@coderifts/agent-guard 6.0.0 → 6.2.0

package/dist/esm/adapters/langgraph.js

@@ -33,6 +33,7 @@
  * Mirrors src/adapters/openai.ts and anthropic.ts — only the target tool shape differs.
  */
 import { withCodeRifts } from '../with-coderifts.js';
+import { attachProofToAgentResponse } from '../final-answer-proof.js';
 /** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
 const EMPTY_SCHEMA = Object.freeze({
     type: 'object',
@@ -104,4 +105,71 @@ export function langGraphToolAdapter(result) {
     }
     return out;
 }
+export function defaultSerializeLangGraphToolResult(result) {
+    if (typeof result === 'string')
+        return result;
+    if (typeof result === 'number'
+        || typeof result === 'boolean'
+        || typeof result === 'bigint'
+        || result === null
+        || result === undefined) {
+        return String(result);
+    }
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+/**
+ * Map a full GuardOutcome into a LangGraph/LangChain ToolMessage shape with proof embedded.
+ * Same arm mapping as bindOpenAIGuardOutcome; id field is tool_call_id.
+ */
+export function bindLangGraphGuardOutcome(outcome, args) {
+    const tool_call_id = args.tool_call_id;
+    const serialize = args.serialize ?? defaultSerializeLangGraphToolResult;
+    let body;
+    if (outcome.executed === true) {
+        body = serialize(outcome.result);
+    }
+    else if (outcome.executionAttempted === false) {
+        const kind = verdictKind(outcome);
+        body =
+            `CodeRifts gate did not permit execution (verdict: ${kind}). `
+                + 'No tool result was produced.';
+    }
+    else {
+        const err = 'error' in outcome ? outcome.error : undefined;
+        const kind = verdictKind(outcome);
+        body =
+            `Tool execution failed after gate decision (verdict: ${kind}): ${formatGuardError(err)}`;
+    }
+    const content = attachProofToAgentResponse(body, outcome.proof);
+    const msg = {
+        content,
+        tool_call_id,
+    };
+    if (args.name != null && args.name !== '') {
+        msg.name = args.name;
+    }
+    return msg;
+}
+function verdictKind(outcome) {
+    return outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
+        ? String(outcome.verdict.kind)
+        : 'UNKNOWN';
+}
+function formatGuardError(err) {
+    if (err instanceof Error)
+        return err.message || err.name || 'Error';
+    if (typeof err === 'string')
+        return err;
+    try {
+        return JSON.stringify(err);
+    }
+    catch {
+        return String(err);
+    }
+}
 //# sourceMappingURL=langgraph.js.map

package/dist/esm/adapters/langgraph.js.map

@@ -1 +1 @@
-{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA8DrD,+EAA+E;AAC/E,MAAM,YAAY,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GACV,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1B,yDAAyD;IACzD,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAwC;IACvE,OAAO,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"langgraph.js","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAuDtE,+EAA+E;AAC/E,MAAM,YAAY,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAmB;IAC1D,MAAM,MAAM,GACV,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;IAE1B,yDAAyD;IACzD,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,GAAG,GAA4B;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAwC;IACvE,OAAO,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,GAAG,GAAiC;QACxC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA4BD,MAAM,UAAU,mCAAmC,CAAI,MAAS;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAwB,EACxB,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAExE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,qDAAqD,IAAI,KAAK;kBAC5D,8BAA8B,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI;YACF,uDAAuD,IAAI,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAC1E,MAAM,GAAG,GAAyB;QAChC,OAAO;QACP,YAAY;KACb,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,GAAqC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAA8B;IACjD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;QACxF,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/esm/adapters/openai.d.ts

@@ -23,6 +23,7 @@
  */
 import type { WithCodeRiftsInput, WithCodeRiftsResult, CompositionAssurance, ReceiptThreadHandle } from '../with-coderifts.js';
 import type { ProtectedTool, RegistryCoverageReport } from '../tool-registry.js';
+import type { GuardOutcome } from '../types.js';
 /**
  * OpenAI chat.completions `tools[]` element (function tool).
  * @see https://platform.openai.com/docs/guides/function-calling
@@ -90,4 +91,47 @@ export declare function withCodeRiftsOpenAI(input: WithCodeRiftsInput): WithCode
  * Does not re-run the guard; does not invent assurance.
  */
 export declare function openAIToolAdapter(result: WithCodeRiftsResult): WithCodeRiftsOpenAIResult;
+/**
+ * Minimal OpenAI chat tool-message (role tool). No openai SDK dependency.
+ * @see https://platform.openai.com/docs/guides/function-calling
+ */
+export type OpenAIToolMessage = {
+    role: 'tool';
+    tool_call_id: string;
+    content: string;
+};
+/**
+ * Brand for proof-bound OpenAI tool messages (compile-time detection of proof-forgotten paths).
+ * Type-level only — same pattern as ReceiptVerifiedEnvelope; not a runtime wire field.
+ */
+declare const __proofBoundBrand: unique symbol;
+export type ProofBoundOpenAIToolMessage = OpenAIToolMessage & {
+    readonly __proofBound: typeof __proofBoundBrand;
+};
+export type BindOpenAIGuardOutcomeArgs<T> = {
+    /** OpenAI tool_call_id this message answers. */
+    tool_call_id: string;
+    /** Override result serialization (default: JSON.stringify objects, String() primitives). */
+    serialize?: (result: T) => string;
+};
+/**
+ * Default result → content body serializer (pure).
+ * Objects/arrays → JSON.stringify; strings unchanged; other primitives → String().
+ */
+export declare function defaultSerializeOpenAIToolResult<T>(result: T): string;
+/**
+ * Map a full GuardOutcome into an OpenAI tool message with the execution proof embedded.
+ *
+ * Option B (proof-binding helper): host still calls guardToolCall; this only binds
+ * outcome → framework tool-result. Pure and non-mutating. Always embeds outcome.proof
+ * (present on every arm) via attachProofToAgentResponse / renderFinalAnswerProof —
+ * does not reinvent proof formatting.
+ *
+ * Arms:
+ *  - executed (result): serialized result + rendered proof
+ *  - blocked before factory: gate-denied text (no fabricated result) + proof
+ *  - factory threw: error indication + proof
+ */
+export declare function bindOpenAIGuardOutcome<T>(outcome: GuardOutcome<T>, args: BindOpenAIGuardOutcomeArgs<T>): ProofBoundOpenAIToolMessage;
+export {};
 //# sourceMappingURL=openai.d.ts.map

package/dist/esm/adapters/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,2EAA2E;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAgB7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAE5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAcxF"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,2EAA2E;QAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,+EAA+E;IAC/E,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B;;;OAGG;IACH,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,wDAAwD;IACxD,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,qBAAqB,EAAE,oBAAoB,CAAC;IAC5C,yEAAyE;IACzE,cAAc,EAAE,mBAAmB,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAQF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,kBAAkB,CAgB7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAE5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,yBAAyB,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,CAcxF;AAID;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,OAAO,CAAC,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAC;AAC/C,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,GAAG;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,iBAAiB,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAgBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EACtC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAClC,2BAA2B,CAqC7B"}

package/dist/esm/adapters/openai.js

@@ -22,6 +22,7 @@
  * LangGraph / Anthropic adapters follow the same thin-converter pattern later.
  */
 import { withCodeRifts } from '../with-coderifts.js';
+import { attachProofToAgentResponse } from '../final-answer-proof.js';
 /** Empty JSON Schema object — used when a ProtectedTool has no inputSchema. */
 const EMPTY_PARAMETERS = Object.freeze({
     type: 'object',
@@ -88,4 +89,87 @@ export function openAIToolAdapter(result) {
     }
     return out;
 }
+/**
+ * Default result → content body serializer (pure).
+ * Objects/arrays → JSON.stringify; strings unchanged; other primitives → String().
+ */
+export function defaultSerializeOpenAIToolResult(result) {
+    if (typeof result === 'string')
+        return result;
+    if (typeof result === 'number'
+        || typeof result === 'boolean'
+        || typeof result === 'bigint'
+        || result === null
+        || result === undefined) {
+        return String(result);
+    }
+    try {
+        return JSON.stringify(result);
+    }
+    catch {
+        return String(result);
+    }
+}
+/**
+ * Map a full GuardOutcome into an OpenAI tool message with the execution proof embedded.
+ *
+ * Option B (proof-binding helper): host still calls guardToolCall; this only binds
+ * outcome → framework tool-result. Pure and non-mutating. Always embeds outcome.proof
+ * (present on every arm) via attachProofToAgentResponse / renderFinalAnswerProof —
+ * does not reinvent proof formatting.
+ *
+ * Arms:
+ *  - executed (result): serialized result + rendered proof
+ *  - blocked before factory: gate-denied text (no fabricated result) + proof
+ *  - factory threw: error indication + proof
+ */
+export function bindOpenAIGuardOutcome(outcome, args) {
+    const tool_call_id = args.tool_call_id;
+    const serialize = args.serialize ?? defaultSerializeOpenAIToolResult;
+    let body;
+    if (outcome.executed === true) {
+        // Executed arms (enforced or not): result is present.
+        body = serialize(outcome.result);
+    }
+    else if (outcome.executionAttempted === false) {
+        // Blocked before factory — no result; never fabricate one.
+        const kind = outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
+            ? String(outcome.verdict.kind)
+            : 'UNKNOWN';
+        body =
+            `CodeRifts gate did not permit execution (verdict: ${kind}). `
+                + 'No tool result was produced.';
+    }
+    else {
+        // executionAttempted && !executed → factory threw; error is present.
+        const err = 'error' in outcome ? outcome.error : undefined;
+        const errText = formatGuardError(err);
+        const kind = outcome.verdict && typeof outcome.verdict === 'object' && 'kind' in outcome.verdict
+            ? String(outcome.verdict.kind)
+            : 'UNKNOWN';
+        body =
+            `Tool execution failed after gate decision (verdict: ${kind}): ${errText}`;
+    }
+    // Reuse public proof render path (string append) — same separator/render as final-answer attach.
+    const content = attachProofToAgentResponse(body, outcome.proof);
+    // Type brand only (no extra wire keys — OpenAI tool messages stay {role, tool_call_id, content}).
+    const msg = {
+        role: 'tool',
+        tool_call_id,
+        content,
+    };
+    return msg;
+}
+function formatGuardError(err) {
+    if (err instanceof Error)
+        return err.message || err.name || 'Error';
+    if (typeof err === 'string')
+        return err;
+    try {
+        return JSON.stringify(err);
+    }
+    catch {
+        return String(err);
+    }
+}
 //# sourceMappingURL=openai.js.map

package/dist/esm/adapters/openai.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAkDrD,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,EAAE,GAAmC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAwC;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/adapters/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AASrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AA2CtE,+EAA+E;AAC/E,MAAM,gBAAgB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC9D,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,IAAI,IAAI;WACrB,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,WAAuC;QAC/C,CAAC,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9B,MAAM,EAAE,GAAmC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU;KACX,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QACxD,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAwC;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAwB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAA8B;QACrC,KAAK;QACL,eAAe;QACf,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA8BD;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAI,MAAS;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;WACvB,OAAO,MAAM,KAAK,SAAS;WAC3B,OAAO,MAAM,KAAK,QAAQ;WAC1B,MAAM,KAAK,IAAI;WACf,MAAM,KAAK,SAAS,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,IAAmC;IAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gCAAgC,CAAC;IAErE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,sDAAsD;QACtD,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QAChD,2DAA2D;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;YAC9F,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI;YACF,qDAAqD,IAAI,KAAK;kBAC5D,8BAA8B,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,CAAC,OAAO;YAC9F,CAAC,CAAC,MAAM,CAAE,OAAO,CAAC,OAA4B,CAAC,IAAI,CAAC;YACpD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI;YACF,uDAAuD,IAAI,MAAM,OAAO,EAAE,CAAC;IAC/E,CAAC;IAED,iGAAiG;IACjG,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAW,CAAC;IAE1E,kGAAkG;IAClG,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,MAAM;QACZ,YAAY;QACZ,OAAO;KACR,CAAC;IACF,OAAO,GAAkC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/esm/cas-adapters/fs.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+import { tokensEqual, type ExecuteIfUnchangedOutcome, type VersionToken, type VersionedContent } from '../conditional-write.js';
+import type { PriorContentResolver } from '../freshness.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export declare const FS_VERSION_TOKEN_PREFIX = "fs:v1:";
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+export declare const FS_ABSENT_TOKEN: VersionToken;
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+export declare function fsTokenContentHash(token: VersionToken | null | undefined): string | null;
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+export declare function createFsVersionToken(filePath: string): Promise<VersionToken>;
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+export declare function readVersionedFile(filePath: string): Promise<VersionedContent>;
+export type WriteFileIfUnchangedArgs = {
+    path: string;
+    /** Token measured before the host decided to write (from createFsVersionToken). */
+    expected_token: VersionToken;
+    /** Full new file contents (utf8 string or Buffer). */
+    content: string | Buffer;
+};
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export declare function writeFileIfUnchanged(args: WriteFileIfUnchangedArgs): Promise<ExecuteIfUnchangedOutcome<{
+    path: string;
+    bytes: number;
+    written_content_hash: string;
+}>>;
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+export declare function createFsPriorContentResolver(options?: {
+    /**
+     * Map artifactId → absolute or relative file path.
+     * If omitted, uses req.path or arguments-style path when provided on the resolve request.
+     */
+    pathForArtifact?: (artifactId: string) => string | null | undefined;
+}): PriorContentResolver;
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=fs.d.ts.map

package/dist/esm/cas-adapters/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,YAA6B,CAAC;AAM5D,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBlF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOnF;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,YAAY,CAAC;IAC7B,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAsDnG;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACrE,GAAG,oBAAoB,CAoBvB;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/esm/cas-adapters/fs.js

@@ -0,0 +1,185 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+'use strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { promises as fsp } from 'node:fs';
+import * as path from 'node:path';
+import { executeIfUnchanged, StaleVersionTokenAbort, tokensEqual, } from '../conditional-write.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export const FS_VERSION_TOKEN_PREFIX = 'fs:v1:';
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+export const FS_ABSENT_TOKEN = 'fs:v1:absent';
+function sha256hex(buf) {
+    return createHash('sha256').update(buf).digest('hex');
+}
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+export function fsTokenContentHash(token) {
+    if (typeof token !== 'string' || !token.startsWith(FS_VERSION_TOKEN_PREFIX))
+        return null;
+    if (token === FS_ABSENT_TOKEN)
+        return null;
+    const rest = token.slice(FS_VERSION_TOKEN_PREFIX.length);
+    const colon = rest.indexOf(':');
+    if (colon < 0)
+        return null;
+    const hash = rest.slice(colon + 1);
+    return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
+}
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+export async function createFsVersionToken(filePath) {
+    let st;
+    try {
+        st = await fsp.stat(filePath);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err
+            ? String(err.code)
+            : '';
+        if (code === 'ENOENT')
+            return FS_ABSENT_TOKEN;
+        throw err;
+    }
+    if (!st.isFile()) {
+        // Directories / specials are not content CAS targets for this adapter.
+        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    }
+    const buf = await fsp.readFile(filePath);
+    const hash = sha256hex(buf);
+    const mtimeMs = Math.trunc(st.mtimeMs);
+    return `${FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+}
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+export async function readVersionedFile(filePath) {
+    const version_token = await createFsVersionToken(filePath);
+    if (version_token === FS_ABSENT_TOKEN) {
+        return { content: '', version_token };
+    }
+    const content = await fsp.readFile(filePath, 'utf8');
+    return { content, version_token };
+}
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export async function writeFileIfUnchanged(args) {
+    const target = path.resolve(args.path);
+    const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
+    const writtenHash = sha256hex(body);
+    return executeIfUnchanged({
+        expected_token: args.expected_token,
+        current_token: () => createFsVersionToken(target),
+        detect_stale_during_commit: true,
+        // Post-commit: token content-hash must equal sha256 of what we wrote (mtime may vary).
+        expected_after_commit: async (result) => {
+            // Synthesize a comparable token: re-read path; equality is content-hash based via tokensEqual
+            // only if full token matches — mtime always changes on write, so we return the LIVE post
+            // token only when its hash matches writtenHash; else return a sentinel that cannot match.
+            const post = await createFsVersionToken(target);
+            const postHash = fsTokenContentHash(post);
+            if (postHash === result.written_content_hash)
+                return post;
+            // Force mismatch → committed_stale_detected (detection, not rollback).
+            return `${FS_VERSION_TOKEN_PREFIX}0:stale_during_commit_mismatch`;
+        },
+        write: async () => {
+            const dir = path.dirname(target);
+            await fsp.mkdir(dir, { recursive: true });
+            const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${randomBytes(6).toString('hex')}.tmp`);
+            try {
+                await fsp.writeFile(tmp, body);
+                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                const still = await createFsVersionToken(target);
+                if (!tokensEqual(args.expected_token, still)) {
+                    try {
+                        await fsp.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new StaleVersionTokenAbort(still);
+                }
+                // Atomic replace on same filesystem (POSIX rename; Windows overwrite where supported).
+                await fsp.rename(tmp, target);
+            }
+            catch (err) {
+                if (err instanceof StaleVersionTokenAbort)
+                    throw err;
+                // Best-effort cleanup of temp — never leave partial target from failed rename.
+                try {
+                    await fsp.unlink(tmp);
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+        },
+    });
+}
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+export function createFsPriorContentResolver(options) {
+    const pathForArtifact = options?.pathForArtifact;
+    return async (req) => {
+        let filePath = typeof req.path === 'string' && req.path.length > 0 ? req.path : undefined;
+        if (!filePath && pathForArtifact) {
+            const mapped = pathForArtifact(req.artifactId);
+            if (typeof mapped === 'string' && mapped.length > 0)
+                filePath = mapped;
+        }
+        if (!filePath)
+            return null;
+        try {
+            return await fsp.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            const code = err && typeof err === 'object' && 'code' in err
+                ? String(err.code)
+                : '';
+            if (code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+}
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=fs.js.map

package/dist/esm/cas-adapters/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,GAIZ,MAAM,yBAAyB,CAAC;AAGjC,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,kBAAkB,CAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,uBAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,sBAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/esm/conditional-write.d.ts

@@ -89,4 +89,70 @@ export declare function conditionalWriteResidual(input: {
     writeStyle: boolean;
     conditionalWrite: ConditionalWriteReport;
 }): string | null;
+/**
+ * Outcome of a conditional write attempt.
+ * - committed: write ran under the expected token; post-check (if any) agreed
+ * - refused / stale_version_token: resource token moved BEFORE write; write did NOT run
+ * - committed_stale_detected / stale_during_commit: write DID run, but a post-commit
+ *   re-check found the resource no longer matches the write's expected post-state
+ *   (detection only — not a rollback)
+ */
+export type ExecuteIfUnchangedOutcome<T> = {
+    status: 'committed';
+    result: T;
+    version_token: VersionToken;
+} | {
+    status: 'refused';
+    reason: 'stale_version_token';
+    expected_token: VersionToken;
+    current_token: VersionToken | null;
+} | {
+    status: 'committed_stale_detected';
+    reason: 'stale_during_commit';
+    result: T;
+    expected_token: VersionToken;
+    post_commit_token: VersionToken | null;
+};
+/**
+ * Thrown from write() when the adapter aborts BEFORE applying the mutation
+ * (e.g. pre-rename re-check). executeIfUnchanged maps this to status:'refused'.
+ * Not a public host API — adapters use it to stay on the single helper path.
+ */
+export declare class StaleVersionTokenAbort extends Error {
+    readonly current_token: VersionToken | null;
+    constructor(current_token: VersionToken | null);
+}
+export type ExecuteIfUnchangedArgs<T> = {
+    /** Token the host measured before deciding to write (opaque string). */
+    expected_token: VersionToken;
+    /**
+     * Re-read the resource's token immediately before commit.
+     * Return null when the resource is gone / unreadable (treated as mismatch).
+     */
+    current_token: () => VersionToken | null | Promise<VersionToken | null>;
+    /** Mutation applied ONLY when current_token equals expected_token. */
+    write: () => T | Promise<T>;
+    /**
+     * Opt-in post-commit detection (default false — byte-identical old paths).
+     * When true AND expected_after_commit is provided: after write(), re-read
+     * current_token and compare to expected_after_commit(result). Mismatch →
+     * committed_stale_detected (write already happened; honest report only).
+     *
+     * NOTE: do NOT compare post-commit to expected_token for content-changing
+     * writes — the token is supposed to change. Supply the token of the written state.
+     */
+    detect_stale_during_commit?: boolean;
+    /**
+     * Token that should hold after a successful write (the written state's token).
+     * Required when detect_stale_during_commit is true; ignored otherwise.
+     */
+    expected_after_commit?: (result: T) => VersionToken | null | Promise<VersionToken | null>;
+};
+/**
+ * Host contract helper: re-check version token, then write or refuse.
+ * Equality via tokensEqual only — never interprets token format.
+ * Never throws for stale tokens (returns refused / committed_stale_detected);
+ * write/current_token errors (other than StaleVersionTokenAbort) propagate.
+ */
+export declare function executeIfUnchanged<T>(args: ExecuteIfUnchangedArgs<T>): Promise<ExecuteIfUnchangedOutcome<T>>;
 //# sourceMappingURL=conditional-write.d.ts.map

package/dist/esm/conditional-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB"}
+{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,aAAa,EAAE,YAAY,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;gBAChC,aAAa,EAAE,YAAY,GAAG,IAAI;CAK/C;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,wEAAwE;IACxE,cAAc,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxE,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,CAAC,KACN,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAmDvC"}