@coderifts/agent-guard 3.0.1 → 4.1.0

package/dist/cjs/deploy-bind.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * bindDeploy — pure deploy-TIME composition over deployGate (#8).
+ *
+ * Why this exists: deployGate is the pure decision; nothing in this package used to
+ * invoke it at the moment of deploying. The merge gate has the same shape
+ * (gateDecision is pure; GitHub enforces via required checks the package does not
+ * control). Deploy generalises that pattern with two differences:
+ *   1. There is no pull request / required status check to hang on — the host must
+ *      call this from the CD step itself.
+ *   2. The environment name is a HOST ASSERTION. The receipt's bound_environment is
+ *      signed evidence; the deploy target's environment string is not verified by us.
+ *      A host can claim "staging" while deploying to production. The output says so.
+ *
+ * This module performs NO I/O, does NOT re-verify receipts, and does NOT act on a
+ * pipeline. pipeline_action is always 'not_observed'. inescapable_deploy still comes
+ * only from deployGate (ENFORCING ∧ ¬bypass) — never flipped here.
+ *
+ * External note: coderifts-app CLI `deploy-gate` historically inlined a similar bind
+ * (deployBind). That is a consumer; this is the package-local pure entry hosts should
+ * call so the decision logic has a first-class caller in-repo.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_REPAIRABLE_REASONS = void 0;
+exports.bindDeploy = bindDeploy;
+const deploy_gate_js_1 = require("./deploy-gate.js");
+/** Reasons a fresh re-preflight for this { env, artifact } can repair. */
+const REPAIRABLE = new Set([
+    'env_mismatch',
+    'stale_artifact',
+    'operation_mismatch',
+    'receipt_not_authorized',
+    'fingerprint_mismatch',
+    'body_hash_mismatch',
+    'no_receipt',
+    'inputs_incomplete',
+]);
+exports.DEPLOY_REPAIRABLE_REASONS = REPAIRABLE;
+function asHostAssertedEnvironment(env) {
+    if (typeof env === 'string') {
+        return { name: env, provenance: 'host_asserted' };
+    }
+    const name = env && typeof env.name === 'string' ? env.name : '';
+    // Force provenance — a host cannot pass provenance: 'verified' through this API.
+    return { name, provenance: 'host_asserted' };
+}
+/**
+ * Pure deploy-time entry: bind host claims + finished receipt view into deployGate.
+ *
+ * @example
+ * ```ts
+ * const r = bindDeploy({
+ *   environment: { name: 'production', provenance: 'host_asserted' },
+ *   artifact_id: digest,
+ *   receipt: receiptView,
+ *   pipeline_enforcement: { enforcement: 'ENFORCING', bypass_possible: false },
+ * });
+ * // r.decision_allows_deploy — decision only
+ * // r.pipeline_action === 'not_observed' — we did not enforce
+ * // r.environment.provenance === 'host_asserted' — we did not verify the target name
+ * if (!r.decision_allows_deploy) process.exit(1); // host pipeline chooses to honour
+ * ```
+ */
+function bindDeploy(input) {
+    const environment = asHostAssertedEnvironment(input.environment);
+    const artifact_id = input.artifact_id == null ? '' : String(input.artifact_id);
+    const operation = input.operation ?? 'deploy';
+    const deployTarget = {
+        environment: environment.name,
+        artifact_id,
+        ...(input.service != null ? { service: input.service } : {}),
+        ...(input.pipeline_run_id != null ? { pipeline_run_id: input.pipeline_run_id } : {}),
+    };
+    const requiredContext = {
+        operation,
+        enforcement: input.pipeline_enforcement || { enforcement: 'UNKNOWN', bypass_possible: true },
+        ...(input.service != null ? { service: input.service } : {}),
+        ...(input.expected_fingerprint != null
+            ? { expected_fingerprint: input.expected_fingerprint }
+            : {}),
+        ...(input.expected_body_hash != null
+            ? { expected_body_hash: input.expected_body_hash }
+            : {}),
+        ...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
+        ...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),
+        ...(input.allowPrefixCompare != null
+            ? { allowPrefixCompare: input.allowPrefixCompare }
+            : {}),
+    };
+    const gate = (0, deploy_gate_js_1.deployGate)({
+        deployTarget,
+        receipt: input.receipt,
+        requiredContext,
+        ...(input.allowPending != null ? { allowPending: input.allowPending } : {}),
+        ...(input.allowWarnDeploy != null ? { allowWarnDeploy: input.allowWarnDeploy } : {}),
+        ...(input.allowPrefixCompare != null
+            ? { allowPrefixCompare: input.allowPrefixCompare }
+            : {}),
+    });
+    return {
+        gate,
+        decision_allows_deploy: gate.deploy_allowed === true,
+        deploy_check_status: gate.state,
+        reason: gate.reason,
+        must_re_preflight: REPAIRABLE.has(gate.reason),
+        environment, // always provenance: 'host_asserted'
+        artifact_id,
+        pipeline_action: 'not_observed',
+        inescapable_deploy: gate.inescapable_deploy === true,
+    };
+}
+//# sourceMappingURL=deploy-bind.js.map

package/dist/cjs/deploy-bind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-bind.js","sourceRoot":"","sources":["../../src/deploy-bind.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAoIH,gCAmDC;AArLD,qDAQ0B;AAE1B,0EAA0E;AAC1E,MAAM,UAAU,GAAkC,IAAI,GAAG,CAAC;IACxD,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAC;AAmKoB,+CAAyB;AA/EhD,SAAS,yBAAyB,CAAC,GAAqC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,iFAAiF;IACjF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,UAAU,CAAC,KAAsB;IAC/C,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC;IAE9C,MAAM,YAAY,GAAiB;QACjC,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,WAAW;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IAEF,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,EAAE,WAAW,EAAE,SAAkB,EAAE,eAAe,EAAE,IAAI,EAAE;QACrG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAI;YACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,IAAI,GAAG,IAAA,2BAAU,EAAC;QACtB,YAAY;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,IAAI;YAClC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,sBAAsB,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QACpD,mBAAmB,EAAE,IAAI,CAAC,KAAK;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9C,WAAW,EAAE,qCAAqC;QAClD,WAAW;QACX,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI;KACrD,CAAC;AACJ,CAAC"}

package/dist/cjs/enforcement-gate.d.ts

@@ -1,7 +1,14 @@
 /**
  * Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
- * degraded) and §115 (safe_for_agent) in the guard, so the client never executes off a raw
- * execution_action an attacker/proxy can flip. All checks are LOCAL and fail-closed.
+ * degraded) and §115 (safe_for_agent) in the guard. All checks are LOCAL and fail-closed.
+ *
+ * Threat model (bounded): a raw execution_action is not trusted alone when the response has NO
+ * receipt — without a signed decision_body_hash, a proxy or intermediary can flip fields. When a
+ * receipt IS present, decision_body_hash covers the RFC 8785-canonical envelope (minus receipt and
+ * the hash field itself) and the receipt signature covers that hash, so execution_action cannot be
+ * flipped without the recomputed hash diverging or a forged signature. The gate still reconciles
+ * decision↔action locally (stricter wins), fails closed on a PRESENT-but-unrecognised action
+ * (version skew — not a missing-action fallback), and never treats an unknown value as permission.
  *
  * Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
  * itself; receipt-binding authenticates the envelope the decision rides on.
@@ -25,6 +32,8 @@ export type GateResult = {
 };
 /**
  * Reconcile an envelope's decision fail-closed. Order:
+ *  0. execution_action PRESENT but not in closed set         → EXECUTION_ACTION_UNRECOGNISED
+ *     (version skew; distinct from DECISION_INCONSISTENT — reconciliation is impossible)
  *  1. decision present + valid enum                          (CE-EP-04)   → DECISION_INCONSISTENT
  *  2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
  *     (CE-EP-01, CE-CC-01)  — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
@@ -34,9 +43,9 @@ export type GateResult = {
  *
  * @param response   the raw preflight response (for the top-level decision/action, CE-CC-01)
  * @param envelope   the decision_result envelope
- * @param executionAction  rd.executionAction from readDecision
+ * @param executionAction  rd.executionAction from readDecision (closed Action, or raw string if unrecognised)
  * @param sentArtifacts    the artifacts the guard sent to preflight (for the digest bind)
  */
-export declare function evaluateEnvelope(response: unknown, envelope: Record<string, unknown>, executionAction: Action, sentArtifacts: Artifact[]): GateResult;
+export declare function evaluateEnvelope(response: unknown, envelope: Record<string, unknown>, executionAction: Action | string, sentArtifacts: Artifact[]): GateResult;
 export {};
 //# sourceMappingURL=enforcement-gate.d.ts.map

package/dist/cjs/enforcement-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3D,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAoBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAKtE;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAkDZ"}
+{"version":3,"file":"enforcement-gate.d.ts","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3D,KAAK,MAAM,GAAG,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAoBpF,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMnE;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAKtE;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,eAAe,EAAE,MAAM,GAAG,MAAM,EAChC,aAAa,EAAE,QAAQ,EAAE,GACxB,UAAU,CAoEZ"}

package/dist/cjs/enforcement-gate.js

@@ -1,8 +1,15 @@
 "use strict";
 /**
  * Client-side authorization gate (P0-b/c) — mirrors the server §106 (binding), §111 (fail-closed on
- * degraded) and §115 (safe_for_agent) in the guard, so the client never executes off a raw
- * execution_action an attacker/proxy can flip. All checks are LOCAL and fail-closed.
+ * degraded) and §115 (safe_for_agent) in the guard. All checks are LOCAL and fail-closed.
+ *
+ * Threat model (bounded): a raw execution_action is not trusted alone when the response has NO
+ * receipt — without a signed decision_body_hash, a proxy or intermediary can flip fields. When a
+ * receipt IS present, decision_body_hash covers the RFC 8785-canonical envelope (minus receipt and
+ * the hash field itself) and the receipt signature covers that hash, so execution_action cannot be
+ * flipped without the recomputed hash diverging or a forged signature. The gate still reconciles
+ * decision↔action locally (stricter wins), fails closed on a PRESENT-but-unrecognised action
+ * (version skew — not a missing-action fallback), and never treats an unknown value as permission.
  *
  * Composes with the P0-a receipt binding (receipt-binding.ts). This module reconciles the DECISION
  * itself; receipt-binding authenticates the envelope the decision rides on.
@@ -45,6 +52,8 @@ function computeBundleFingerprint(artifacts) {
 }
 /**
  * Reconcile an envelope's decision fail-closed. Order:
+ *  0. execution_action PRESENT but not in closed set         → EXECUTION_ACTION_UNRECOGNISED
+ *     (version skew; distinct from DECISION_INCONSISTENT — reconciliation is impossible)
  *  1. decision present + valid enum                          (CE-EP-04)   → DECISION_INCONSISTENT
  *  2. effective decision = STRICTEST(envelope.decision, action-implied, top-level decision/action)
  *     (CE-EP-01, CE-CC-01)  — BLOCK/REQUIRE_APPROVAL → clean block (positive control CE-EP-02 kept)
@@ -54,18 +63,34 @@ function computeBundleFingerprint(artifacts) {
  *
  * @param response   the raw preflight response (for the top-level decision/action, CE-CC-01)
  * @param envelope   the decision_result envelope
- * @param executionAction  rd.executionAction from readDecision
+ * @param executionAction  rd.executionAction from readDecision (closed Action, or raw string if unrecognised)
  * @param sentArtifacts    the artifacts the guard sent to preflight (for the digest bind)
  */
 function evaluateEnvelope(response, envelope, executionAction, sentArtifacts) {
+    const top = (response && typeof response === 'object') ? response : {};
+    // 0. PRESENT-but-unrecognised action — before any decision map or reconciliation.
+    //    Missing action is not handled here (readDecision maps legacy missing → closed Action).
+    const candidates = [executionAction, envelope.execution_action, top.execution_action];
+    for (const cand of candidates) {
+        if (cand === undefined || cand === null || cand === '')
+            continue; // missing — skip
+        if (!isAction(cand)) {
+            return {
+                verdict: 'fail-closed',
+                cause: 'EXECUTION_ACTION_UNRECOGNISED',
+                detail: `execution_action=${JSON.stringify(cand)} is present but not in the closed set`,
+            };
+        }
+    }
     // 1. decision required + valid enum.
     const dec = envelope.decision;
     if (!isDecision(dec)) {
         return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${JSON.stringify(dec)} is missing/invalid` };
     }
+    // Known closed action from here (step 0 rejected unknowns).
+    const action = executionAction;
     // 2. Strictest of every decision signal present (envelope, action-implied, top-level).
-    const signals = [dec, ACTION_TO_DECISION[executionAction]];
-    const top = (response && typeof response === 'object') ? response : {};
+    const signals = [dec, ACTION_TO_DECISION[action]];
     if (isDecision(top.decision))
         signals.push(top.decision);
     if (isAction(top.execution_action))
@@ -76,8 +101,8 @@ function evaluateEnvelope(response, envelope, executionAction, sentArtifacts) {
         return { verdict: 'block-strict', decision: effective };
     }
     // (effective is ALLOW or WARN — but ALSO require the envelope's own action to agree, else tamper.)
-    if (DECISION_TO_ACTION[dec] !== executionAction) {
-        return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${dec} ≠ execution_action=${executionAction}` };
+    if (DECISION_TO_ACTION[dec] !== action) {
+        return { verdict: 'fail-closed', cause: 'DECISION_INCONSISTENT', detail: `decision=${dec} ≠ execution_action=${action}` };
     }
     // 3. §115 — safe_for_agent=false is NEVER executable, regardless of action.
     if (envelope.safe_for_agent === false) {

package/dist/cjs/enforcement-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA2BH,sDAMC;AAGD,4DAKC;AAqBD,4CAuDC;AAnHD,6CAAyC;AAMzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,sDAAsD;AAC1E,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,SAAgB,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,SAAgB,wBAAwB,CAAC,SAAqB;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAuB,EACvB,aAAyB;IAEzB,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,eAAe,EAAE,EAAE,CAAC;IACrI,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"enforcement-gate.js","sourceRoot":"","sources":["../../src/enforcement-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA2BH,sDAMC;AAGD,4DAKC;AAuBD,4CAyEC;AAvID,6CAAyC;AAMzC,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrG,MAAM,kBAAkB,GAA6B;IACnD,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO;CACzG,CAAC;AACF,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM;CACzG,CAAC;AACF,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,OAAO,CAAC;AACpF,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,MAAM,CAAC;AAC1G,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,sDAAsD;AAC1E,SAAS,SAAS,CAAC,CAAS,IAAY,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjH,wGAAwG;AACxG,SAAgB,qBAAqB,CAAC,SAAqB;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,UAAU,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,SAAgB,wBAAwB,CAAC,SAAqB;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,OAAO,UAAU,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,gBAAgB,CAC9B,QAAiB,EACjB,QAAiC,EACjC,eAAgC,EAChC,aAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,kFAAkF;IAClF,4FAA4F;IAC5F,MAAM,UAAU,GAAc,CAAC,eAAe,EAAE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS,CAAC,iBAAiB;QACnF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,KAAK,EAAE,+BAA+B;gBACtC,MAAM,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,uCAAuC;aACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;IAClI,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,eAAyB,CAAC;IAEzC,uFAAuF;IACvF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QAC/D,2FAA2F;QAC3F,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAyC,EAAE,CAAC;IAC1F,CAAC;IAED,mGAAmG;IACnG,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,uBAAuB,MAAM,EAAE,EAAE,CAAC;IAC5H,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAC/H,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAC;IAClD,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9D,QAAQ,CAAC,QAAQ,KAAK,IAAI;WAC1B,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC1G,CAAC;IAED,6FAA6F;IAC7F,sGAAsG;IACtG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;WACrD,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ;WAC5C,QAAQ,CAAC,eAAe,KAAK,qBAAqB,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACzI,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjF,CAAC"}

package/dist/cjs/execution-proof.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Guard-produced execution proof block.
+ *
+ * Assembled ONLY from state the guard itself observed while handling a call. Callers cannot supply
+ * fields into this object: builders take GuardOutcome-internal facts, not a host "proof" option.
+ * The returned object is deeply frozen so post-return mutation of proof fields is rejected.
+ *
+ * What this block proves (when the corresponding fields are present):
+ *  - preflight happened          → preflighted + decision_id
+ *  - receipt was fresh           → receipt.status === 'VERIFIED_CURRENT' + expires_at
+ *  - scope matched               → binds_to.operation + currently_authorized
+ *  - ran on the guarded path     → execution.enforced === true (runtime-asserted only with
+ *                                  receipt.verified + preflighted; same invariant the types encode)
+ *  - artifact checked vs executed → change_fp is WHAT WAS CHECKED; execution_result_hash is NOT a
+ *                                  general claim that the applied side effect matched that fp
+ *
+ * What this block must never claim: that the change is safe, that the host cannot bypass the
+ * package, or that an absent field means compliance. Those limits are explicit on every block.
+ */
+import type { GuardVerdict } from './types.js';
+/** Machine-readable schema id for this block. */
+export declare const EXECUTION_PROOF_SPEC: "guard-execution-proof.v1";
+/**
+ * Hash of the factory return value — only when the value is already byte-stable.
+ *
+ * Not hashed (and the block says so) when:
+ *  - the factory did not run / threw / produced no result
+ *  - the result is an object, array, number, boolean, null, bigint, symbol, function — any of these
+ *    would require a serialization choice (key order, undefined, non-JSON values) that reformats
+ *    the value rather than hashing the bytes the factory returned
+ *
+ * A hash of a string/Buffer does NOT prove the contract artifacts applied match change_fp_checked.
+ * That gap is named on limits.
+ */
+export type ExecutionResultHash = {
+    status: 'hashed';
+    algorithm: 'sha256';
+    value: string;
+} | {
+    status: 'not_hashed';
+    reason: 'not_executed' | 'execution_threw' | 'result_not_byte_stable' | 'result_type_unsupported';
+};
+export type GuardExecutionProof = {
+    proof_spec: typeof EXECUTION_PROOF_SPEC;
+    /** Observed: true iff this call completed a preflight round-trip that produced a decision envelope. */
+    preflighted: boolean;
+    /** Observed from the decision envelope when preflighted; null otherwise. */
+    decision_id: string | null;
+    receipt: {
+        /**
+         * Observed: true only when the guard's verify+bind step branded the envelope
+         * (requires valid signature, status VERIFIED_CURRENT, body hash + fp + scope match).
+         */
+        verified: boolean;
+        /**
+         * Observed derivation: bind requires status === 'VERIFIED_CURRENT', so verified ⇒ this value.
+         * null when the receipt was not verified (or no receipt path).
+         */
+        status: 'VERIFIED_CURRENT' | null;
+        /** Observed from the envelope when present; null when no envelope. */
+        expires_at: string | null;
+    };
+    /**
+     * Observed from the authenticated envelope fields when an envelope exists.
+     * change_fp is the fingerprint of WHAT WAS CHECKED (preflighted), not of what the factory applied.
+     * null when no envelope (SKIPPED / unavailable without envelope).
+     */
+    binds_to: {
+        operation: string | null;
+        change_fp: string | null;
+    } | null;
+    /**
+     * Observed at verify time: true iff receipt.verified (VERIFIED_CURRENT + bind).
+     * false when an envelope/receipt was present but did not verify.
+     * null when there was no receipt path to evaluate (SKIPPED, no envelope).
+     */
+    currently_authorized: boolean | null;
+    execution: {
+        attempted: boolean;
+        executed: boolean;
+        enforced: boolean;
+    };
+    /**
+     * Observed: kind of the guard verdict that produced this outcome.
+     * On a blocked call this is how the block is named (BLOCK / APPROVAL / UNAVAILABLE / …).
+     */
+    verdict_kind: string;
+    execution_result_hash: ExecutionResultHash;
+    /**
+     * Explicit non-claims. Readers that treat missing fields as "ok" are wrong; these are always set.
+     */
+    limits: {
+        does_not_claim_change_safe: true;
+        does_not_claim_host_cannot_bypass: true;
+        does_not_claim_absent_field_is_compliance: true;
+        change_fp_is_what_was_checked_not_what_executed: true;
+        calls_outside_guarded_path_invisible: true;
+        execution_result_hash_is_not_artifact_match_proof: true;
+    };
+};
+export type ProofBuildInput = {
+    preflighted: boolean;
+    executionAttempted: boolean;
+    executed: boolean;
+    enforced: boolean;
+    verdict: GuardVerdict;
+    /** Present only when executed:true (factory returned). */
+    result?: unknown;
+    /** Present only when factory threw. */
+    error?: unknown;
+    /** Optional conditional-write basis for the enforced+policy invariant. */
+    conditionalWriteBasis?: {
+        require_conditional_write: boolean;
+        write_style: boolean;
+        conditional_write: true | false | 'not_reported';
+    };
+};
+/**
+ * Runtime twin of the type-level enforced⟺receiptVerified invariant.
+ * Throws if enforced:true is paired with anything other than receiptVerified+preflighted.
+ * When requireConditionalWrite+writeStyle: enforced:true also requires conditional_write:true
+ * (same refusal class as the permission gate — not a parallel path).
+ * The proof block is read by consumers that do not have our TypeScript brands.
+ */
+export declare function assertEnforcedReceiptInvariant(input: {
+    enforced: boolean;
+    preflighted: boolean;
+    receiptVerified: boolean;
+    /** Policy requireConditionalWrite for this call (optional; omit = not checked here). */
+    requireConditionalWrite?: boolean;
+    writeStyle?: boolean;
+    /** Host report: true | false | 'not_reported'. */
+    conditionalWrite?: true | false | 'not_reported';
+}): void;
+/**
+ * Honest byte hash of a factory return. Only string / Buffer / Uint8Array are hashed as raw bytes.
+ * Everything else is not_hashed with an explicit reason — never a JSON reformat hash.
+ */
+export declare function hashExecutionResult(result: unknown): ExecutionResultHash;
+/**
+ * Build the proof block from guard-observed outcome facts only.
+ * Never accepts a caller-supplied proof object or partial field map.
+ */
+export declare function buildExecutionProof(input: ProofBuildInput): GuardExecutionProof;
+//# sourceMappingURL=execution-proof.d.ts.map

package/dist/cjs/execution-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-proof.d.ts","sourceRoot":"","sources":["../../src/execution-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EACF,cAAc,GACd,iBAAiB,GACjB,wBAAwB,GACxB,yBAAyB,CAAC;CAC/B,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,OAAO,oBAAoB,CAAC;IACxC,uGAAuG;IACvG,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE;QACP;;;WAGG;QACH,QAAQ,EAAE,OAAO,CAAC;QAClB;;;WAGG;QACH,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAClC,sEAAsE;QACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;IACF;;;;OAIG;IACH,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE;QACT,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C;;OAEG;IACH,MAAM,EAAE;QACN,0BAA0B,EAAE,IAAI,CAAC;QACjC,iCAAiC,EAAE,IAAI,CAAC;QACxC,yCAAyC,EAAE,IAAI,CAAC;QAChD,+CAA+C,EAAE,IAAI,CAAC;QACtD,oCAAoC,EAAE,IAAI,CAAC;QAC3C,iDAAiD,EAAE,IAAI,CAAC;KACzD,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE;QACtB,yBAAyB,EAAE,OAAO,CAAC;QACnC,WAAW,EAAE,OAAO,CAAC;QACrB,iBAAiB,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;KAClD,CAAC;CACH,CAAC;AAWF;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,wFAAwF;IACxF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;CAClD,GAAG,IAAI,CAeP;AA0BD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,mBAAmB,CAuBxE;AAeD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,mBAAmB,CA0D/E"}

package/dist/cjs/execution-proof.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * Guard-produced execution proof block.
+ *
+ * Assembled ONLY from state the guard itself observed while handling a call. Callers cannot supply
+ * fields into this object: builders take GuardOutcome-internal facts, not a host "proof" option.
+ * The returned object is deeply frozen so post-return mutation of proof fields is rejected.
+ *
+ * What this block proves (when the corresponding fields are present):
+ *  - preflight happened          → preflighted + decision_id
+ *  - receipt was fresh           → receipt.status === 'VERIFIED_CURRENT' + expires_at
+ *  - scope matched               → binds_to.operation + currently_authorized
+ *  - ran on the guarded path     → execution.enforced === true (runtime-asserted only with
+ *                                  receipt.verified + preflighted; same invariant the types encode)
+ *  - artifact checked vs executed → change_fp is WHAT WAS CHECKED; execution_result_hash is NOT a
+ *                                  general claim that the applied side effect matched that fp
+ *
+ * What this block must never claim: that the change is safe, that the host cannot bypass the
+ * package, or that an absent field means compliance. Those limits are explicit on every block.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXECUTION_PROOF_SPEC = void 0;
+exports.assertEnforcedReceiptInvariant = assertEnforcedReceiptInvariant;
+exports.hashExecutionResult = hashExecutionResult;
+exports.buildExecutionProof = buildExecutionProof;
+const node_crypto_1 = require("node:crypto");
+/** Machine-readable schema id for this block. */
+exports.EXECUTION_PROOF_SPEC = 'guard-execution-proof.v1';
+const LIMITS = Object.freeze({
+    does_not_claim_change_safe: true,
+    does_not_claim_host_cannot_bypass: true,
+    does_not_claim_absent_field_is_compliance: true,
+    change_fp_is_what_was_checked_not_what_executed: true,
+    calls_outside_guarded_path_invisible: true,
+    execution_result_hash_is_not_artifact_match_proof: true,
+});
+/**
+ * Runtime twin of the type-level enforced⟺receiptVerified invariant.
+ * Throws if enforced:true is paired with anything other than receiptVerified+preflighted.
+ * When requireConditionalWrite+writeStyle: enforced:true also requires conditional_write:true
+ * (same refusal class as the permission gate — not a parallel path).
+ * The proof block is read by consumers that do not have our TypeScript brands.
+ */
+function assertEnforcedReceiptInvariant(input) {
+    if (input.enforced === true) {
+        if (input.preflighted !== true || input.receiptVerified !== true) {
+            throw new Error('@coderifts/agent-guard: enforced:true without receiptVerified+preflighted (runtime invariant)');
+        }
+        if (input.requireConditionalWrite === true && input.writeStyle === true) {
+            if (input.conditionalWrite !== true) {
+                throw new Error('@coderifts/agent-guard: enforced:true without conditional_write:true under requireConditionalWrite (runtime invariant)');
+            }
+        }
+    }
+}
+function receiptVerifiedOf(verdict) {
+    if ('receiptVerified' in verdict && typeof verdict.receiptVerified === 'boolean') {
+        return verdict.receiptVerified === true;
+    }
+    return false;
+}
+function envelopeOf(verdict) {
+    if ('envelope' in verdict && verdict.envelope && typeof verdict.envelope === 'object') {
+        return verdict.envelope;
+    }
+    return null;
+}
+/**
+ * Honest byte hash of a factory return. Only string / Buffer / Uint8Array are hashed as raw bytes.
+ * Everything else is not_hashed with an explicit reason — never a JSON reformat hash.
+ */
+function hashExecutionResult(result) {
+    if (typeof result === 'string') {
+        return {
+            status: 'hashed',
+            algorithm: 'sha256',
+            value: 'sha256:' + (0, node_crypto_1.createHash)('sha256').update(result, 'utf8').digest('hex'),
+        };
+    }
+    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(result)) {
+        return {
+            status: 'hashed',
+            algorithm: 'sha256',
+            value: 'sha256:' + (0, node_crypto_1.createHash)('sha256').update(result).digest('hex'),
+        };
+    }
+    if (result instanceof Uint8Array) {
+        return {
+            status: 'hashed',
+            algorithm: 'sha256',
+            value: 'sha256:' + (0, node_crypto_1.createHash)('sha256').update(result).digest('hex'),
+        };
+    }
+    return { status: 'not_hashed', reason: 'result_not_byte_stable' };
+}
+function executionResultHashOf(input) {
+    if (input.executionAttempted && !input.executed && 'error' in input && input.error !== undefined) {
+        return { status: 'not_hashed', reason: 'execution_threw' };
+    }
+    if (!input.executed) {
+        return { status: 'not_hashed', reason: 'not_executed' };
+    }
+    if (!('result' in input)) {
+        return { status: 'not_hashed', reason: 'result_type_unsupported' };
+    }
+    return hashExecutionResult(input.result);
+}
+/**
+ * Build the proof block from guard-observed outcome facts only.
+ * Never accepts a caller-supplied proof object or partial field map.
+ */
+function buildExecutionProof(input) {
+    const receiptVerified = receiptVerifiedOf(input.verdict);
+    const cwb = input.conditionalWriteBasis;
+    assertEnforcedReceiptInvariant({
+        enforced: input.enforced,
+        preflighted: input.preflighted,
+        receiptVerified,
+        requireConditionalWrite: cwb?.require_conditional_write,
+        writeStyle: cwb?.write_style,
+        conditionalWrite: cwb?.conditional_write,
+    });
+    const env = envelopeOf(input.verdict);
+    const hasEnvelope = env !== null;
+    let decision_id = null;
+    let expires_at = null;
+    let binds_to = null;
+    if (hasEnvelope && env) {
+        decision_id = typeof env.decision_id === 'string' ? env.decision_id : null;
+        expires_at = typeof env.expires_at === 'string' ? env.expires_at : null;
+        binds_to = Object.freeze({
+            operation: typeof env.operation === 'string' ? env.operation : null,
+            change_fp: typeof env.fingerprint === 'string' ? env.fingerprint : null,
+        });
+    }
+    // currently_authorized: only evaluable when a receipt path existed.
+    // verified ⇒ true (bind required VERIFIED_CURRENT). envelope present but not verified ⇒ false.
+    // no envelope (SKIPPED / some UNAVAILABLE) ⇒ null.
+    let currently_authorized = null;
+    if (hasEnvelope) {
+        currently_authorized = receiptVerified;
+    }
+    const proof = {
+        proof_spec: exports.EXECUTION_PROOF_SPEC,
+        preflighted: input.preflighted === true,
+        decision_id,
+        receipt: Object.freeze({
+            verified: receiptVerified,
+            status: receiptVerified ? 'VERIFIED_CURRENT' : null,
+            expires_at,
+        }),
+        binds_to: binds_to ? Object.freeze(binds_to) : null,
+        currently_authorized,
+        execution: Object.freeze({
+            attempted: input.executionAttempted === true,
+            executed: input.executed === true,
+            enforced: input.enforced === true,
+        }),
+        verdict_kind: typeof input.verdict?.kind === 'string' ? input.verdict.kind : 'UNKNOWN',
+        execution_result_hash: Object.freeze(executionResultHashOf(input)),
+        limits: LIMITS,
+    };
+    return freezeProof(proof);
+}
+function freezeProof(p) {
+    return Object.freeze(p);
+}
+//# sourceMappingURL=execution-proof.js.map

package/dist/cjs/execution-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-proof.js","sourceRoot":"","sources":["../../src/execution-proof.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA4HH,wEAwBC;AA8BD,kDAuBC;AAmBD,kDA0DC;AApRD,6CAAyC;AAGzC,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,0BAAmC,CAAC;AAsGxE,MAAM,MAAM,GAAkC,MAAM,CAAC,MAAM,CAAC;IAC1D,0BAA0B,EAAE,IAAI;IAChC,iCAAiC,EAAE,IAAI;IACvC,yCAAyC,EAAE,IAAI;IAC/C,+CAA+C,EAAE,IAAI;IACrD,oCAAoC,EAAE,IAAI;IAC1C,iDAAiD,EAAE,IAAI;CACxD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAC,KAS9C;IACC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAqB;IAC9C,IAAI,iBAAiB,IAAI,OAAO,IAAI,OAAQ,OAAyC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpH,OAAQ,OAAwC,CAAC,eAAe,KAAK,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAAqB;IAMvC,IAAI,UAAU,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC,QAKd,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAe;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,YAAY,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAsB;IACnD,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,KAAsB;IACxD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACxC,8BAA8B,CAAC;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe;QACf,uBAAuB,EAAE,GAAG,EAAE,yBAAyB;QACvD,UAAU,EAAE,GAAG,EAAE,WAAW;QAC5B,gBAAgB,EAAE,GAAG,EAAE,iBAAiB;KACzC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,CAAC;IAEjC,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,QAAQ,GAAoC,IAAI,CAAC;IAErD,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;QACvB,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACnE,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;SACxE,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,+FAA+F;IAC/F,mDAAmD;IACnD,IAAI,oBAAoB,GAAmB,IAAI,CAAC;IAChD,IAAI,WAAW,EAAE,CAAC;QAChB,oBAAoB,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAwB;QACjC,UAAU,EAAE,4BAAoB;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;QACvC,WAAW;QACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,eAAe,CAAC,CAAC,CAAE,kBAA4B,CAAC,CAAC,CAAC,IAAI;YAC9D,UAAU;SACX,CAAC;QACF,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACnD,oBAAoB;QACpB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,SAAS,EAAE,KAAK,CAAC,kBAAkB,KAAK,IAAI;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;SAClC,CAAC;QACF,YAAY,EAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACtF,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,CAAsB;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}