@coderifts/agent-guard 4.2.0 → 5.0.0

package/README.md

@@ -89,6 +89,124 @@ const { tools, registry_report, composition_assurance } = withCodeRifts({
 // the guard — the composition can only protect the table it returns.
 ```
 
+### Final-answer proof block (ID645)
+
+When a call produces a machine `GuardExecutionProof` (`outcome.proof`), you can embed a
+**human-readable** block in the agent’s final answer. The renderer is faithful: `currently_authorized: null`
+is **SKIPPED (not a pass)**; limits (e.g. host can still bypass; calls outside the guarded path are
+invisible) always appear. It does not change the proof shape.
+
+```typescript
+import { renderFinalAnswerProof, attachProofToAgentResponse } from '@coderifts/agent-guard';
+
+// After guardToolCall / withCodeRifts …
+const block = renderFinalAnswerProof(outcome.proof); // markdown string
+const answer = attachProofToAgentResponse('I applied the authorized edit.', outcome.proof);
+// string → appends block; object → adds final_answer_proof + final_answer_proof_text
+```
+
+See `examples/final-answer-proof.mjs` for verified vs skipped side by side.
+
+**OpenAI tool-calling (ID632 reference adapter).** Same input; OpenAI-shaped `tools` for
+`chat.completions`, plus the same unflattened assurance objects. Shape conversion only — does
+**not** claim product-level inescapability the core does not:
+
+```typescript
+import { withCodeRiftsOpenAI } from '@coderifts/agent-guard';
+
+const {
+  tools,                 // OpenAI: [{ type:'function', function:{ name, description?, parameters } }]
+  protected_tools,       // guarded execute — dispatch tool_calls here, never re-register rawTools
+  registry_report,
+  composition_assurance, // still may be incomplete (inescapable_runtime:false) — do not drop
+  receipt_thread,
+} = withCodeRiftsOpenAI({ tools: rawTools, client, operation: 'merge' });
+
+// openai.chat.completions.create({ model, messages, tools })
+// Host boundary: only `tools` / `protected_tools` enter the model loop — raw tools stay out.
+```
+
+See also `examples/openai-adapter.mjs` (not published in the npm tarball).
+
+**OpenAI-compatible models (no extra adapter).** DeepSeek, Kimi (Moonshot), and Qwen use the
+same ChatCompletions tool-calling format as OpenAI (`{ type: 'function', function: { name,
+description, parameters } }`). Use **`withCodeRiftsOpenAI`** and point your client `baseURL`
+(and API key) at their endpoint — zero new adapters, same guarded tools + unflattened assurance.
+
+**Grok (xAI).** Also OpenAI-compatible tool calling — use **`withCodeRiftsOpenAI`** with the xAI `baseURL`.
+
+**Perplexity (Sonar).** OpenAI-compatible chat completions, but tool calling is model-dependent: `sonar-pro` supports it (with a stricter JSON-object parameter schema), while plain `sonar` rejects tool definitions. Use **`withCodeRiftsOpenAI`** with tool-capable Perplexity models only.
+
+**Anthropic tool_use (ID632 slice 2).** Same thin pattern; Anthropic Messages `tools` shape
+(`{ name, description?, input_schema }`) instead of OpenAI function tools. Assurance still
+unflattened — composition may remain incomplete:
+
+```typescript
+import { withCodeRiftsAnthropic } from '@coderifts/agent-guard';
+
+const {
+  tools,                 // Anthropic: [{ name, description?, input_schema }]
+  protected_tools,       // guarded execute — dispatch tool_use here, never re-register rawTools
+  registry_report,
+  composition_assurance, // still may be incomplete (inescapable_runtime:false) — do not drop
+  receipt_thread,
+} = withCodeRiftsAnthropic({ tools: rawTools, client, operation: 'merge' });
+
+// anthropic.messages.create({ model, messages, tools, max_tokens })
+// Host boundary: only `tools` / `protected_tools` enter the model loop — raw tools stay out.
+```
+
+See also `examples/anthropic-adapter.mjs` (not published in the npm tarball).
+
+**LangChain / LangGraph (ID632 slice 3).** Same thin pattern; emits **dependency-free** plain
+descriptors the host can hand to LangChain `tool()` / LangGraph `ToolNode` / `bind_tools`. This
+package does **not** depend on langchain or langgraph — the host owns those imports. Assurance
+still unflattened:
+
+```typescript
+import { withCodeRiftsLangGraph } from '@coderifts/agent-guard';
+// host-owned (not a dependency of this package):
+// import { tool } from '@langchain/core/tools';
+// import { ToolNode } from '@langchain/langgraph/prebuilt';
+
+const {
+  tools,                 // [{ name, description?, schema, func, invoke }] — guarded execute bound
+  protected_tools,
+  registry_report,
+  composition_assurance, // still may be incomplete (inescapable_runtime:false) — do not drop
+  receipt_thread,
+} = withCodeRiftsLangGraph({ tools: rawTools, client, operation: 'merge' });
+
+// const lcTools = tools.map((d) =>
+//   tool(d.func, { name: d.name, description: d.description, schema: d.schema }),
+// );
+// const toolNode = new ToolNode(lcTools); // StateGraph … .addNode('tools', toolNode)
+// Host boundary: only `tools` / `protected_tools` enter the graph — raw tools stay out.
+```
+
+See also `examples/langgraph-adapter.mjs` (not published in the npm tarball).
+
+**Google Gemini (ID632 slice 4).** Same thin pattern; Gemini nests **all** tools under one
+`functionDeclarations` array (not one OpenAI-style `{ type: 'function' }` per tool). Assurance
+still unflattened:
+
+```typescript
+import { withCodeRiftsGemini } from '@coderifts/agent-guard';
+
+const {
+  tools,                 // Gemini: [{ functionDeclarations: [{ name, description?, parameters }, …] }]
+  protected_tools,       // guarded execute — dispatch functionCall here, never re-register rawTools
+  registry_report,
+  composition_assurance, // still may be incomplete (inescapable_runtime:false) — do not drop
+  receipt_thread,
+} = withCodeRiftsGemini({ tools: rawTools, client, operation: 'merge' });
+
+// model.generateContent({ contents, tools })
+// Host boundary: only `tools` / `protected_tools` enter the model loop — raw tools stay out.
+```
+
+See also `examples/gemini-adapter.mjs` (not published in the npm tarball).
+
 **Why `operation` is mandatory (no default).** Receipts bind to an operation and `merge` is not
 `deploy`, so a silent default would evaluate a deployment under merge semantics. `operation` is the
 session-level default for **generic** mutating tools only; a tool with a specialised mutation class
@@ -123,10 +241,13 @@ mutating tools):
   `withCodeRifts` passes it through **untouched**.
 - **`composition_assurance`** is the narrower, product-level statement — what `withCodeRifts` itself
   claims. Today it reports `PARTIAL` with `inescapable_runtime: false` and the residual
-  `composition_call_policy_incomplete`, because composition-level completeness still needs more than
-  tool wrapping: receipt carry-forward, and a freshness-safe prior for write-style calls (path + new
-  content only). Call-time STOP on BLOCK/RA is already on the frozen path; both-sides edit binders
-  (old_string/new_string, edits[]) are already shipped — neither alone flips this residual off.
+  `composition_call_policy_incomplete`, because **composition-call-policy completeness**
+  (`COMPOSITION_CALL_POLICY_COMPLETE`) is still false — not because tool wrapping or receipt
+  carry-forward are missing. Receipt carry-forward **ships** (per-composition cursor, `threadReceipts`
+  default on). Call-time STOP on BLOCK/RA and both-sides edit binders are already on the frozen path.
+  What still blocks the product-level claim includes a **freshness-safe prior for write-style calls**
+  (path + new content only) wired into enforce, among other policy gates — carry-forward alone does
+  not flip this residual off.
 - **This is deliberate, not a defect.** The composition will not claim runtime inescapability it cannot
   yet deliver.
 
@@ -136,17 +257,19 @@ does not weaken it. `composition_assurance` answers a *different* question: not
 wrapped" (true today) but "is the whole execution path through this composition inescapable yet" (not
 yet). The composition says so rather than borrowing the registry's answer.
 
-**What you get today:** one entry point, every mutator in the returned table wrapped fail-closed, and an
-honest composition statement. **What you do not get yet:** any product-level claim of runtime
-inescapability — `composition_assurance.inescapable_runtime` stays `false` until receipt carry-forward
-and a freshness-safe prior for write-style calls (path + new content only) land. Both-sides edit
-binders already shipped; they do not complete that claim alone.
+**What you get today:** one entry point, every mutator in the returned table wrapped fail-closed,
+automatic receipt carry-forward on by default, and an honest composition statement. **What you do not
+get yet:** any product-level claim of runtime inescapability —
+`composition_assurance.inescapable_runtime` stays `false` while **composition-call-policy** remains
+incomplete (`COMPOSITION_CALL_POLICY_COMPLETE` is false). That is **not** because carry-forward is
+missing (it ships). A green construction is still **not** a product-level runtime-inescapability
+guarantee.
 
 **`requireCoverage?` (optional).** Aborts construction when the **registry** coverage is weaker than
 required, by the ordering `COMPLETE > PARTIAL > BYPASSED > UNKNOWN`. It constrains the **registry surface
-only** — it **cannot** demand product-level inescapability (still blocked on receipt carry-forward and
-write-style prior content, not on registry wrapping), and a green construction under it is not a
-product-level enforcement guarantee.
+only** — it **cannot** demand product-level inescapability (still gated on composition-call-policy
+completeness, not on registry wrapping or on whether carry-forward is enabled), and a green
+construction under it is not a product-level enforcement guarantee.
 
 **`unknownToolPolicy` defaults to `'mutating'`.** An unclassified tool (no `mutationClass`, no
 name-heuristic match) is treated as a mutator and wrapped — never silently downgraded to readonly, which
@@ -164,8 +287,11 @@ change it.
 artifacts when a contract path is present — it does **not** invent a `before` for write-style
 path+new-content-only calls (no IO; empty before is forbidden).
 
-**Not in this yet** (do not infer these from the one-call ergonomics): receipt carry-forward,
-freshness-safe prior content for write-style calls, and framework adapters.
+**Not in this yet** (do not infer these from the one-call ergonomics): freshness-safe prior content
+for write-style calls wired into enforce (path + new content only — pure core may exist; product
+path is incomplete), platform-native bypass exclusion, a concurrent receipt manager (overlap
+refuses to advance the package cursor — host owns serialisation if a linear chain is required), and
+framework adapters. **Receipt carry-forward is shipped** (see below); do not list it as missing.
 
 #### `composition_assurance` is the runtime placement input
 
@@ -359,48 +485,67 @@ Neither replaces the other. Lifecycle crumbs ≠ full settle record; settle reco
 - A throwing `onSettledCall` does not break the call; a **returned rejected promise** is handled (not left unhandled).
 - If the tool/`guardToolCall` path **rejects**, the rejection **propagates** after the THREW observation fires — no fake GuardOutcome is invented on that arm.
 
-### Receipt chaining (optional, host-threaded — no package cursor)
+### Receipt chaining (package cursor default-on; host may override)
 
 The signed receipt body has always carried a **previous-receipt** field (`prev`): the issuer stores
 the literal `null` when no prior token was supplied, or `sha256:`+hex of the prior token when the
 preflight request included `previous_receipt`. That makes **hash-linked sequences** possible.
-Historically the guard sent `previous_receipt: undefined` on every call, so every receipt was a
-root. Chaining is now **possible**, not automatic.
 
-**How to thread a prior (host-owned):**
+**Package-level composition cursor (shipped, default on):** `withCodeRifts` keeps a **per-composition-
+instance** receipt cursor. With `threadReceipts` defaulting to **true** (`threadReceipts !== false`),
+each enforced+receipt-verified guarded call can advance that cursor and supply it as
+`previous_receipt` on the next preflight for the same composition. Opt out with
+`threadReceipts: false` (every call is then a root unless the host threads manually). This is **not**
+process/session global; it is one cursor per `withCodeRifts` result. The package does **not** verify
+signatures or self-attest chain authenticity — re-run `verifyReceiptChainLinkage` (and signature
+verify) on tokens you export if you need product truth.
+
+**Host override (always wins):** `previousReceipt` on the composition (string or getter) overrides the
+package cursor at resolve time when set — use it to inject a prior the composition does not hold.
 
 ```typescript
+// Default: automatic carry-forward for this composition (threadReceipts defaults true).
+const { tools, receipt_thread } = withCodeRifts({
+  tools: rawTools,
+  client,
+  operation: 'merge',
+});
+// receipt_thread.enabled === true; receipt_thread.lastToken() after settled guarded calls.
+
+// Opt out of the package cursor:
+const { tools: t2 } = withCodeRifts({
+  tools: rawTools,
+  client,
+  operation: 'merge',
+  threadReceipts: false,
+});
+
+// Host-owned prior (overrides the package cursor when both exist):
 let lastToken: string | undefined;
-const { tools } = withCodeRifts({
+const { tools: t3 } = withCodeRifts({
   tools: rawTools,
   client,
   operation: 'merge',
-  // Read on each preflight; the package does not store or advance this value.
   previousReceipt: () => lastToken,
   onSettledCall: (o) => {
-    // Advance the chain only on a GUARDED return that carries a receipt token.
     if (o.kind !== 'settled_call' || o.route !== 'GUARDED' || o.terminal !== 'RETURNED') return;
     const v = o.outcome.verdict;
     if (v && 'envelope' in v && v.envelope?.receipt?.token) {
-      lastToken = v.envelope.receipt.token; // host advances the cursor
+      lastToken = v.envelope.receipt.token;
     }
   },
 });
 ```
 
-The same field exists on `GuardConfig` for direct `guardToolCall` / `guardToolRegistry` use
-(`previousReceipt?: string | (() => string | undefined | null)`). A plain string works if the host
-mutates it between calls; a getter is preferred so the package never looks like it owns the value.
-
-**Concurrency (serial only for a linear chain):** The getter/`onSettledCall` pattern above is correct
-when guarded contract calls run **one after another**. Modern agents often issue **overlapping** tool
-calls. `onSettledCall` runs **after** a call settles, so two preflights in flight can both read the
-same `lastToken` before either advances it. The issuer then produces two children of one parent —
-a **forest**, not a single linear chain. The package holds nothing, so it cannot serialise that
-advance; **the host owns the ordering rule**. If you need a linear chain under concurrency, you
-must serialise your own advance (no package mutex or queue is provided). Symptom of treating a
-fork as a line: `verifyReceiptChainLinkage` reports `broken_link` on a sequence you believed was
-linear, with no other explanation in the tokens themselves.
+The same `previousReceipt` field exists on `GuardConfig` for direct `guardToolCall` /
+`guardToolRegistry` use (`previousReceipt?: string | (() => string | undefined | null)`).
+
+**Concurrency (serial only for a linear chain):** Automatic advance is correct when guarded contract
+calls run **one after another**. Overlapping tool calls can race; the package **refuses to advance**
+the composition cursor under overlap rather than inventing a concurrent receipt manager. If you need
+a linear chain under concurrency, **the host owns the ordering rule** (no package mutex or queue).
+Symptom of treating a fork as a line: `verifyReceiptChainLinkage` reports `broken_link` on a
+sequence you believed was linear, with no other explanation in the tokens themselves.
 
 **Offline linkage check (not signature verification):**
 

package/dist/cjs/adapters/anthropic.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Anthropic tool_use adapter over withCodeRifts (ID632 slice 2 — same thin pattern as OpenAI).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → Anthropic Messages API tool definition,
+ *   3. returns Anthropic-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned Anthropic table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → Anthropic-ready guarded tools.
+ * Mirrors src/adapters/openai.ts — only the target tool shape differs.
+ */
+import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+/**
+ * Anthropic Messages API `tools[]` element (tool_use definition).
+ * @see https://docs.anthropic.com/en/docs/agents-and-tools/tool-use/overview
+ */
+export type AnthropicTool = {
+    name: string;
+    description?: string;
+    /** JSON Schema object for the tool input (Anthropic `input_schema`). */
+    input_schema: Record<string, unknown>;
+};
+/**
+ * Result of withCodeRiftsAnthropic — Anthropic tool definitions + core assurance, unflattened.
+ *
+ * `tools` is the ONLY list intended for the model/runtime tool table. `protected_tools` is the
+ * same guarded list (with execute) for host dispatch after tool_use blocks — never the raw tools.
+ */
+export type WithCodeRiftsAnthropicResult = {
+    /** Anthropic-shaped tools for messages.create — only protected/guarded tools. */
+    tools: AnthropicTool[];
+    /**
+     * Guarded ProtectedTool list from withCodeRifts (same tools as `tools`, with execute).
+     * Host dispatches model tool_use through these only. Never raw tools.
+     */
+    protected_tools: ProtectedTool[];
+    /** Untouched registry report — registry's own truth. */
+    registry_report: RegistryCoverageReport;
+    /**
+     * Product-level assurance — deliberately narrower than the registry.
+     * Passed through untouched; may still show inescapable_runtime:false and
+     * residual composition_call_policy_incomplete.
+     */
+    composition_assurance: CompositionAssurance;
+    /** Per-composition receipt cursor — NOT product-truth chain evidence. */
+    receipt_thread: ReceiptThreadHandle;
+    repository?: string;
+};
+/**
+ * Map one ProtectedTool → Anthropic tool definition (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export declare function protectedToolToAnthropic(tool: ProtectedTool): AnthropicTool;
+/**
+ * Convert a list of ProtectedTool into Anthropic tool definitions.
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+export declare function toAnthropicTools(protectedTools: readonly ProtectedTool[]): AnthropicTool[];
+/**
+ * Build Anthropic-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — Anthropic messages API shape ({ name, description?, input_schema })
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export declare function withCodeRiftsAnthropic(input: WithCodeRiftsInput): WithCodeRiftsAnthropicResult;
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsAnthropic when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export declare function anthropicToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsAnthropicResult;
+//# sourceMappingURL=anthropic.d.ts.map

package/dist/cjs/adapters/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/adapters/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,iFAAiF;IACjF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAgB3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAE1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,4BAA4B,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,4BAA4B,CAc9F"}

package/dist/cjs/adapters/anthropic.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Anthropic tool_use adapter over withCodeRifts (ID632 slice 2 — same thin pattern as OpenAI).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps each ProtectedTool → Anthropic Messages API tool definition,
+ *   3. returns Anthropic-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned Anthropic table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → Anthropic-ready guarded tools.
+ * Mirrors src/adapters/openai.ts — only the target tool shape differs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectedToolToAnthropic = protectedToolToAnthropic;
+exports.toAnthropicTools = toAnthropicTools;
+exports.withCodeRiftsAnthropic = withCodeRiftsAnthropic;
+exports.anthropicToolAdapter = anthropicToolAdapter;
+const with_coderifts_js_1 = require("../with-coderifts.js");
+/** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
+const EMPTY_INPUT_SCHEMA = Object.freeze({
+    type: 'object',
+    properties: {},
+});
+/**
+ * Map one ProtectedTool → Anthropic tool definition (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+function protectedToolToAnthropic(tool) {
+    const input_schema = tool.inputSchema != null
+        && typeof tool.inputSchema === 'object'
+        && !Array.isArray(tool.inputSchema)
+        ? tool.inputSchema
+        : { ...EMPTY_INPUT_SCHEMA };
+    const out = {
+        name: tool.name,
+        input_schema,
+    };
+    if (tool.description != null && tool.description !== '') {
+        out.description = tool.description;
+    }
+    return out;
+}
+/**
+ * Convert a list of ProtectedTool into Anthropic tool definitions.
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+function toAnthropicTools(protectedTools) {
+    return protectedTools.map(protectedToolToAnthropic);
+}
+/**
+ * Build Anthropic-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — Anthropic messages API shape ({ name, description?, input_schema })
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+function withCodeRiftsAnthropic(input) {
+    const core = (0, with_coderifts_js_1.withCodeRifts)(input);
+    return anthropicToolAdapter(core);
+}
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsAnthropic when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+function anthropicToolAdapter(result) {
+    const protected_tools = result.tools;
+    const tools = toAnthropicTools(protected_tools);
+    const out = {
+        tools,
+        protected_tools,
+        registry_report: result.registry_report,
+        composition_assurance: result.composition_assurance,
+        receipt_thread: result.receipt_thread,
+    };
+    if (result.repository !== undefined) {
+        out.repository = result.repository;
+    }
+    return out;
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/cjs/adapters/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/adapters/anthropic.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AA2DH,4DAgBC;AAMD,4CAEC;AAYD,wDAGC;AAQD,oDAcC;AAtHD,4DAAqD;AA+CrD,+EAA+E;AAC/E,MAAM,kBAAkB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAChE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,YAAY,GAChB,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEhC,MAAM,GAAG,GAAkB;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY;KACb,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,cAAwC;IACvE,OAAO,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,IAAA,iCAAa,EAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/adapters/gemini.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Google Gemini function-calling adapter over withCodeRifts (ID632 slice 4 —
+ * same thin pattern as OpenAI / Anthropic / LangGraph).
+ *
+ * Thin SHAPE converter only. Guard logic stays in withCodeRifts; this module:
+ *   1. calls withCodeRifts with the same input shape,
+ *   2. maps ProtectedTool[] → Gemini generateContent tools shape,
+ *   3. returns Gemini-shaped tools PLUS the untouched assurance objects
+ *      (registry_report, composition_assurance, receipt_thread).
+ *
+ * Gemini nesting (differs from OpenAI):
+ *   tools: [ { functionDeclarations: [ { name, description?, parameters }, … ] } ]
+ * One tools entry wraps ALL declarations in a single functionDeclarations array —
+ * not one { type: 'function' } object per tool.
+ *
+ * Honesty (do not "upgrade" assurance):
+ *   - composition_assurance is passed through EXACTLY as the core reported it
+ *     (COMPOSITION_CALL_POLICY_COMPLETE may still be false; inescapable_runtime may be false).
+ *   - The adapter converts tool SHAPE for the model API; it does not claim product-level
+ *     inescapability the core does not claim.
+ *
+ * Only-protected-tools (6/D at the adapter surface):
+ *   - `tools` is derived ONLY from the frozen registry's ProtectedTool list.
+ *   - Raw tools never appear in the returned Gemini table. The host may still hold a raw
+ *     reference outside this table; that boundary stays the host's responsibility.
+ *
+ * Ergonomics (5–10 lines): pass raw tools + client + operation → Gemini-ready tools.
+ * Mirrors src/adapters/openai.ts — only the target tool shape differs.
+ */
+import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
+import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+/**
+ * One Gemini function declaration (inside functionDeclarations[]).
+ * @see https://ai.google.dev/gemini-api/docs/function-calling
+ */
+export type GeminiFunctionDeclaration = {
+    name: string;
+    description?: string;
+    /**
+     * OpenAPI-like JSON Schema for function parameters
+     * (Gemini `parameters` — from ProtectedTool.inputSchema).
+     */
+    parameters: Record<string, unknown>;
+};
+/**
+ * Gemini `tools[]` element: a single wrapper holding all functionDeclarations.
+ * Unlike OpenAI (one {type:'function'} per tool), Gemini nests every declaration
+ * under one functionDeclarations array.
+ */
+export type GeminiTool = {
+    functionDeclarations: GeminiFunctionDeclaration[];
+};
+/**
+ * Result of withCodeRiftsGemini — Gemini tool definitions + core assurance, unflattened.
+ *
+ * `tools` is typically a one-element array:
+ *   [ { functionDeclarations: [ …all protected tools… ] } ]
+ * `protected_tools` is the same guarded list (with execute) for host dispatch after functionCall.
+ */
+export type WithCodeRiftsGeminiResult = {
+    /**
+     * Gemini generateContent `tools` array — only protected/guarded tools, nested under
+     * functionDeclarations (usually length 1 wrapper).
+     */
+    tools: GeminiTool[];
+    /**
+     * Guarded ProtectedTool list from withCodeRifts.
+     * Host dispatches model functionCall through these only. Never raw tools.
+     */
+    protected_tools: ProtectedTool[];
+    /** Untouched registry report — registry's own truth. */
+    registry_report: RegistryCoverageReport;
+    /**
+     * Product-level assurance — deliberately narrower than the registry.
+     * Passed through untouched; may still show inescapable_runtime:false and
+     * residual composition_call_policy_incomplete.
+     */
+    composition_assurance: CompositionAssurance;
+    /** Per-composition receipt cursor — NOT product-truth chain evidence. */
+    receipt_thread: ReceiptThreadHandle;
+    repository?: string;
+};
+/**
+ * Map one ProtectedTool → Gemini functionDeclaration (shape only; no execute).
+ * Prefer tool.inputSchema when it is a plain object; otherwise empty object schema.
+ */
+export declare function protectedToolToFunctionDeclaration(tool: ProtectedTool): GeminiFunctionDeclaration;
+/**
+ * Convert ProtectedTool[] into Gemini `tools` array:
+ *   [ { functionDeclarations: [ … ] } ]
+ *
+ * Empty protected list → empty tools array (no empty wrapper).
+ * Does NOT call the guard — pure shape map over an already-protected list.
+ */
+export declare function toGeminiTools(protectedTools: readonly ProtectedTool[]): GeminiTool[];
+/**
+ * Build Gemini-ready guarded tools from raw tools + client + operation.
+ *
+ * Calls withCodeRifts internally (guard logic stays in the core). Returns:
+ *   - `tools` — Gemini shape [ { functionDeclarations: […] } ]
+ *   - `protected_tools` — same guarded tools for host execute dispatch
+ *   - assurance objects from the core, passed through untouched
+ *
+ * @param input Same shape as withCodeRifts (WithCodeRiftsInput).
+ */
+export declare function withCodeRiftsGemini(input: WithCodeRiftsInput): WithCodeRiftsGeminiResult;
+/**
+ * Shape-only adapter over an existing WithCodeRiftsResult (composition style).
+ * Prefer withCodeRiftsGemini when starting from raw tools.
+ *
+ * Does not re-run the guard; does not invent assurance.
+ */
+export declare function geminiToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsGeminiResult;
+//# sourceMappingURL=gemini.d.ts.map

package/dist/cjs/adapters/gemini.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/adapters/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,oBAAoB,EAAE,yBAAyB,EAAE,CAAC;CACnD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,aAAa,GAAG,yBAAyB,CAgBjG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,UAAU,EAAE,CAKpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAcxF"}