnD,QAAA,gBAAgB,GAAW,4jJAA4jJ,CAAC;AAErmJ,sFAAsF;AACzE,QAAA,kBAAkB,GAC7B,mPAAmP,CAAC;AAmBtP,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAa,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,OAAkC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAA+B;IAC9D,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,SAAgB,oBAAoB,CAAC,IAA+B;IAClE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,wBAAgB,CAAC;IACpD,OAAO,QAAQ,GAAG,MAAM,GAAG,wBAAgB,CAAC;AAC9C,CAAC;AASD,SAAgB,UAAU,CACxB,KAAwC,EACxC,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,KAAK,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yFAAyF;QACzF,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAgB,oBAAoB;IAClC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,0BAAkB,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAA+B;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,QAAQ;QAAE,oBAAoB,EAAE,CAAC;IAClD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oDAAoD;AACpD,SAAgB,uBAAuB;IACrC,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC"}

package/dist/cjs/posture-receipt.d.ts

@@ -48,6 +48,19 @@ export type PostureReceiptPayload = {
     verdict?: string;
     facts?: unknown;
     drift?: unknown;
+    /**
+     * The credential-boundary tuple (AUDIT P1 / RES-3).
+     *
+     * MEASURED: the issuer (capability-demo demo/src/posture.js) emits these as
+     * OPTIONAL reserved body fields — only non-empty strings are spread in, so a
+     * receipt may legitimately carry none of them. They are part of the signed
+     * body when present, which is what makes binding them here meaningful rather
+     * than decorative.
+     */
+    executor_id?: string;
+    adapter_id?: string;
+    target_uri?: string;
+    policy_hash?: string;
 };
 export type PostureVerifyInput = {
     /** Well-known-shaped registry `{ keys: [{ kid, public_key_pem, status, … }] }`. */
@@ -56,6 +69,22 @@ export type PostureVerifyInput = {
     pinnedKeyPem?: string;
     /** The receipt must be bound to THIS deployment. */
     expectedDeploymentId?: string;
+    /**
+     * The credential-boundary tuple this receipt must bind (AUDIT P1 / RES-3).
+     *
+     * Each is INDEPENDENTLY opt-in, and each behaves like expectedDeploymentId:
+     * supply it and the receipt must carry a matching value or the verify fails
+     * closed with POSTURE_UNBOUND.
+     *
+     * A field you do NOT supply is NOT silently ignored — the result's
+     * `bound` / `not_bound` lists say exactly which parts of the tuple this
+     * verification actually proved. A receipt that binds nothing still verifies
+     * as a signature; it just does not get to claim a boundary it never named.
+     */
+    expectedExecutorId?: string;
+    expectedAdapterId?: string;
+    expectedTargetUri?: string;
+    expectedPolicyHash?: string;
     /** Caller-supplied freshness window in ms. NO DEFAULT — see the header. */
     maxAgeMs?: number;
     /** Injectable clock for tests. Defaults to Date.now. */
@@ -68,6 +97,16 @@ export type PostureVerifyResult = {
     payload?: PostureReceiptPayload;
     /** Age in ms at verification time, when it could be computed. */
     age_ms?: number;
+    /**
+     * Which credential-boundary fields this verification actually BOUND, and
+     * which it did not. Named rather than implied: a caller reading `valid: true`
+     * must be able to see that a tuple it did not ask about was not checked.
+     */
+    bound?: string[];
+    not_bound?: Array<{
+        field: string;
+        reason: string;
+    }>;
 };
 /**
  * Verify a posture receipt token.

package/dist/cjs/posture-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture-receipt.d.ts","sourceRoot":"","sources":["../../src/posture-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAG,uBAAgC,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,2BAA2B,GAC3B,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AA6CF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,kBAAuB,GAC7B,mBAAmB,CAyGrB"}
+{"version":3,"file":"posture-receipt.d.ts","sourceRoot":"","sources":["../../src/posture-receipt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAG,uBAAgC,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,2BAA2B,GAC3B,iBAAiB,GACjB,eAAe,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD,CAAC;AA6CF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,kBAAuB,GAC7B,mBAAmB,CAiJrB"}

package/dist/cjs/posture-receipt.js

@@ -144,6 +144,41 @@ function verifyPostureReceipt(token, input = {}) {
             return fail('POSTURE_UNBOUND', 'deployment_id_mismatch', { payload });
         }
     }
+    // ── CREDENTIAL-BOUNDARY TUPLE (AUDIT P1 / RES-3) ───────────────────────────
+    // atomic-profile.ts used to say, in its own comment, that a V2 receipt binds
+    // "NOT executor_id, adapter_id, target_uri or policy_hash". Each is now bound
+    // when the caller names it — same mechanism as the deployment above, so a
+    // receipt for the RIGHT deployment but the WRONG executor no longer passes.
+    //
+    // An expectation the caller does not state is recorded in `not_bound`, never
+    // defaulted to a value that would make it look checked.
+    const bound = [];
+    const notBound = [];
+    const tuple = [
+        ['executor_id', input.expectedExecutorId, 'executor_id'],
+        ['adapter_id', input.expectedAdapterId, 'adapter_id'],
+        ['target_uri', input.expectedTargetUri, 'target_uri'],
+        ['policy_hash', input.expectedPolicyHash, 'policy_hash'],
+    ];
+    for (const [field, expected, label] of tuple) {
+        if (typeof expected !== 'string' || expected.length === 0) {
+            notBound.push({
+                field: label,
+                reason: 'the caller did not state an expected value, so this verification did not check it',
+            });
+            continue;
+        }
+        const actual = payload[field];
+        if (typeof actual !== 'string' || actual.length === 0) {
+            // The caller asked for a binding the receipt cannot supply. That is a
+            // refusal, not a pass: a missing field is not a matching one.
+            return fail('POSTURE_UNBOUND', `${label}_absent`, { payload, bound, not_bound: notBound });
+        }
+        if (actual !== expected) {
+            return fail('POSTURE_UNBOUND', `${label}_mismatch`, { payload, bound, not_bound: notBound });
+        }
+        bound.push(label);
+    }
     // FRESHNESS. maxAgeMs is the CALLER's window; there is no receipt-carried
     // expiry to fall back on, so an absent maxAgeMs means the caller did not ask
     // for an age check — not that the receipt is timeless.
@@ -176,6 +211,10 @@ function verifyPostureReceipt(token, input = {}) {
         reason: null,
         payload,
         ...(ageMs === undefined ? {} : { age_ms: ageMs }),
+        // What this PASS actually proved about the credential boundary — and what
+        // it did not. A caller must not have to infer the difference.
+        bound,
+        not_bound: notBound,
     };
 }
 //# sourceMappingURL=posture-receipt.js.map

package/dist/cjs/posture-receipt.js.map

@@ -1 +1 @@
-{"version":3,"file":"posture-receipt.js","sourceRoot":"","sources":["../../src/posture-receipt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AAwGH,oDA4GC;AAlND,6CAAsE;AAGzD,QAAA,iBAAiB,GAAG,uBAAgC,CAAC;AAYlE;;;GAGG;AACU,QAAA,+BAA+B,GAAG,KAAK,CAAC;AAsCrD;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,6BAAe,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAClE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,6BAAe,EAAC,KAAK,CAAC,cAAwB,CAAC,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACd,QAAsC,EAAE,EACnB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,KAAc,EACd,QAA4B,EAAE;IAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAiB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,MAAM,KAAK,qBAAqB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAEzB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,oBAAY,EAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IAE3E,8EAA8E;IAC9E,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA0B,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,cAAc,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;WACxE,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,iGAAiG;IACjG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI;WACpE,OAAO,CAAC,CAAC,KAAK,yBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5F,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,eAAe,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAChD,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,GAAG,GAAG,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,uCAA+B,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,eAAe,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,eAAe,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI;QACZ,OAAO;QACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"posture-receipt.js","sourceRoot":"","sources":["../../src/posture-receipt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AA4IH,oDAoJC;AA9RD,6CAAsE;AAGzD,QAAA,iBAAiB,GAAG,uBAAgC,CAAC;AAYlE;;;GAGG;AACU,QAAA,+BAA+B,GAAG,KAAK,CAAC;AA0ErD;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAW,EACX,QAAyC,EACzC,YAAgC;IAEhC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,6BAAe,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAClE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,6BAAe,EAAC,KAAK,CAAC,cAAwB,CAAC,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACd,QAAsC,EAAE,EACnB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,KAAc,EACd,QAA4B,EAAE;IAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAiB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,MAAM,KAAK,qBAAqB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAEzB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,oBAAY,EAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC;IAE3E,8EAA8E;IAC9E,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA0B,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,cAAc,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,qFAAqF;IACrF,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;WACxE,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,iGAAiG;IACjG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,IAAI;WACpE,OAAO,CAAC,CAAC,KAAK,yBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5F,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAA6C,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAqE;QAC9E,CAAC,aAAa,EAAE,KAAK,CAAC,kBAAkB,EAAE,aAAa,CAAC;QACxD,CAAC,YAAY,EAAE,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC;QACrD,CAAC,YAAY,EAAE,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC;QACrD,CAAC,aAAa,EAAE,KAAK,CAAC,kBAAkB,EAAE,aAAa,CAAC;KACzD,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,mFAAmF;aAC5F,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,KAAK,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,eAAe,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAChD,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,GAAG,GAAG,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,EAAE,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,uCAA+B,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,eAAe,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,eAAe,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI;QACZ,OAAO;QACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACjD,0EAA0E;QAC1E,8DAA8D;QAC9D,KAAK;QACL,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC"}

package/dist/cjs/types.d.ts

@@ -157,6 +157,22 @@ export interface GuardConfig {
      * Observation-only on the outcome (`requested` / `arrived`); not a verdict/preimage field.
      */
     executionGrant?: import('./execution-grant.js').ExecutionGrantConfig;
+    /**
+     * THE CANONICAL V2 IDENTITY (roadmap 1198). One home, read by BOTH halves:
+     * the authorize request (execution-grant.ts v2WireFields) and the ATOMIC
+     * construction check / posture tuple (atomic-profile.ts).
+     *
+     * withCodeRifts resolves its input onto these before building the guard, so a
+     * direct guardToolCall caller and a withCodeRifts composition hand
+     * v2WireFields an identically-shaped config. `executionGrant.<same name>` is a
+     * deprecated alias; setting both with different values throws at init.
+     */
+    executorId?: string;
+    adapterId?: string;
+    targetUri?: string;
+    tenantId?: string;
+    policyHash?: string;
+    audienceHash?: string;
 }
 export interface ToolCallDescriptor {
     toolName: string;
@@ -290,6 +306,29 @@ export type GuardOutcome<T> = GuardOutcomeCore<T> & import('./auto-recheck.js').
      * Not a verdict input; not a preimage field.
      */
     execution_grant?: import('./execution-grant.js').ExecutionGrantObservation;
+    /**
+     * deny-remedy.v1 — the machine-readable next step for a refusal the guard
+     * reached before the factory ran. Present only when the refusal maps to one
+     * of the three grant error classes; absent otherwise, and absent on every
+     * executed outcome. Additive: not a verdict input, not a preimage field.
+     */
+    remedy?: import('./deny-remedy.js').DenyRemedy;
+    /**
+     * I-1288f — the DECISION's own remediation suggestion, lifted verbatim from the
+     * `decision_result` envelope. Distinct from `remedy`: that one names THIS GUARD's
+     * refusal class (the grant is missing / invalid / unavailable), this one is what
+     * the issuer signed about the change itself. They can co-occur.
+     *
+     * PRESENT ONLY WHEN `verdict.receiptVerified` IS TRUE. The envelope arrives over
+     * the network; without a verified receipt nothing in this process checked a
+     * signature over the step, and unverified guidance carrying the issuer's voice is
+     * exactly the thing this package refuses to emit. Absent on SKIPPED / UNAVAILABLE
+     * (no envelope), on every executed outcome, and when the envelope carried none.
+     *
+     * NOT PERMISSION: branch on `verdict.action`, never on this. Additive — not a
+     * verdict input, not a preimage field.
+     */
+    next_step?: import('./next-agent-step.js').NextAgentStep;
 };
 export type GuardVerdict = {
     kind: 'ALLOW';

package/dist/cjs/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEnG,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAInG,MAAM,MAAM,uBAAuB,GACjC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,0BAA0B,EAAE,cAAc,CAAC;IACnE,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qGAAqG;IACrG,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;IAClD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,gBAAgB,EAAE,oBAAoB,CAAC;IACpE;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,0BAA0B,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,iBAAiB,CAAC;IAC5D;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,kBAAkB,EAAE,gBAAgB,CAAC;IACnE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;IAC/E;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,6BAA6B,EAAE,2BAA2B,CAAC;IAC1F;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IACrE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,sBAAsB,EAAE,oBAAoB,CAAC;CACtE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;AAEjG,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAC9B,QAAQ,EAAE,sBAAsB,GAAG,IAAI,EACvC,YAAY,EAAE,kBAAkB,EAChC,SAAS,CAAC,EAAE,yBAAyB,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAIhB,MAAM,MAAM,eAAe,GACzB,CAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAAE,GAC3F;IAAE,eAAe,EAAE,IAAI,CAAA;CAAE,CAAC;AAG9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvH,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG,2BAA2B,CAAC;AAEtF,KAAK,gBAAgB,CAAC,CAAC,IAEnB;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAc,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE9S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnT,gGAAgG;AAChG,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAC7C,OAAO,mBAAmB,EAAE,kBAAkB,GAC9C,OAAO,kBAAkB,EAAE,qBAAqB,GAChD;IAAE,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAA;CAAE,GAC7D;IACA;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IAC1D,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD,uGAAuG;IACvG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,aAAa,EAAE,cAAc,CAAC;IACvD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IACtE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;CAC5E,CAAC;AASJ,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,UAAU,CAAC;IAAiB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAS,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,MAAM,CAAC;IAAqB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,qBAAqB,CAAC;IAAM,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACpG,kBAAkB,CAAC;AAIvB,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IACnD,eAAe,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG,CAEpD;IAAE,KAAK,EAAE,cAAc,CAAC;IAAI,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAEpG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAC5E,MAAM,EAAE,UAAU,GAAG,0BAA0B,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,CAC5F,CAAC;AAKF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,cAAc,CAAC;AACxF,MAAM,MAAM,cAAc,GACxB,kBAAkB,GAAG,qBAAqB,GAAG,gBAAgB,GAC3D,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GACxD,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAE3B,uBAAuB,GACvB,+BAA+B,GAC/B,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,oBAAoB,GACpB,0BAA0B,GAC1B,oBAAoB,GACpB,kBAAkB,GAClB,4BAA4B,GAC5B,uBAAuB,GACvB,8BAA8B,GAC9B,oCAAoC,GACpC,yBAAyB,GACzB,oBAAoB,CAAA;AACxB,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAIlE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAC7B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CACtF;AAED,MAAM,WAAW,QAAQ;IAIvB,GAAG,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,iBAAiB,GAAC,kBAAkB,GAAC,uBAAuB,GAC7D,gBAAgB,GAAC,mBAAmB,GAAC,mBAAmB,GACxD,qBAAqB,GAAC,oBAAoB,GAAC,0BAA0B,GAAC,oBAAoB,GAC1F,iBAAiB,GAAC,0BAA0B,GAAC,eAAe,GAC5D,0BAA0B,GAC1B,gCAAgC,GAChC,mCAAmC,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxD,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE;AAClD,oGAAoG;GAClG;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC/F;;;;GAIG;GACD;IAAE,IAAI,EAAE,8BAA8B,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACtE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAC1F,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,+GAA+G;GAC7G;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAChE;;;GAGG;GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC1E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AACpE;;;GAGG;GACD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEnG,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAInG,MAAM,MAAM,uBAAuB,GACjC,sBAAsB,GAAG;IAAE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,kBAAkB,CAAC;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,0BAA0B,EAAE,cAAc,CAAC;IACnE,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qGAAqG;IACrG,OAAO,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;IAClD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,gBAAgB,EAAE,oBAAoB,CAAC;IACpE;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,0BAA0B,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,iBAAiB,CAAC;IAC5D;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,kBAAkB,EAAE,gBAAgB,CAAC;IACnE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;IAC/E;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,6BAA6B,EAAE,2BAA2B,CAAC;IAC1F;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IACrE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,sBAAsB,EAAE,oBAAoB,CAAC;IACrE;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;AAEjG,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI,CAC9B,QAAQ,EAAE,sBAAsB,GAAG,IAAI,EACvC,YAAY,EAAE,kBAAkB,EAChC,SAAS,CAAC,EAAE,yBAAyB,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAIhB,MAAM,MAAM,eAAe,GACzB,CAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,CAAE,GAC3F;IAAE,eAAe,EAAE,IAAI,CAAA;CAAE,CAAC;AAG9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvH,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG,2BAA2B,CAAC;AAEtF,KAAK,gBAAgB,CAAC,CAAC,IAEnB;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAG,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAc,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE3S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAE9S;IAAE,kBAAkB,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,qBAAqB,CAAC;IAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnT,gGAAgG;AAChG,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAC7C,OAAO,mBAAmB,EAAE,kBAAkB,GAC9C,OAAO,kBAAkB,EAAE,qBAAqB,GAChD;IAAE,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAA;CAAE,GAC7D;IACA;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,sBAAsB,EAAE,WAAW,CAAC;IAC1D,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACnD,uGAAuG;IACvG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,aAAa,EAAE,cAAc,CAAC;IACvD;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,wBAAwB,EAAE,gBAAgB,CAAC;IACtE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,sBAAsB,EAAE,yBAAyB,CAAC;IAC3E;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,kBAAkB,EAAE,UAAU,CAAC;IAC/C;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,sBAAsB,EAAE,aAAa,CAAC;CAC1D,CAAC;AASJ,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,UAAU,CAAC;IAAiB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAS,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,OAAO,CAAC;IAAI,MAAM,EAAE,MAAM,CAAC;IAAqB,QAAQ,EAAE,sBAAsB,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GACpH;IAAE,IAAI,EAAE,SAAS,CAAC;IAAE,MAAM,EAAE,qBAAqB,CAAC;IAAM,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACpG,kBAAkB,CAAC;AAIvB,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IACnD,eAAe,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG,CAEpD;IAAE,KAAK,EAAE,cAAc,CAAC;IAAI,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,QAAQ,GAAC,MAAM,GAAC,KAAK,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAErG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAEpG;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAC5E,MAAM,EAAE,UAAU,GAAG,0BAA0B,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,CAC5F,CAAC;AAKF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,GAAG,cAAc,CAAC;AACxF,MAAM,MAAM,cAAc,GACxB,kBAAkB,GAAG,qBAAqB,GAAG,gBAAgB,GAC3D,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GACxD,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAE3B,uBAAuB,GACvB,+BAA+B,GAC/B,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,oBAAoB,GACpB,0BAA0B,GAC1B,oBAAoB,GACpB,kBAAkB,GAClB,4BAA4B,GAC5B,uBAAuB,GACvB,8BAA8B,GAC9B,oCAAoC,GACpC,yBAAyB,GACzB,oBAAoB,CAAA;AACxB,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAIlE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAC7B;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CACtF;AAED,MAAM,WAAW,QAAQ;IAIvB,GAAG,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,iBAAiB,GAAC,kBAAkB,GAAC,uBAAuB,GAC7D,gBAAgB,GAAC,mBAAmB,GAAC,mBAAmB,GACxD,qBAAqB,GAAC,oBAAoB,GAAC,0BAA0B,GAAC,oBAAoB,GAC1F,iBAAiB,GAAC,0BAA0B,GAAC,eAAe,GAC5D,0BAA0B,GAC1B,gCAAgC,GAChC,mCAAmC,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxD,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE;AAClD,oGAAoG;GAClG;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACxE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC/F;;;;GAIG;GACD;IAAE,IAAI,EAAE,8BAA8B,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IACtE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAC1F,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,+GAA+G;GAC7G;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAChE;;;GAGG;GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC1E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AACpE;;;GAGG;GACD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/cjs/with-coderifts.d.ts

@@ -319,9 +319,24 @@ export type WithCodeRiftsInput = {
     executorAttestation?: GuardConfig['executorAttestation'];
     /** ATOMIC: explicit mutator register (replaces isWriteStyleCall for this profile only). */
     mutatorRegister?: MutatorRegister;
+    /**
+     * THE CANONICAL V2 IDENTITY (1198). These bind the ATOMIC construction check
+     * and the posture receipt, AND they are what goes on the authorize request —
+     * one source for both. `executionGrant.<same name>` is a deprecated alias;
+     * setting both with different values throws at init (resolveV2Fields).
+     */
     executorId?: string;
     adapterId?: string;
     targetUri?: string;
+    /**
+     * Added here in 1198. policyHash had a reader (atomic-profile.ts passes it to
+     * the posture verifier) and no writer on this path, so the binding was
+     * permanently undefined; tenantId and audienceHash existed on the wire side
+     * only. All three now have the same single home as the other three.
+     */
+    tenantId?: string;
+    policyHash?: string;
+    audienceHash?: string;
     casAdapter?: unknown;
     readBack?: (ctx: unknown) => unknown;
     credentialBoundary?: true | Record<string, unknown>;
@@ -403,6 +418,27 @@ export type ReceiptThreadHandle = {
      */
     lastSkipReason: () => ReceiptCursorSkipReason | null;
 };
+/**
+ * The unversioned spelling still resolves to `_V1`, and always will — see the type doc above:
+ * re-pointing it at a future `_V2` would silently move every existing caller, which is the
+ * migration this design refuses.
+ *
+ * SO THIS NOTICE PROMISES NOTHING. It does not say deprecated, it does not name a removal
+ * version, and it must not: the alias is permanent by design, and a notice announcing a removal
+ * that will never happen is a false statement shipped to every consumer on the alias. What it
+ * does is point at the name that carries the version, so a caller who wants the guarantee the
+ * suffix gives can ask for it by name.
+ *
+ * ONCE PER PROCESS, and the flag is module-level for the same reason `policy.ts` uses one: a
+ * per-call notice on a construction path that a host may run per request is noise, and noise is
+ * how a line stops being read.
+ *
+ * The wire value is untouched. `GUARD_PROFILE_WIRE_VALUE` stays the suffix-less string that four
+ * downstream modules compare against; this observes the spelling, it does not rewrite it.
+ */
+export declare const UNVERSIONED_PROFILE_NOTICE = "ENFORCING_STRICT is the unversioned spelling of ENFORCING_STRICT_V1; prefer the versioned name.";
+/** Test-only reset. Exported so a test can assert the once-per-process behaviour more than once. */
+export declare function _resetUnversionedProfileNoticeForTest(): void;
 /**
  * Wrap guardToolRegistry with a mandatory operation and a separately-computed composition assurance.
  * Fails at CONSTRUCTION (never at first tool call) for a missing client, a missing/empty operation, an