@coderifts/agent-guard 6.1.0 → 6.2.0

package/README.md

@@ -22,7 +22,11 @@ stays free of git/fs. Production PR artifact derivation:
 
 **TOCTOU is unclosed.** Resolving content proves what was true *at measurement time*;
 a host that then writes unconditionally still races. Neither the example nor this
-package supplies a version token or conditional write.
+package supplies a version token or conditional write. An **opt-in** execution-state
+recheck can *detect* (or enforce against) drift between the authorized change set and
+the artifacts still held at execute time — see **`requireExecutionStateMatch`** below.
+That is a detection/enforcement aid for the residual race, **not** a full TOCTOU
+closure (hosts that write unconditionally still race; conditional write remains host-side).
 
 ```typescript
 import { guardToolCall } from '@coderifts/agent-guard';
@@ -49,6 +53,58 @@ if (!outcome.executed) console.error('blocked:', outcome.verdict);
 // Retry ONLY when outcome.executionAttempted === false (the safe-to-retry signal).
 ```
 
+#### `requireExecutionStateMatch` — opt-in execution-state recheck (ID842)
+
+After a fully enforceable ALLOW/MONITOR decision and **immediately before** `executeFactory`,
+the guard can recompute the execution-time change-set fingerprint (crbundle.v1 over the
+**current** `artifacts[]` the guard already holds) and compare it to what the receipt
+authorized. Config field on `GuardConfig` (tri-state):
+
+```ts
+requireExecutionStateMatch?: boolean | 'warn';
+```
+
+| Mode | Value | Behavior |
+|---|---|---|
+| **OFF** (default) | `false` / absent | No recheck. Residual execution-state race as described under “TOCTOU is unclosed.” |
+| **Warn** (report-only) | `'warn'` | Rechecks. On **drift**, emits `execution_state_drift_observed` via **`onEvent`**, then **proceeds** (does not block). On match, silent (drift-only telemetry). Use this to gather production drift data without changing who executes. |
+| **Enforce** | `true` | Rechecks. On drift, **blocks** with integrity cause `EXECUTION_STATE_DRIFT` (factory never runs). Byte-identical to the original enforce path. |
+
+Recommended adoption path: **off → `'warn'` (observe) → `true` (enforce)** once your own
+telemetry shows drift is rare and real. A default flip to enforce is a later, versioned
+product decision — not this mode’s job.
+
+Warn-mode event (host-side only; the guard does **not** phone home), on `GuardConfig.onEvent`:
+
+```ts
+{
+  type: 'execution_state_drift_observed';
+  at: string;                         // ISO timestamp
+  decisionId?: string;
+  current_fingerprint: string | null;
+  authorized_fingerprint: string | null;
+  reason: string;
+}
+```
+
+```typescript
+const outcome = await guardToolCall(call, executeFactory, {
+  client,
+  operation: 'merge',
+  requireExecutionStateMatch: 'warn', // opt-in telemetry; still proceeds on drift
+  onEvent: (e) => {
+    if (e.type === 'execution_state_drift_observed') {
+      // host metrics / log — you own retention; nothing is sent to CodeRifts from here
+      console.warn('execution-state drift', e.decisionId, e.reason, e.current_fingerprint);
+    }
+  },
+});
+```
+
+Honesty: this aids **detection** (warn) or **hard stop** (enforce) for execution-state
+mismatch at the guard boundary. It does **not** close TOCTOU proper — measurement-to-commit
+and host-side unconditional writes remain; see Guarantees.
+
 > **Supply `artifacts[]` with content.** If the guard detects a contract change (e.g. from
 > `filesTouched`/`diff`) but you did **not** supply `artifacts[]` with `before`/`after`, it fails
 > closed **locally** with `outcome.verdict.cause === 'MISSING_ARTIFACT_CONTENT'` — the tool does not
@@ -682,7 +738,10 @@ Pass both on `withCodeRifts({ …, onEvent, monitoringSinkWired: true })`, or on
   measurement-to-commit race remains: content resolved at measurement time can change before the
   host commits. Closing that needs a host-side conditional write (compare-and-swap on a version
   token) — this package never writes, and reports `conditional_write` as a host assertion it
-  cannot verify.
+  cannot verify. Opt-in **`requireExecutionStateMatch`** (`false` / `'warn'` / `true`) can
+  recheck the execution-time fingerprint before the factory (warn = telemetry via
+  `execution_state_drift_observed`; true = block with `EXECUTION_STATE_DRIFT`) — a detection or
+  enforcement aid, **not** a full TOCTOU closure. See the subsection above.
 - **Retry-safe** — `executionAttempted` is the only safe-to-retry signal; a post-authorization throw
   is `executionAttempted:true` (the remote side effect may have landed).
 - **`enforced:true` only on a LIVE, receipt-verified `ALLOW`/`MONITOR`** — never on cached/LKG,

package/dist/cjs/cas-adapters/fs.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+import { tokensEqual, type ExecuteIfUnchangedOutcome, type VersionToken, type VersionedContent } from '../conditional-write.js';
+import type { PriorContentResolver } from '../freshness.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export declare const FS_VERSION_TOKEN_PREFIX = "fs:v1:";
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+export declare const FS_ABSENT_TOKEN: VersionToken;
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+export declare function fsTokenContentHash(token: VersionToken | null | undefined): string | null;
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+export declare function createFsVersionToken(filePath: string): Promise<VersionToken>;
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+export declare function readVersionedFile(filePath: string): Promise<VersionedContent>;
+export type WriteFileIfUnchangedArgs = {
+    path: string;
+    /** Token measured before the host decided to write (from createFsVersionToken). */
+    expected_token: VersionToken;
+    /** Full new file contents (utf8 string or Buffer). */
+    content: string | Buffer;
+};
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export declare function writeFileIfUnchanged(args: WriteFileIfUnchangedArgs): Promise<ExecuteIfUnchangedOutcome<{
+    path: string;
+    bytes: number;
+    written_content_hash: string;
+}>>;
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+export declare function createFsPriorContentResolver(options?: {
+    /**
+     * Map artifactId → absolute or relative file path.
+     * If omitted, uses req.path or arguments-style path when provided on the resolve request.
+     */
+    pathForArtifact?: (artifactId: string) => string | null | undefined;
+}): PriorContentResolver;
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=fs.d.ts.map

package/dist/cjs/cas-adapters/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,YAA6B,CAAC;AAM5D,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBlF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOnF;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,YAAY,CAAC;IAC7B,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAsDnG;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACrE,GAAG,oBAAoB,CAoBvB;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/cjs/cas-adapters/fs.js

@@ -0,0 +1,224 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokensEqual = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = void 0;
+exports.fsTokenContentHash = fsTokenContentHash;
+exports.createFsVersionToken = createFsVersionToken;
+exports.readVersionedFile = readVersionedFile;
+exports.writeFileIfUnchanged = writeFileIfUnchanged;
+exports.createFsPriorContentResolver = createFsPriorContentResolver;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const conditional_write_js_1 = require("../conditional-write.js");
+Object.defineProperty(exports, "tokensEqual", { enumerable: true, get: function () { return conditional_write_js_1.tokensEqual; } });
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+exports.FS_VERSION_TOKEN_PREFIX = 'fs:v1:';
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+exports.FS_ABSENT_TOKEN = 'fs:v1:absent';
+function sha256hex(buf) {
+    return (0, node_crypto_1.createHash)('sha256').update(buf).digest('hex');
+}
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+function fsTokenContentHash(token) {
+    if (typeof token !== 'string' || !token.startsWith(exports.FS_VERSION_TOKEN_PREFIX))
+        return null;
+    if (token === exports.FS_ABSENT_TOKEN)
+        return null;
+    const rest = token.slice(exports.FS_VERSION_TOKEN_PREFIX.length);
+    const colon = rest.indexOf(':');
+    if (colon < 0)
+        return null;
+    const hash = rest.slice(colon + 1);
+    return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
+}
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+async function createFsVersionToken(filePath) {
+    let st;
+    try {
+        st = await node_fs_1.promises.stat(filePath);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err
+            ? String(err.code)
+            : '';
+        if (code === 'ENOENT')
+            return exports.FS_ABSENT_TOKEN;
+        throw err;
+    }
+    if (!st.isFile()) {
+        // Directories / specials are not content CAS targets for this adapter.
+        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    }
+    const buf = await node_fs_1.promises.readFile(filePath);
+    const hash = sha256hex(buf);
+    const mtimeMs = Math.trunc(st.mtimeMs);
+    return `${exports.FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+}
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+async function readVersionedFile(filePath) {
+    const version_token = await createFsVersionToken(filePath);
+    if (version_token === exports.FS_ABSENT_TOKEN) {
+        return { content: '', version_token };
+    }
+    const content = await node_fs_1.promises.readFile(filePath, 'utf8');
+    return { content, version_token };
+}
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+async function writeFileIfUnchanged(args) {
+    const target = path.resolve(args.path);
+    const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
+    const writtenHash = sha256hex(body);
+    return (0, conditional_write_js_1.executeIfUnchanged)({
+        expected_token: args.expected_token,
+        current_token: () => createFsVersionToken(target),
+        detect_stale_during_commit: true,
+        // Post-commit: token content-hash must equal sha256 of what we wrote (mtime may vary).
+        expected_after_commit: async (result) => {
+            // Synthesize a comparable token: re-read path; equality is content-hash based via tokensEqual
+            // only if full token matches — mtime always changes on write, so we return the LIVE post
+            // token only when its hash matches writtenHash; else return a sentinel that cannot match.
+            const post = await createFsVersionToken(target);
+            const postHash = fsTokenContentHash(post);
+            if (postHash === result.written_content_hash)
+                return post;
+            // Force mismatch → committed_stale_detected (detection, not rollback).
+            return `${exports.FS_VERSION_TOKEN_PREFIX}0:stale_during_commit_mismatch`;
+        },
+        write: async () => {
+            const dir = path.dirname(target);
+            await node_fs_1.promises.mkdir(dir, { recursive: true });
+            const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${(0, node_crypto_1.randomBytes)(6).toString('hex')}.tmp`);
+            try {
+                await node_fs_1.promises.writeFile(tmp, body);
+                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                const still = await createFsVersionToken(target);
+                if (!(0, conditional_write_js_1.tokensEqual)(args.expected_token, still)) {
+                    try {
+                        await node_fs_1.promises.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new conditional_write_js_1.StaleVersionTokenAbort(still);
+                }
+                // Atomic replace on same filesystem (POSIX rename; Windows overwrite where supported).
+                await node_fs_1.promises.rename(tmp, target);
+            }
+            catch (err) {
+                if (err instanceof conditional_write_js_1.StaleVersionTokenAbort)
+                    throw err;
+                // Best-effort cleanup of temp — never leave partial target from failed rename.
+                try {
+                    await node_fs_1.promises.unlink(tmp);
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+        },
+    });
+}
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+function createFsPriorContentResolver(options) {
+    const pathForArtifact = options?.pathForArtifact;
+    return async (req) => {
+        let filePath = typeof req.path === 'string' && req.path.length > 0 ? req.path : undefined;
+        if (!filePath && pathForArtifact) {
+            const mapped = pathForArtifact(req.artifactId);
+            if (typeof mapped === 'string' && mapped.length > 0)
+                filePath = mapped;
+        }
+        if (!filePath)
+            return null;
+        try {
+            return await node_fs_1.promises.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            const code = err && typeof err === 'object' && 'code' in err
+                ? String(err.code)
+                : '';
+            if (code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=fs.js.map

package/dist/cjs/cas-adapters/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6Bb,gDAQC;AAOD,oDAmBC;AAMD,8CAOC;AA0BD,oDAwDC;AASD,oEA0BC;AA/LD,6CAAsD;AACtD,qCAA0C;AAC1C,gDAAkC;AAClC,kEAOiC;AAwLxB,4FA5LP,kCAAW,OA4LO;AArLpB,mFAAmF;AACtE,QAAA,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACU,QAAA,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAgB,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,+BAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,uBAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,+BAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,kBAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,+BAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,uBAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAA,yCAAkB,EAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,+BAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,kBAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,kBAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAA,kCAAW,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,6CAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6CAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,kBAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,kBAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/conditional-write.d.ts

@@ -89,4 +89,70 @@ export declare function conditionalWriteResidual(input: {
     writeStyle: boolean;
     conditionalWrite: ConditionalWriteReport;
 }): string | null;
+/**
+ * Outcome of a conditional write attempt.
+ * - committed: write ran under the expected token; post-check (if any) agreed
+ * - refused / stale_version_token: resource token moved BEFORE write; write did NOT run
+ * - committed_stale_detected / stale_during_commit: write DID run, but a post-commit
+ *   re-check found the resource no longer matches the write's expected post-state
+ *   (detection only — not a rollback)
+ */
+export type ExecuteIfUnchangedOutcome<T> = {
+    status: 'committed';
+    result: T;
+    version_token: VersionToken;
+} | {
+    status: 'refused';
+    reason: 'stale_version_token';
+    expected_token: VersionToken;
+    current_token: VersionToken | null;
+} | {
+    status: 'committed_stale_detected';
+    reason: 'stale_during_commit';
+    result: T;
+    expected_token: VersionToken;
+    post_commit_token: VersionToken | null;
+};
+/**
+ * Thrown from write() when the adapter aborts BEFORE applying the mutation
+ * (e.g. pre-rename re-check). executeIfUnchanged maps this to status:'refused'.
+ * Not a public host API — adapters use it to stay on the single helper path.
+ */
+export declare class StaleVersionTokenAbort extends Error {
+    readonly current_token: VersionToken | null;
+    constructor(current_token: VersionToken | null);
+}
+export type ExecuteIfUnchangedArgs<T> = {
+    /** Token the host measured before deciding to write (opaque string). */
+    expected_token: VersionToken;
+    /**
+     * Re-read the resource's token immediately before commit.
+     * Return null when the resource is gone / unreadable (treated as mismatch).
+     */
+    current_token: () => VersionToken | null | Promise<VersionToken | null>;
+    /** Mutation applied ONLY when current_token equals expected_token. */
+    write: () => T | Promise<T>;
+    /**
+     * Opt-in post-commit detection (default false — byte-identical old paths).
+     * When true AND expected_after_commit is provided: after write(), re-read
+     * current_token and compare to expected_after_commit(result). Mismatch →
+     * committed_stale_detected (write already happened; honest report only).
+     *
+     * NOTE: do NOT compare post-commit to expected_token for content-changing
+     * writes — the token is supposed to change. Supply the token of the written state.
+     */
+    detect_stale_during_commit?: boolean;
+    /**
+     * Token that should hold after a successful write (the written state's token).
+     * Required when detect_stale_during_commit is true; ignored otherwise.
+     */
+    expected_after_commit?: (result: T) => VersionToken | null | Promise<VersionToken | null>;
+};
+/**
+ * Host contract helper: re-check version token, then write or refuse.
+ * Equality via tokensEqual only — never interprets token format.
+ * Never throws for stale tokens (returns refused / committed_stale_detected);
+ * write/current_token errors (other than StaleVersionTokenAbort) propagate.
+ */
+export declare function executeIfUnchanged<T>(args: ExecuteIfUnchangedArgs<T>): Promise<ExecuteIfUnchangedOutcome<T>>;
 //# sourceMappingURL=conditional-write.d.ts.map

package/dist/cjs/conditional-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB"}
+{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,aAAa,EAAE,YAAY,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;gBAChC,aAAa,EAAE,YAAY,GAAG,IAAI;CAK/C;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,wEAAwE;IACxE,cAAc,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxE,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,CAAC,KACN,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAmDvC"}

package/dist/cjs/conditional-write.js

@@ -18,10 +18,11 @@
  */
 'use strict';
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESIDUAL_UNCONDITIONAL_WRITE = void 0;
+exports.StaleVersionTokenAbort = exports.RESIDUAL_UNCONDITIONAL_WRITE = void 0;
 exports.tokensEqual = tokensEqual;
 exports.buildConditionalWriteBasis = buildConditionalWriteBasis;
 exports.conditionalWriteResidual = conditionalWriteResidual;
+exports.executeIfUnchanged = executeIfUnchanged;
 /** Equality compare only — never semantic interpretation of the token. */
 function tokensEqual(a, b) {
     if (a == null || b == null)
@@ -93,4 +94,74 @@ function conditionalWriteResidual(input) {
         return null;
     return exports.RESIDUAL_UNCONDITIONAL_WRITE;
 }
+/**
+ * Thrown from write() when the adapter aborts BEFORE applying the mutation
+ * (e.g. pre-rename re-check). executeIfUnchanged maps this to status:'refused'.
+ * Not a public host API — adapters use it to stay on the single helper path.
+ */
+class StaleVersionTokenAbort extends Error {
+    current_token;
+    constructor(current_token) {
+        super('stale_version_token');
+        this.name = 'StaleVersionTokenAbort';
+        this.current_token = current_token;
+    }
+}
+exports.StaleVersionTokenAbort = StaleVersionTokenAbort;
+/**
+ * Host contract helper: re-check version token, then write or refuse.
+ * Equality via tokensEqual only — never interprets token format.
+ * Never throws for stale tokens (returns refused / committed_stale_detected);
+ * write/current_token errors (other than StaleVersionTokenAbort) propagate.
+ */
+async function executeIfUnchanged(args) {
+    const expected = args.expected_token;
+    if (typeof expected !== 'string' || expected.length === 0) {
+        return {
+            status: 'refused',
+            reason: 'stale_version_token',
+            expected_token: typeof expected === 'string' ? expected : '',
+            current_token: null,
+        };
+    }
+    const current = await args.current_token();
+    if (!tokensEqual(expected, current)) {
+        return {
+            status: 'refused',
+            reason: 'stale_version_token',
+            expected_token: expected,
+            current_token: current == null ? null : current,
+        };
+    }
+    let result;
+    try {
+        result = await args.write();
+    }
+    catch (err) {
+        if (err instanceof StaleVersionTokenAbort) {
+            return {
+                status: 'refused',
+                reason: 'stale_version_token',
+                expected_token: expected,
+                current_token: err.current_token,
+            };
+        }
+        throw err;
+    }
+    // Post-commit detection (best-effort honesty, not prevention).
+    if (args.detect_stale_during_commit === true && typeof args.expected_after_commit === 'function') {
+        const want = await args.expected_after_commit(result);
+        const post = await args.current_token();
+        if (!tokensEqual(want, post)) {
+            return {
+                status: 'committed_stale_detected',
+                reason: 'stale_during_commit',
+                result,
+                expected_token: expected,
+                post_commit_token: post == null ? null : post,
+            };
+        }
+    }
+    return { status: 'committed', result, version_token: expected };
+}
 //# sourceMappingURL=conditional-write.js.map

package/dist/cjs/conditional-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;;;AAkDb,kCAOC;AAkBD,gEAwCC;AASD,4DASC;AApFD,0EAA0E;AAC1E,SAAgB,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAI1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;KACZ,CAAC;IAEF,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,WAAW,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AAC5E,QAAA,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAIxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,oCAA4B,CAAC;AACtC,CAAC"}
+{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;;;AAkDb,kCAOC;AAkBD,gEAwCC;AASD,4DASC;AA+ED,gDAqDC;AAxND,0EAA0E;AAC1E,SAAgB,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAI1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;KACZ,CAAC;IAEF,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,WAAW,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AAC5E,QAAA,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAIxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,oCAA4B,CAAC;AACtC,CAAC;AA8BD;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IACtC,aAAa,CAAsB;IAC5C,YAAY,aAAkC;QAC5C,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAPD,wDAOC;AA+BD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC5D,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC;IAED,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,QAAQ;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,MAAM;gBACN,cAAc,EAAE,QAAQ;gBACxB,iBAAiB,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC"}

package/dist/cjs/index.d.ts

@@ -41,8 +41,9 @@ export { renderFinalAnswerProof, attachProofToAgentResponse, deriveProofBanner,
 export type { RenderFinalAnswerProofOptions, AttachProofToAgentResponseOptions, FinalAnswerProofFormat, FinalAnswerProofBanner, } from './final-answer-proof.js';
 export { assessFreshness, assessWriteStylePrior, contentByteIdentical, computePathSetTreeHash, freshnessAllowsEnforce, isWriteStyleCall, artifactIdsForResolve, collectFreshnessCallContext, buildFreshnessBasis, } from './freshness.js';
 export type { FreshnessOutcome, FreshnessCheckLevel, FreshnessAssessInput, FreshnessAssessResult, WriteStylePriorInput, WriteStylePriorResult, FreshnessWiringState, FreshnessBasis, FreshnessCallContext, PriorContentResolver, FreshnessDegradeReason, } from './freshness.js';
-export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, } from './conditional-write.js';
-export type { VersionToken, VersionedContent, ConditionalWriteReport, ConditionalWriteBasis, ConditionalWriteCallContext, } from './conditional-write.js';
+export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, executeIfUnchanged, StaleVersionTokenAbort, } from './conditional-write.js';
+export type { VersionToken, VersionedContent, ConditionalWriteReport, ConditionalWriteBasis, ConditionalWriteCallContext, ExecuteIfUnchangedOutcome, ExecuteIfUnchangedArgs, } from './conditional-write.js';
+export { createFsVersionToken, readVersionedFile, writeFileIfUnchanged, createFsPriorContentResolver, fsTokenContentHash, FS_VERSION_TOKEN_PREFIX, FS_ABSENT_TOKEN, } from './cas-adapters/fs.js';
 export { resolve as resolveArtifacts, classifyByName, blobMapKey } from './artifact-resolver.js';
 export type { ResolveInput, ResolveConfig, ResolveResult, ResolvedArtifact, ResolveCoverage, UnresolvedEntry, UnresolvedReason, BlobValue, SsotSelection, ArtifactType as ResolverArtifactType, } from './artifact-resolver.js';
 export { matchGlob, globToRegExp } from './resolver-glob.js';

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/cjs/index.js

@@ -23,8 +23,8 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.classifyByName = exports.resolveArtifacts = exports.RESIDUAL_UNCONDITIONAL_WRITE = exports.conditionalWriteResidual = exports.tokensEqual = exports.buildConditionalWriteBasis = exports.buildFreshnessBasis = exports.collectFreshnessCallContext = exports.artifactIdsForResolve = exports.isWriteStyleCall = exports.freshnessAllowsEnforce = exports.computePathSetTreeHash = exports.contentByteIdentical = exports.assessWriteStylePrior = exports.assessFreshness = exports.deriveProofBanner = exports.attachProofToAgentResponse = exports.renderFinalAnswerProof = exports.EXECUTION_PROOF_SPEC = exports.assertEnforcedReceiptInvariant = exports.hashExecutionResult = exports.buildExecutionProof = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.EXECUTION_TIME_FP_REASONS = exports.computeCanonicalBundleFingerprint = exports.authorizedFingerprintFromEnvelope = exports.checkExecutionTimeFingerprint = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.RECEIPT_PREV_NULL = exports.decodeReceiptBodyPrev = exports.previousReceiptCommitment = exports.verifyReceiptChainLinkage = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
-exports.defaultSerializeGeminiToolResult = exports.bindGeminiGuardOutcome = exports.protectedToolToFunctionDeclaration = exports.toGeminiTools = exports.geminiToolAdapter = exports.withCodeRiftsGemini = exports.defaultSerializeLangGraphToolResult = exports.bindLangGraphGuardOutcome = exports.protectedToolToLangGraph = exports.toLangGraphTools = exports.langGraphToolAdapter = exports.withCodeRiftsLangGraph = exports.defaultSerializeAnthropicToolResult = exports.bindAnthropicGuardOutcome = exports.protectedToolToAnthropic = exports.toAnthropicTools = exports.anthropicToolAdapter = exports.withCodeRiftsAnthropic = exports.defaultSerializeOpenAIToolResult = exports.bindOpenAIGuardOutcome = exports.protectedToolToOpenAI = exports.toOpenAITools = exports.openAIToolAdapter = exports.withCodeRiftsOpenAI = exports.guardedFractionAmongRoutes = exports.foldTableSettledCalls = exports.withCodeRifts = exports.coverageReport = exports.DEPLOY_REPAIRABLE_REASONS = exports.bindDeploy = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.blobMapKey = void 0;
+exports.StaleVersionTokenAbort = exports.executeIfUnchanged = exports.RESIDUAL_UNCONDITIONAL_WRITE = exports.conditionalWriteResidual = exports.tokensEqual = exports.buildConditionalWriteBasis = exports.buildFreshnessBasis = exports.collectFreshnessCallContext = exports.artifactIdsForResolve = exports.isWriteStyleCall = exports.freshnessAllowsEnforce = exports.computePathSetTreeHash = exports.contentByteIdentical = exports.assessWriteStylePrior = exports.assessFreshness = exports.deriveProofBanner = exports.attachProofToAgentResponse = exports.renderFinalAnswerProof = exports.EXECUTION_PROOF_SPEC = exports.assertEnforcedReceiptInvariant = exports.hashExecutionResult = exports.buildExecutionProof = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.EXECUTION_TIME_FP_REASONS = exports.computeCanonicalBundleFingerprint = exports.authorizedFingerprintFromEnvelope = exports.checkExecutionTimeFingerprint = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.RECEIPT_PREV_NULL = exports.decodeReceiptBodyPrev = exports.previousReceiptCommitment = exports.verifyReceiptChainLinkage = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
+exports.defaultSerializeGeminiToolResult = exports.bindGeminiGuardOutcome = exports.protectedToolToFunctionDeclaration = exports.toGeminiTools = exports.geminiToolAdapter = exports.withCodeRiftsGemini = exports.defaultSerializeLangGraphToolResult = exports.bindLangGraphGuardOutcome = exports.protectedToolToLangGraph = exports.toLangGraphTools = exports.langGraphToolAdapter = exports.withCodeRiftsLangGraph = exports.defaultSerializeAnthropicToolResult = exports.bindAnthropicGuardOutcome = exports.protectedToolToAnthropic = exports.toAnthropicTools = exports.anthropicToolAdapter = exports.withCodeRiftsAnthropic = exports.defaultSerializeOpenAIToolResult = exports.bindOpenAIGuardOutcome = exports.protectedToolToOpenAI = exports.toOpenAITools = exports.openAIToolAdapter = exports.withCodeRiftsOpenAI = exports.guardedFractionAmongRoutes = exports.foldTableSettledCalls = exports.withCodeRifts = exports.coverageReport = exports.DEPLOY_REPAIRABLE_REASONS = exports.bindDeploy = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.blobMapKey = exports.classifyByName = exports.resolveArtifacts = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = exports.fsTokenContentHash = exports.createFsPriorContentResolver = exports.writeFileIfUnchanged = exports.readVersionedFile = exports.createFsVersionToken = void 0;
 var guard_js_1 = require("./guard.js");
 Object.defineProperty(exports, "guardToolCall", { enumerable: true, get: function () { return guard_js_1.guardToolCall; } });
 var detector_js_1 = require("./detector.js");
@@ -92,12 +92,24 @@ Object.defineProperty(exports, "isWriteStyleCall", { enumerable: true, get: func
 Object.defineProperty(exports, "artifactIdsForResolve", { enumerable: true, get: function () { return freshness_js_1.artifactIdsForResolve; } });
 Object.defineProperty(exports, "collectFreshnessCallContext", { enumerable: true, get: function () { return freshness_js_1.collectFreshnessCallContext; } });
 Object.defineProperty(exports, "buildFreshnessBasis", { enumerable: true, get: function () { return freshness_js_1.buildFreshnessBasis; } });
-// Conditional-write surface (reporting only — package never writes). Opt-in requireConditionalWrite.
+// Conditional-write surface (reporting + host helper executeIfUnchanged). Opt-in requireConditionalWrite.
+// The package still never invents business writes — adapters perform I/O under the helper.
 var conditional_write_js_1 = require("./conditional-write.js");
 Object.defineProperty(exports, "buildConditionalWriteBasis", { enumerable: true, get: function () { return conditional_write_js_1.buildConditionalWriteBasis; } });
 Object.defineProperty(exports, "tokensEqual", { enumerable: true, get: function () { return conditional_write_js_1.tokensEqual; } });
 Object.defineProperty(exports, "conditionalWriteResidual", { enumerable: true, get: function () { return conditional_write_js_1.conditionalWriteResidual; } });
 Object.defineProperty(exports, "RESIDUAL_UNCONDITIONAL_WRITE", { enumerable: true, get: function () { return conditional_write_js_1.RESIDUAL_UNCONDITIONAL_WRITE; } });
+Object.defineProperty(exports, "executeIfUnchanged", { enumerable: true, get: function () { return conditional_write_js_1.executeIfUnchanged; } });
+Object.defineProperty(exports, "StaleVersionTokenAbort", { enumerable: true, get: function () { return conditional_write_js_1.StaleVersionTokenAbort; } });
+// Filesystem CAS adapter (mtime + content-hash token, atomic rename). First execution-state CAS enabler.
+var fs_js_1 = require("./cas-adapters/fs.js");
+Object.defineProperty(exports, "createFsVersionToken", { enumerable: true, get: function () { return fs_js_1.createFsVersionToken; } });
+Object.defineProperty(exports, "readVersionedFile", { enumerable: true, get: function () { return fs_js_1.readVersionedFile; } });
+Object.defineProperty(exports, "writeFileIfUnchanged", { enumerable: true, get: function () { return fs_js_1.writeFileIfUnchanged; } });
+Object.defineProperty(exports, "createFsPriorContentResolver", { enumerable: true, get: function () { return fs_js_1.createFsPriorContentResolver; } });
+Object.defineProperty(exports, "fsTokenContentHash", { enumerable: true, get: function () { return fs_js_1.fsTokenContentHash; } });
+Object.defineProperty(exports, "FS_VERSION_TOKEN_PREFIX", { enumerable: true, get: function () { return fs_js_1.FS_VERSION_TOKEN_PREFIX; } });
+Object.defineProperty(exports, "FS_ABSENT_TOKEN", { enumerable: true, get: function () { return fs_js_1.FS_ABSENT_TOKEN; } });
 // artifactResolver — automatic base/head contract artifacts from a pure git snapshot (upstream of
 // preflight; produces artifacts, never decides). Companion to MISSING_ARTIFACT_CONTENT.
 var artifact_resolver_js_1 = require("./artifact-resolver.js");

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,wGAAwG;AACxG,uDAK4B;AAJ1B,6HAAA,yBAAyB,OAAA;AACzB,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,qHAAA,iBAAiB,OAAA;AAMnB,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,6GAA6G;AAC7G,iFAKyC;AAJvC,8IAAA,6BAA6B,OAAA;AAC7B,kJAAA,iCAAiC,OAAA;AACjC,kJAAA,iCAAiC,OAAA;AACjC,0IAAA,yBAAyB,OAAA;AAQ3B,+FAA+F;AAC/F,6FAA6F;AAC7F,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AA8B9E,8FAA8F;AAC9F,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,yHAAA,mBAAmB,OAAA;AACnB,oIAAA,8BAA8B,OAAA;AAC9B,0HAAA,oBAAoB,OAAA;AAGtB,2FAA2F;AAC3F,sFAAsF;AACtF,iEAIiC;AAH/B,+HAAA,sBAAsB,OAAA;AACtB,mIAAA,0BAA0B,OAAA;AAC1B,0HAAA,iBAAiB,OAAA;AASnB,mGAAmG;AACnG,+CAUwB;AATtB,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,oHAAA,oBAAoB,OAAA;AACpB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,gHAAA,gBAAgB,OAAA;AAChB,qHAAA,qBAAqB,OAAA;AACrB,2HAAA,2BAA2B,OAAA;AAC3B,mHAAA,mBAAmB,OAAA;AAgBrB,qGAAqG;AACrG,+DAKgC;AAJ9B,kIAAA,0BAA0B,OAAA;AAC1B,mHAAA,WAAW,OAAA;AACX,gIAAA,wBAAwB,OAAA;AACxB,oIAAA,4BAA4B,OAAA;AAU9B,kGAAkG;AAClG,wFAAwF;AACxF,+DAAiG;AAAxF,wHAAA,OAAO,OAAoB;AAAE,sHAAA,cAAc,OAAA;AAAE,kHAAA,UAAU,OAAA;AAKhE,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAA8C;AAArC,4GAAA,UAAU,OAAA;AAKnB,yGAAyG;AACzG,mDAAyE;AAAhE,4GAAA,UAAU,OAAA;AAAE,2HAAA,yBAAyB,OAAA;AAK9C,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA;AAOvB,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,yDAI6B;AAH3B,kHAAA,aAAa,OAAA;AACb,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAQ5B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAUlC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,8FAA8F;AAC9F,wGAAwG;AACxG,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,+HAAA,kCAAkC,OAAA;AAClC,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,wGAAwG;AACxG,uDAK4B;AAJ1B,6HAAA,yBAAyB,OAAA;AACzB,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,qHAAA,iBAAiB,OAAA;AAMnB,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,6GAA6G;AAC7G,iFAKyC;AAJvC,8IAAA,6BAA6B,OAAA;AAC7B,kJAAA,iCAAiC,OAAA;AACjC,kJAAA,iCAAiC,OAAA;AACjC,0IAAA,yBAAyB,OAAA;AAQ3B,+FAA+F;AAC/F,6FAA6F;AAC7F,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AA8B9E,8FAA8F;AAC9F,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,yHAAA,mBAAmB,OAAA;AACnB,oIAAA,8BAA8B,OAAA;AAC9B,0HAAA,oBAAoB,OAAA;AAGtB,2FAA2F;AAC3F,sFAAsF;AACtF,iEAIiC;AAH/B,+HAAA,sBAAsB,OAAA;AACtB,mIAAA,0BAA0B,OAAA;AAC1B,0HAAA,iBAAiB,OAAA;AASnB,mGAAmG;AACnG,+CAUwB;AATtB,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,oHAAA,oBAAoB,OAAA;AACpB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,gHAAA,gBAAgB,OAAA;AAChB,qHAAA,qBAAqB,OAAA;AACrB,2HAAA,2BAA2B,OAAA;AAC3B,mHAAA,mBAAmB,OAAA;AAgBrB,0GAA0G;AAC1G,2FAA2F;AAC3F,+DAOgC;AAN9B,kIAAA,0BAA0B,OAAA;AAC1B,mHAAA,WAAW,OAAA;AACX,gIAAA,wBAAwB,OAAA;AACxB,oIAAA,4BAA4B,OAAA;AAC5B,0HAAA,kBAAkB,OAAA;AAClB,8HAAA,sBAAsB,OAAA;AAYxB,yGAAyG;AACzG,8CAQ8B;AAP5B,6GAAA,oBAAoB,OAAA;AACpB,0GAAA,iBAAiB,OAAA;AACjB,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AAEjB,kGAAkG;AAClG,wFAAwF;AACxF,+DAAiG;AAAxF,wHAAA,OAAO,OAAoB;AAAE,sHAAA,cAAc,OAAA;AAAE,kHAAA,UAAU,OAAA;AAKhE,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAA8C;AAArC,4GAAA,UAAU,OAAA;AAKnB,yGAAyG;AACzG,mDAAyE;AAAhE,4GAAA,UAAU,OAAA;AAAE,2HAAA,yBAAyB,OAAA;AAK9C,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA;AAOvB,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,yDAI6B;AAH3B,kHAAA,aAAa,OAAA;AACb,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAQ5B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAUlC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,8FAA8F;AAC9F,wGAAwG;AACxG,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,+HAAA,kCAAkC,OAAA;AAClC,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA"}

package/dist/esm/cas-adapters/fs.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+import { tokensEqual, type ExecuteIfUnchangedOutcome, type VersionToken, type VersionedContent } from '../conditional-write.js';
+import type { PriorContentResolver } from '../freshness.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export declare const FS_VERSION_TOKEN_PREFIX = "fs:v1:";
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+export declare const FS_ABSENT_TOKEN: VersionToken;
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+export declare function fsTokenContentHash(token: VersionToken | null | undefined): string | null;
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+export declare function createFsVersionToken(filePath: string): Promise<VersionToken>;
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+export declare function readVersionedFile(filePath: string): Promise<VersionedContent>;
+export type WriteFileIfUnchangedArgs = {
+    path: string;
+    /** Token measured before the host decided to write (from createFsVersionToken). */
+    expected_token: VersionToken;
+    /** Full new file contents (utf8 string or Buffer). */
+    content: string | Buffer;
+};
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export declare function writeFileIfUnchanged(args: WriteFileIfUnchangedArgs): Promise<ExecuteIfUnchangedOutcome<{
+    path: string;
+    bytes: number;
+    written_content_hash: string;
+}>>;
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+export declare function createFsPriorContentResolver(options?: {
+    /**
+     * Map artifactId → absolute or relative file path.
+     * If omitted, uses req.path or arguments-style path when provided on the resolve request.
+     */
+    pathForArtifact?: (artifactId: string) => string | null | undefined;
+}): PriorContentResolver;
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=fs.d.ts.map

package/dist/esm/cas-adapters/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAGL,WAAW,EACX,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,YAA6B,CAAC;AAM5D,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBlF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAOnF;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,cAAc,EAAE,YAAY,CAAC;IAC7B,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAsDnG;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACrE,GAAG,oBAAoB,CAoBvB;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/esm/cas-adapters/fs.js

@@ -0,0 +1,185 @@
+/**
+ * Filesystem CAS adapter — mtime + content-hash VersionToken and atomic-rename write.
+ *
+ * Uses the host contract helper executeIfUnchanged (conditional-write.ts). Does not invent
+ * a parallel outcome shape. Token format is opaque to the guard (string equality only).
+ *
+ * Token encoding (this adapter only; not interpreted by the core):
+ *   fs:v1:<mtime_ms>:<sha256_hex_of_file_bytes>
+ * Missing file → createFsVersionToken still works for "absent" via a dedicated absent token
+ * only if we choose; for create we require the file to exist (ENOENT throws) so hosts
+ * measure an existing prior. For write of new files, expected_token may be ABSENT_TOKEN.
+ */
+'use strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { promises as fsp } from 'node:fs';
+import * as path from 'node:path';
+import { executeIfUnchanged, StaleVersionTokenAbort, tokensEqual, } from '../conditional-write.js';
+/** Prefix for this adapter's opaque tokens (equality-only outside this module). */
+export const FS_VERSION_TOKEN_PREFIX = 'fs:v1:';
+/**
+ * Token used when the path does not exist yet (create-if-absent CAS).
+ * Hosts that measured absence should pass this as expected_token for first write.
+ */
+export const FS_ABSENT_TOKEN = 'fs:v1:absent';
+function sha256hex(buf) {
+    return createHash('sha256').update(buf).digest('hex');
+}
+/** Extract content-hash segment from an fs:v1 token (null if absent/malformed). */
+export function fsTokenContentHash(token) {
+    if (typeof token !== 'string' || !token.startsWith(FS_VERSION_TOKEN_PREFIX))
+        return null;
+    if (token === FS_ABSENT_TOKEN)
+        return null;
+    const rest = token.slice(FS_VERSION_TOKEN_PREFIX.length);
+    const colon = rest.indexOf(':');
+    if (colon < 0)
+        return null;
+    const hash = rest.slice(colon + 1);
+    return /^[a-f0-9]{64}$/.test(hash) ? hash : null;
+}
+/**
+ * Build a VersionToken from path: mtime (ms) + sha256 of file bytes.
+ * Throws on I/O errors other than callers may catch. ENOENT → returns FS_ABSENT_TOKEN
+ * so hosts can CAS create vs create-raced.
+ */
+export async function createFsVersionToken(filePath) {
+    let st;
+    try {
+        st = await fsp.stat(filePath);
+    }
+    catch (err) {
+        const code = err && typeof err === 'object' && 'code' in err
+            ? String(err.code)
+            : '';
+        if (code === 'ENOENT')
+            return FS_ABSENT_TOKEN;
+        throw err;
+    }
+    if (!st.isFile()) {
+        // Directories / specials are not content CAS targets for this adapter.
+        throw new Error(`createFsVersionToken: not a regular file: ${filePath}`);
+    }
+    const buf = await fsp.readFile(filePath);
+    const hash = sha256hex(buf);
+    const mtimeMs = Math.trunc(st.mtimeMs);
+    return `${FS_VERSION_TOKEN_PREFIX}${mtimeMs}:${hash}`;
+}
+/**
+ * Read file content + version token for VersionedContent (host reporting / preflight prior).
+ * ENOENT → content '' and FS_ABSENT_TOKEN.
+ */
+export async function readVersionedFile(filePath) {
+    const version_token = await createFsVersionToken(filePath);
+    if (version_token === FS_ABSENT_TOKEN) {
+        return { content: '', version_token };
+    }
+    const content = await fsp.readFile(filePath, 'utf8');
+    return { content, version_token };
+}
+/**
+ * Conditional write: re-stat+re-hash; if token matches expected → temp file + atomic rename.
+ *
+ * MEASURED windows (pre-fix, 2fcd74e-era):
+ *   1. executeIfUnchanged: current_token() then await write() — no re-check in between.
+ *   2. write(): writeFile(tmp) then rename(tmp,target) with NO re-stat of target before rename
+ *      (fs.ts former lines 106–108) — concurrent mutation of target is clobbered by rename.
+ *
+ * Closures:
+ *   - Pre-rename: re-createFsVersionToken(target); on mismatch abort rename, unlink tmp,
+ *     throw StaleVersionTokenAbort → refused/stale_version_token (write did not land).
+ *   - Post-rename: detect_stale_during_commit — content-hash of path must match sha256(body);
+ *     mismatch → committed_stale_detected (write landed; someone overwrote after rename).
+ *
+ * Wired through executeIfUnchanged — not a parallel path.
+ */
+export async function writeFileIfUnchanged(args) {
+    const target = path.resolve(args.path);
+    const body = typeof args.content === 'string' ? Buffer.from(args.content, 'utf8') : args.content;
+    const writtenHash = sha256hex(body);
+    return executeIfUnchanged({
+        expected_token: args.expected_token,
+        current_token: () => createFsVersionToken(target),
+        detect_stale_during_commit: true,
+        // Post-commit: token content-hash must equal sha256 of what we wrote (mtime may vary).
+        expected_after_commit: async (result) => {
+            // Synthesize a comparable token: re-read path; equality is content-hash based via tokensEqual
+            // only if full token matches — mtime always changes on write, so we return the LIVE post
+            // token only when its hash matches writtenHash; else return a sentinel that cannot match.
+            const post = await createFsVersionToken(target);
+            const postHash = fsTokenContentHash(post);
+            if (postHash === result.written_content_hash)
+                return post;
+            // Force mismatch → committed_stale_detected (detection, not rollback).
+            return `${FS_VERSION_TOKEN_PREFIX}0:stale_during_commit_mismatch`;
+        },
+        write: async () => {
+            const dir = path.dirname(target);
+            await fsp.mkdir(dir, { recursive: true });
+            const tmp = path.join(dir, `.coderifts-cas-${path.basename(target)}-${process.pid}-${randomBytes(6).toString('hex')}.tmp`);
+            try {
+                await fsp.writeFile(tmp, body);
+                // Close pre-rename window: if target moved since the executeIfUnchanged check, do not clobber.
+                const still = await createFsVersionToken(target);
+                if (!tokensEqual(args.expected_token, still)) {
+                    try {
+                        await fsp.unlink(tmp);
+                    }
+                    catch {
+                        /* ignore */
+                    }
+                    throw new StaleVersionTokenAbort(still);
+                }
+                // Atomic replace on same filesystem (POSIX rename; Windows overwrite where supported).
+                await fsp.rename(tmp, target);
+            }
+            catch (err) {
+                if (err instanceof StaleVersionTokenAbort)
+                    throw err;
+                // Best-effort cleanup of temp — never leave partial target from failed rename.
+                try {
+                    await fsp.unlink(tmp);
+                }
+                catch {
+                    /* ignore */
+                }
+                throw err;
+            }
+            return { path: target, bytes: body.length, written_content_hash: writtenHash };
+        },
+    });
+}
+/**
+ * Opt-in PriorContentResolver that reads a file path from tool arguments.
+ * Returns file utf8 content for freshness measurement (string only — tokens travel separately
+ * via versioned_content / conditioned_on_token on the call context).
+ *
+ * Plug-in: pass as GuardConfig.resolvePriorContent / withCodeRifts({ resolvePriorContent }).
+ */
+export function createFsPriorContentResolver(options) {
+    const pathForArtifact = options?.pathForArtifact;
+    return async (req) => {
+        let filePath = typeof req.path === 'string' && req.path.length > 0 ? req.path : undefined;
+        if (!filePath && pathForArtifact) {
+            const mapped = pathForArtifact(req.artifactId);
+            if (typeof mapped === 'string' && mapped.length > 0)
+                filePath = mapped;
+        }
+        if (!filePath)
+            return null;
+        try {
+            return await fsp.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            const code = err && typeof err === 'object' && 'code' in err
+                ? String(err.code)
+                : '';
+            if (code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    };
+}
+/** Re-export equality helper for hosts comparing tokens without importing core module. */
+export { tokensEqual };
+//# sourceMappingURL=fs.js.map

package/dist/esm/cas-adapters/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/cas-adapters/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,CAAC;AAEb,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,GAIZ,MAAM,yBAAyB,CAAC;AAGjC,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB,cAAc,CAAC;AAE5D,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,KAAsC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;YAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,eAAe,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,GAAG,uBAAuB,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACjG,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,kBAAkB,CAAC;QACxB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACjD,0BAA0B,EAAE,IAAI;QAChC,uFAAuF;QACvF,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,8FAA8F;YAC9F,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,MAAM,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAC1D,uEAAuE;YACvE,OAAO,GAAG,uBAAuB,gCAAgC,CAAC;QACpE,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CACnB,GAAG,EACH,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/F,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/B,+FAA+F;gBAC/F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY;oBACd,CAAC;oBACD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC1C,CAAC;gBACD,uFAAuF;gBACvF,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,sBAAsB;oBAAE,MAAM,GAAG,CAAC;gBACrD,+EAA+E;gBAC/E,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAM5C;IACC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,QAAQ,GACV,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG;gBAC1D,CAAC,CAAC,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/esm/conditional-write.d.ts

@@ -89,4 +89,70 @@ export declare function conditionalWriteResidual(input: {
     writeStyle: boolean;
     conditionalWrite: ConditionalWriteReport;
 }): string | null;
+/**
+ * Outcome of a conditional write attempt.
+ * - committed: write ran under the expected token; post-check (if any) agreed
+ * - refused / stale_version_token: resource token moved BEFORE write; write did NOT run
+ * - committed_stale_detected / stale_during_commit: write DID run, but a post-commit
+ *   re-check found the resource no longer matches the write's expected post-state
+ *   (detection only — not a rollback)
+ */
+export type ExecuteIfUnchangedOutcome<T> = {
+    status: 'committed';
+    result: T;
+    version_token: VersionToken;
+} | {
+    status: 'refused';
+    reason: 'stale_version_token';
+    expected_token: VersionToken;
+    current_token: VersionToken | null;
+} | {
+    status: 'committed_stale_detected';
+    reason: 'stale_during_commit';
+    result: T;
+    expected_token: VersionToken;
+    post_commit_token: VersionToken | null;
+};
+/**
+ * Thrown from write() when the adapter aborts BEFORE applying the mutation
+ * (e.g. pre-rename re-check). executeIfUnchanged maps this to status:'refused'.
+ * Not a public host API — adapters use it to stay on the single helper path.
+ */
+export declare class StaleVersionTokenAbort extends Error {
+    readonly current_token: VersionToken | null;
+    constructor(current_token: VersionToken | null);
+}
+export type ExecuteIfUnchangedArgs<T> = {
+    /** Token the host measured before deciding to write (opaque string). */
+    expected_token: VersionToken;
+    /**
+     * Re-read the resource's token immediately before commit.
+     * Return null when the resource is gone / unreadable (treated as mismatch).
+     */
+    current_token: () => VersionToken | null | Promise<VersionToken | null>;
+    /** Mutation applied ONLY when current_token equals expected_token. */
+    write: () => T | Promise<T>;
+    /**
+     * Opt-in post-commit detection (default false — byte-identical old paths).
+     * When true AND expected_after_commit is provided: after write(), re-read
+     * current_token and compare to expected_after_commit(result). Mismatch →
+     * committed_stale_detected (write already happened; honest report only).
+     *
+     * NOTE: do NOT compare post-commit to expected_token for content-changing
+     * writes — the token is supposed to change. Supply the token of the written state.
+     */
+    detect_stale_during_commit?: boolean;
+    /**
+     * Token that should hold after a successful write (the written state's token).
+     * Required when detect_stale_during_commit is true; ignored otherwise.
+     */
+    expected_after_commit?: (result: T) => VersionToken | null | Promise<VersionToken | null>;
+};
+/**
+ * Host contract helper: re-check version token, then write or refuse.
+ * Equality via tokensEqual only — never interprets token format.
+ * Never throws for stale tokens (returns refused / committed_stale_detected);
+ * write/current_token errors (other than StaleVersionTokenAbort) propagate.
+ */
+export declare function executeIfUnchanged<T>(args: ExecuteIfUnchangedArgs<T>): Promise<ExecuteIfUnchangedOutcome<T>>;
 //# sourceMappingURL=conditional-write.d.ts.map

package/dist/esm/conditional-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB"}
+{"version":3,"file":"conditional-write.d.ts","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iBAAiB,EAAE,sBAAsB,CAAC;IAC1C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,6DAA6D;IAC7D,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,iBAAiB,CAAC,EAAE,sBAAsB,CAAC;IAC3C,oBAAoB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,WAAW,CACzB,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAClC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AASD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;CAC1C,GAAG;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,mDAAmD;IACnD,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,CAgCA;AAED,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,iDAAiD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,uBAAuB,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,GAAG,MAAM,GAAG,IAAI,CAKhB;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IACnC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,aAAa,EAAE,YAAY,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC,GACD;IACE,MAAM,EAAE,0BAA0B,CAAC;IACnC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,cAAc,EAAE,YAAY,CAAC;IAC7B,iBAAiB,EAAE,YAAY,GAAG,IAAI,CAAC;CACxC,CAAC;AAEN;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;gBAChC,aAAa,EAAE,YAAY,GAAG,IAAI;CAK/C;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAAI;IACtC,wEAAwE;IACxE,cAAc,EAAE,YAAY,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACxE,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B;;;;;;;;OAQG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,CAAC,KACN,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAmDvC"}

package/dist/esm/conditional-write.js

@@ -88,4 +88,73 @@ export function conditionalWriteResidual(input) {
         return null;
     return RESIDUAL_UNCONDITIONAL_WRITE;
 }
+/**
+ * Thrown from write() when the adapter aborts BEFORE applying the mutation
+ * (e.g. pre-rename re-check). executeIfUnchanged maps this to status:'refused'.
+ * Not a public host API — adapters use it to stay on the single helper path.
+ */
+export class StaleVersionTokenAbort extends Error {
+    current_token;
+    constructor(current_token) {
+        super('stale_version_token');
+        this.name = 'StaleVersionTokenAbort';
+        this.current_token = current_token;
+    }
+}
+/**
+ * Host contract helper: re-check version token, then write or refuse.
+ * Equality via tokensEqual only — never interprets token format.
+ * Never throws for stale tokens (returns refused / committed_stale_detected);
+ * write/current_token errors (other than StaleVersionTokenAbort) propagate.
+ */
+export async function executeIfUnchanged(args) {
+    const expected = args.expected_token;
+    if (typeof expected !== 'string' || expected.length === 0) {
+        return {
+            status: 'refused',
+            reason: 'stale_version_token',
+            expected_token: typeof expected === 'string' ? expected : '',
+            current_token: null,
+        };
+    }
+    const current = await args.current_token();
+    if (!tokensEqual(expected, current)) {
+        return {
+            status: 'refused',
+            reason: 'stale_version_token',
+            expected_token: expected,
+            current_token: current == null ? null : current,
+        };
+    }
+    let result;
+    try {
+        result = await args.write();
+    }
+    catch (err) {
+        if (err instanceof StaleVersionTokenAbort) {
+            return {
+                status: 'refused',
+                reason: 'stale_version_token',
+                expected_token: expected,
+                current_token: err.current_token,
+            };
+        }
+        throw err;
+    }
+    // Post-commit detection (best-effort honesty, not prevention).
+    if (args.detect_stale_during_commit === true && typeof args.expected_after_commit === 'function') {
+        const want = await args.expected_after_commit(result);
+        const post = await args.current_token();
+        if (!tokensEqual(want, post)) {
+            return {
+                status: 'committed_stale_detected',
+                reason: 'stale_during_commit',
+                result,
+                expected_token: expected,
+                post_commit_token: post == null ? null : post,
+            };
+        }
+    }
+    return { status: 'committed', result, version_token: expected };
+}
 //# sourceMappingURL=conditional-write.js.map

package/dist/esm/conditional-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;AAiDb,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;KACZ,CAAC;IAEF,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,WAAW,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,4BAA4B,CAAC;AACtC,CAAC"}
+{"version":3,"file":"conditional-write.js","sourceRoot":"","sources":["../../src/conditional-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,YAAY,CAAC;AAiDb,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CACzB,CAAkC,EAClC,CAAkC;IAElC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAClD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IAKC,MAAM,yBAAyB,GAAG,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAEjE,MAAM,KAAK,GAA0B;QACnC,iBAAiB;QACjB,yBAAyB;QACzB,WAAW;KACZ,CAAC;IAEF,2FAA2F;IAC3F,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;YACjD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACxD,CAAC;aAAM,IACL,GAAG,CAAC,iBAAiB;eAClB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;eACzC,OAAO,GAAG,CAAC,iBAAiB,CAAC,aAAa,KAAK,QAAQ,EAC1D,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC;QACnE,CAAC;aAAM,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,WAAW,IAAI,yBAAyB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,4BAA4B,GAAG,8CAA8C,CAAC;AAE3F;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,4BAA4B,CAAC;AACtC,CAAC;AA8BD;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,aAAa,CAAsB;IAC5C,YAAY,aAAkC;QAC5C,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AA+BD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC5D,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qBAAqB;YAC7B,cAAc,EAAE,QAAQ;YACxB,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC;IAED,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,QAAQ;gBACxB,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,0BAA0B;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,MAAM;gBACN,cAAc,EAAE,QAAQ;gBACxB,iBAAiB,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC"}

package/dist/esm/index.d.ts

@@ -41,8 +41,9 @@ export { renderFinalAnswerProof, attachProofToAgentResponse, deriveProofBanner,
 export type { RenderFinalAnswerProofOptions, AttachProofToAgentResponseOptions, FinalAnswerProofFormat, FinalAnswerProofBanner, } from './final-answer-proof.js';
 export { assessFreshness, assessWriteStylePrior, contentByteIdentical, computePathSetTreeHash, freshnessAllowsEnforce, isWriteStyleCall, artifactIdsForResolve, collectFreshnessCallContext, buildFreshnessBasis, } from './freshness.js';
 export type { FreshnessOutcome, FreshnessCheckLevel, FreshnessAssessInput, FreshnessAssessResult, WriteStylePriorInput, WriteStylePriorResult, FreshnessWiringState, FreshnessBasis, FreshnessCallContext, PriorContentResolver, FreshnessDegradeReason, } from './freshness.js';
-export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, } from './conditional-write.js';
-export type { VersionToken, VersionedContent, ConditionalWriteReport, ConditionalWriteBasis, ConditionalWriteCallContext, } from './conditional-write.js';
+export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, executeIfUnchanged, StaleVersionTokenAbort, } from './conditional-write.js';
+export type { VersionToken, VersionedContent, ConditionalWriteReport, ConditionalWriteBasis, ConditionalWriteCallContext, ExecuteIfUnchangedOutcome, ExecuteIfUnchangedArgs, } from './conditional-write.js';
+export { createFsVersionToken, readVersionedFile, writeFileIfUnchanged, createFsPriorContentResolver, fsTokenContentHash, FS_VERSION_TOKEN_PREFIX, FS_ABSENT_TOKEN, } from './cas-adapters/fs.js';
 export { resolve as resolveArtifacts, classifyByName, blobMapKey } from './artifact-resolver.js';
 export type { ResolveInput, ResolveConfig, ResolveResult, ResolvedArtifact, ResolveCoverage, UnresolvedEntry, UnresolvedReason, BlobValue, SsotSelection, ArtifactType as ResolverArtifactType, } from './artifact-resolver.js';
 export { matchGlob, globToRegExp } from './resolver-glob.js';

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/esm/index.js

@@ -44,8 +44,11 @@ export { buildExecutionProof, hashExecutionResult, assertEnforcedReceiptInvarian
 export { renderFinalAnswerProof, attachProofToAgentResponse, deriveProofBanner, } from './final-answer-proof.js';
 // Freshness: pure assess + runner collect (values into guardToolCall). Opt-in resolvePriorContent.
 export { assessFreshness, assessWriteStylePrior, contentByteIdentical, computePathSetTreeHash, freshnessAllowsEnforce, isWriteStyleCall, artifactIdsForResolve, collectFreshnessCallContext, buildFreshnessBasis, } from './freshness.js';
-// Conditional-write surface (reporting only — package never writes). Opt-in requireConditionalWrite.
-export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, } from './conditional-write.js';
+// Conditional-write surface (reporting + host helper executeIfUnchanged). Opt-in requireConditionalWrite.
+// The package still never invents business writes — adapters perform I/O under the helper.
+export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, executeIfUnchanged, StaleVersionTokenAbort, } from './conditional-write.js';
+// Filesystem CAS adapter (mtime + content-hash token, atomic rename). First execution-state CAS enabler.
+export { createFsVersionToken, readVersionedFile, writeFileIfUnchanged, createFsPriorContentResolver, fsTokenContentHash, FS_VERSION_TOKEN_PREFIX, FS_ABSENT_TOKEN, } from './cas-adapters/fs.js';
 // artifactResolver — automatic base/head contract artifacts from a pure git snapshot (upstream of
 // preflight; produces artifacts, never decides). Companion to MISSING_ARTIFACT_CONTENT.
 export { resolve as resolveArtifacts, classifyByName, blobMapKey } from './artifact-resolver.js';

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,wGAAwG;AACxG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAK5B,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,6GAA6G;AAC7G,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAOzC,+FAA+F;AAC/F,6FAA6F;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AA6B5B,8FAA8F;AAC9F,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,2FAA2F;AAC3F,sFAAsF;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAQjC,mGAAmG;AACnG,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAexB,qGAAqG;AACrG,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAShC,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKjG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,yGAAyG;AACzG,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAKzE,uGAAuG;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOtD,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAO7B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAS9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,8FAA8F;AAC9F,wGAAwG;AACxG,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,2FAA2F;AAC3F,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7F,wGAAwG;AACxG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAK5B,sGAAsG;AACtG,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE1G,6GAA6G;AAC7G,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAOzC,+FAA+F;AAC/F,6FAA6F;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,+FAA+F;AAC/F,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AA6B5B,8FAA8F;AAC9F,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,2FAA2F;AAC3F,sFAAsF;AACtF,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAQjC,mGAAmG;AACnG,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAexB,0GAA0G;AAC1G,2FAA2F;AAC3F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAWhC,yGAAyG;AACzG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,kGAAkG;AAClG,wFAAwF;AACxF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKjG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7D,qGAAqG;AACrG,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAalF,uGAAuG;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,oGAAoG;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,yGAAyG;AACzG,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAKzE,uGAAuG;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOtD,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAO7B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAS9B,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AASjC,8FAA8F;AAC9F,wGAAwG;AACxG,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderifts/agent-guard",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "Fail-closed guard for AI agent tool calls — preflight contract changes before they execute. Security core frozen (agent-guard-api v1.0); v1.1 adds client-side enforcement: receipt→envelope binding, decision↔action reconciliation, safe_for_agent + degraded fail-closed, and enforced⟺executed (P0 client-enforcement pack).",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",