@coderifts/agent-guard 6.2.0 → 6.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +36 -10
- package/dist/cjs/cas-adapters/api.d.ts +94 -0
- package/dist/cjs/cas-adapters/api.d.ts.map +1 -0
- package/dist/cjs/cas-adapters/api.js +120 -0
- package/dist/cjs/cas-adapters/api.js.map +1 -0
- package/dist/cjs/cas-adapters/db.d.ts +93 -0
- package/dist/cjs/cas-adapters/db.d.ts.map +1 -0
- package/dist/cjs/cas-adapters/db.js +139 -0
- package/dist/cjs/cas-adapters/db.js.map +1 -0
- package/dist/cjs/cas-adapters/registry.d.ts +88 -0
- package/dist/cjs/cas-adapters/registry.d.ts.map +1 -0
- package/dist/cjs/cas-adapters/registry.js +120 -0
- package/dist/cjs/cas-adapters/registry.js.map +1 -0
- package/dist/cjs/cas-attestation.d.ts +94 -0
- package/dist/cjs/cas-attestation.d.ts.map +1 -0
- package/dist/cjs/cas-attestation.js +133 -0
- package/dist/cjs/cas-attestation.js.map +1 -0
- package/dist/cjs/deploy-gate.d.ts +10 -1
- package/dist/cjs/deploy-gate.d.ts.map +1 -1
- package/dist/cjs/deploy-gate.js +14 -10
- package/dist/cjs/deploy-gate.js.map +1 -1
- package/dist/cjs/execute-tool-call.d.ts +100 -0
- package/dist/cjs/execute-tool-call.d.ts.map +1 -0
- package/dist/cjs/execute-tool-call.js +334 -0
- package/dist/cjs/execute-tool-call.js.map +1 -0
- package/dist/cjs/execution-time-fingerprint.d.ts +8 -0
- package/dist/cjs/execution-time-fingerprint.d.ts.map +1 -1
- package/dist/cjs/execution-time-fingerprint.js +13 -1
- package/dist/cjs/execution-time-fingerprint.js.map +1 -1
- package/dist/cjs/guard.d.ts.map +1 -1
- package/dist/cjs/guard.js +28 -9
- package/dist/cjs/guard.js.map +1 -1
- package/dist/cjs/index.d.ts +13 -1
- package/dist/cjs/index.d.ts.map +1 -1
- package/dist/cjs/index.js +51 -2
- package/dist/cjs/index.js.map +1 -1
- package/dist/cjs/merge-gate.d.ts +8 -0
- package/dist/cjs/merge-gate.d.ts.map +1 -1
- package/dist/cjs/merge-gate.js +19 -12
- package/dist/cjs/merge-gate.js.map +1 -1
- package/dist/cjs/remediation-loop-attestation.d.ts +125 -0
- package/dist/cjs/remediation-loop-attestation.d.ts.map +1 -0
- package/dist/cjs/remediation-loop-attestation.js +186 -0
- package/dist/cjs/remediation-loop-attestation.js.map +1 -0
- package/dist/cjs/types.d.ts +20 -3
- package/dist/cjs/types.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.d.ts +9 -0
- package/dist/cjs/with-coderifts.d.ts.map +1 -1
- package/dist/cjs/with-coderifts.js +3 -0
- package/dist/cjs/with-coderifts.js.map +1 -1
- package/dist/esm/cas-adapters/api.d.ts +94 -0
- package/dist/esm/cas-adapters/api.d.ts.map +1 -0
- package/dist/esm/cas-adapters/api.js +116 -0
- package/dist/esm/cas-adapters/api.js.map +1 -0
- package/dist/esm/cas-adapters/db.d.ts +93 -0
- package/dist/esm/cas-adapters/db.d.ts.map +1 -0
- package/dist/esm/cas-adapters/db.js +135 -0
- package/dist/esm/cas-adapters/db.js.map +1 -0
- package/dist/esm/cas-adapters/registry.d.ts +88 -0
- package/dist/esm/cas-adapters/registry.d.ts.map +1 -0
- package/dist/esm/cas-adapters/registry.js +116 -0
- package/dist/esm/cas-adapters/registry.js.map +1 -0
- package/dist/esm/cas-attestation.d.ts +94 -0
- package/dist/esm/cas-attestation.d.ts.map +1 -0
- package/dist/esm/cas-attestation.js +127 -0
- package/dist/esm/cas-attestation.js.map +1 -0
- package/dist/esm/deploy-gate.d.ts +10 -1
- package/dist/esm/deploy-gate.d.ts.map +1 -1
- package/dist/esm/deploy-gate.js +14 -10
- package/dist/esm/deploy-gate.js.map +1 -1
- package/dist/esm/execute-tool-call.d.ts +100 -0
- package/dist/esm/execute-tool-call.d.ts.map +1 -0
- package/dist/esm/execute-tool-call.js +325 -0
- package/dist/esm/execute-tool-call.js.map +1 -0
- package/dist/esm/execution-time-fingerprint.d.ts +8 -0
- package/dist/esm/execution-time-fingerprint.d.ts.map +1 -1
- package/dist/esm/execution-time-fingerprint.js +11 -0
- package/dist/esm/execution-time-fingerprint.js.map +1 -1
- package/dist/esm/guard.d.ts.map +1 -1
- package/dist/esm/guard.js +29 -10
- package/dist/esm/guard.js.map +1 -1
- package/dist/esm/index.d.ts +13 -1
- package/dist/esm/index.d.ts.map +1 -1
- package/dist/esm/index.js +16 -1
- package/dist/esm/index.js.map +1 -1
- package/dist/esm/merge-gate.d.ts +8 -0
- package/dist/esm/merge-gate.d.ts.map +1 -1
- package/dist/esm/merge-gate.js +19 -12
- package/dist/esm/merge-gate.js.map +1 -1
- package/dist/esm/remediation-loop-attestation.d.ts +125 -0
- package/dist/esm/remediation-loop-attestation.d.ts.map +1 -0
- package/dist/esm/remediation-loop-attestation.js +179 -0
- package/dist/esm/remediation-loop-attestation.js.map +1 -0
- package/dist/esm/types.d.ts +20 -3
- package/dist/esm/types.d.ts.map +1 -1
- package/dist/esm/with-coderifts.d.ts +9 -0
- package/dist/esm/with-coderifts.d.ts.map +1 -1
- package/dist/esm/with-coderifts.js +3 -0
- package/dist/esm/with-coderifts.js.map +1 -1
- package/package.json +1 -1
package/dist/cjs/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,iCAAiC,EACjC,+BAA+B,EAC/B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EACL,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EACnF,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,GAC3G,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,uBAAuB,EACvB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjG,YAAY,EACV,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAC7E,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,IAAI,oBAAoB,GAClG,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EACV,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,UAAU,EACV,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAC9E,UAAU,EAAE,eAAe,EAAE,gBAAgB,GAC9C,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EACV,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAC7E,sBAAsB,EAAE,YAAY,EAAE,gBAAgB,GACvD,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EACV,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,GAC3D,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAClF,eAAe,EAAE,cAAc,EAAE,eAAe,EAChD,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,GACxF,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,2BAA2B,EAC5E,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,kCAAkC,EAClC,sBAAsB,EACtB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,yBAAyB,EACzB,UAAU,EACV,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC"}
|
package/dist/cjs/index.js
CHANGED
|
@@ -23,8 +23,9 @@
|
|
|
23
23
|
* ```
|
|
24
24
|
*/
|
|
25
25
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
26
|
-
exports.
|
|
27
|
-
exports.
|
|
26
|
+
exports.RESIDUAL_UNCONDITIONAL_WRITE = exports.conditionalWriteResidual = exports.tokensEqual = exports.buildConditionalWriteBasis = exports.buildFreshnessBasis = exports.collectFreshnessCallContext = exports.artifactIdsForResolve = exports.isWriteStyleCall = exports.freshnessAllowsEnforce = exports.computePathSetTreeHash = exports.contentByteIdentical = exports.assessWriteStylePrior = exports.assessFreshness = exports.deriveProofBanner = exports.attachProofToAgentResponse = exports.renderFinalAnswerProof = exports.EXECUTION_PROOF_SPEC = exports.assertEnforcedReceiptInvariant = exports.hashExecutionResult = exports.buildExecutionProof = exports.deriveKeySignal = exports.pathClass = exports.classifyCommand = exports.projectState = exports.emptySessionState = exports.computeTainted = exports.evaluate = exports.updateSession = exports.SESSION_TAINT_VERSION = exports.SessionTaintTracker = exports.readDecision = exports.EXECUTION_TIME_FP_REASONS = exports.EXECUTION_STATE_UNMEASURABLE_NOTE = exports.isUnmeasurableExecutionStateReason = exports.computeCanonicalBundleFingerprint = exports.authorizedFingerprintFromEnvelope = exports.checkExecutionTimeFingerprint = exports.computeBundleFingerprint = exports.computeArtifactDigest = exports.evaluateEnvelope = exports.RECEIPT_PREV_NULL = exports.decodeReceiptBodyPrev = exports.previousReceiptCommitment = exports.verifyReceiptChainLinkage = exports.canonicalJson = exports.computeBodyHash = exports.bindReceiptToEnvelope = exports.DETECTOR_VERSION = exports.builtinDetector = exports.guardToolCall = void 0;
|
|
27
|
+
exports.openAIToolAdapter = exports.withCodeRiftsOpenAI = exports.guardedFractionAmongRoutes = exports.foldTableSettledCalls = exports.withCodeRifts = exports.coverageReport = exports.DEPLOY_REPAIRABLE_REASONS = exports.bindDeploy = exports.deployGate = exports.gateDecision = exports.RegistryConstructionError = exports.guardToolRegistry = exports.globToRegExp = exports.matchGlob = exports.blobMapKey = exports.classifyByName = exports.resolveArtifacts = exports.REMEDIATION_LOOP_ATTESTATION_SPEC = exports.isCasAttestation = exports.readPriorBlockRemediation = exports.readRemediationTransaction = exports.buildRemediationLoopAttestation = exports.CAS_ATTESTATION_SPEC = exports.isExecuteIfUnchangedOutcome = exports.isGuardExecutionProof = exports.buildCasAttestation = exports.REGISTRY_ABSENT_TOKEN = exports.REGISTRY_VERSION_TOKEN_PREFIX = exports.registryTokenRaw = exports.writeRegistryIfUnchanged = exports.createRegistryVersionToken = exports.DB_ABSENT_TOKEN = exports.DB_VERSION_TOKEN_PREFIX = exports.dbTokenRaw = exports.writeDbIfUnchanged = exports.createDbVersionToken = exports.API_ABSENT_TOKEN = exports.API_VERSION_TOKEN_PREFIX = exports.apiTokenRaw = exports.writeApiIfUnchanged = exports.createApiVersionToken = exports.FS_ABSENT_TOKEN = exports.FS_VERSION_TOKEN_PREFIX = exports.fsTokenContentHash = exports.createFsPriorContentResolver = exports.writeFileIfUnchanged = exports.readVersionedFile = exports.createFsVersionToken = exports.StaleVersionTokenAbort = exports.executeIfUnchanged = void 0;
|
|
28
|
+
exports.surfaceEnvelopeFields = exports.isGuardOutcome = exports.executeLangGraphToolCall = exports.executeGeminiToolCall = exports.executeAnthropicToolCall = exports.executeOpenAIToolCall = exports.executeProtectedTool = exports.defaultSerializeGeminiToolResult = exports.bindGeminiGuardOutcome = exports.protectedToolToFunctionDeclaration = exports.toGeminiTools = exports.geminiToolAdapter = exports.withCodeRiftsGemini = exports.defaultSerializeLangGraphToolResult = exports.bindLangGraphGuardOutcome = exports.protectedToolToLangGraph = exports.toLangGraphTools = exports.langGraphToolAdapter = exports.withCodeRiftsLangGraph = exports.defaultSerializeAnthropicToolResult = exports.bindAnthropicGuardOutcome = exports.protectedToolToAnthropic = exports.toAnthropicTools = exports.anthropicToolAdapter = exports.withCodeRiftsAnthropic = exports.defaultSerializeOpenAIToolResult = exports.bindOpenAIGuardOutcome = exports.protectedToolToOpenAI = exports.toOpenAITools = void 0;
|
|
28
29
|
var guard_js_1 = require("./guard.js");
|
|
29
30
|
Object.defineProperty(exports, "guardToolCall", { enumerable: true, get: function () { return guard_js_1.guardToolCall; } });
|
|
30
31
|
var detector_js_1 = require("./detector.js");
|
|
@@ -52,6 +53,8 @@ var execution_time_fingerprint_js_1 = require("./execution-time-fingerprint.js")
|
|
|
52
53
|
Object.defineProperty(exports, "checkExecutionTimeFingerprint", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.checkExecutionTimeFingerprint; } });
|
|
53
54
|
Object.defineProperty(exports, "authorizedFingerprintFromEnvelope", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.authorizedFingerprintFromEnvelope; } });
|
|
54
55
|
Object.defineProperty(exports, "computeCanonicalBundleFingerprint", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.computeCanonicalBundleFingerprint; } });
|
|
56
|
+
Object.defineProperty(exports, "isUnmeasurableExecutionStateReason", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.isUnmeasurableExecutionStateReason; } });
|
|
57
|
+
Object.defineProperty(exports, "EXECUTION_STATE_UNMEASURABLE_NOTE", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.EXECUTION_STATE_UNMEASURABLE_NOTE; } });
|
|
55
58
|
Object.defineProperty(exports, "EXECUTION_TIME_FP_REASONS", { enumerable: true, get: function () { return execution_time_fingerprint_js_1.EXECUTION_TIME_FP_REASONS; } });
|
|
56
59
|
// Guard-local readDecision: present-but-unrecognised execution_action does NOT fall through to
|
|
57
60
|
// the decision map (SDK ladder did — that reinvented permission). Missing action still maps.
|
|
@@ -110,6 +113,42 @@ Object.defineProperty(exports, "createFsPriorContentResolver", { enumerable: tru
|
|
|
110
113
|
Object.defineProperty(exports, "fsTokenContentHash", { enumerable: true, get: function () { return fs_js_1.fsTokenContentHash; } });
|
|
111
114
|
Object.defineProperty(exports, "FS_VERSION_TOKEN_PREFIX", { enumerable: true, get: function () { return fs_js_1.FS_VERSION_TOKEN_PREFIX; } });
|
|
112
115
|
Object.defineProperty(exports, "FS_ABSENT_TOKEN", { enumerable: true, get: function () { return fs_js_1.FS_ABSENT_TOKEN; } });
|
|
116
|
+
// HTTP/API CAS adapter — ETag/If-Match discipline; host-injected I/O only (no fetch).
|
|
117
|
+
var api_js_1 = require("./cas-adapters/api.js");
|
|
118
|
+
Object.defineProperty(exports, "createApiVersionToken", { enumerable: true, get: function () { return api_js_1.createApiVersionToken; } });
|
|
119
|
+
Object.defineProperty(exports, "writeApiIfUnchanged", { enumerable: true, get: function () { return api_js_1.writeApiIfUnchanged; } });
|
|
120
|
+
Object.defineProperty(exports, "apiTokenRaw", { enumerable: true, get: function () { return api_js_1.apiTokenRaw; } });
|
|
121
|
+
Object.defineProperty(exports, "API_VERSION_TOKEN_PREFIX", { enumerable: true, get: function () { return api_js_1.API_VERSION_TOKEN_PREFIX; } });
|
|
122
|
+
Object.defineProperty(exports, "API_ABSENT_TOKEN", { enumerable: true, get: function () { return api_js_1.API_ABSENT_TOKEN; } });
|
|
123
|
+
// DB optimistic-lock CAS adapter — version column discipline; host-injected I/O only (no SQL drivers).
|
|
124
|
+
var db_js_1 = require("./cas-adapters/db.js");
|
|
125
|
+
Object.defineProperty(exports, "createDbVersionToken", { enumerable: true, get: function () { return db_js_1.createDbVersionToken; } });
|
|
126
|
+
Object.defineProperty(exports, "writeDbIfUnchanged", { enumerable: true, get: function () { return db_js_1.writeDbIfUnchanged; } });
|
|
127
|
+
Object.defineProperty(exports, "dbTokenRaw", { enumerable: true, get: function () { return db_js_1.dbTokenRaw; } });
|
|
128
|
+
Object.defineProperty(exports, "DB_VERSION_TOKEN_PREFIX", { enumerable: true, get: function () { return db_js_1.DB_VERSION_TOKEN_PREFIX; } });
|
|
129
|
+
Object.defineProperty(exports, "DB_ABSENT_TOKEN", { enumerable: true, get: function () { return db_js_1.DB_ABSENT_TOKEN; } });
|
|
130
|
+
// Registry compareAndSwap CAS adapter — host-injected I/O only (no registry SDKs).
|
|
131
|
+
var registry_js_1 = require("./cas-adapters/registry.js");
|
|
132
|
+
Object.defineProperty(exports, "createRegistryVersionToken", { enumerable: true, get: function () { return registry_js_1.createRegistryVersionToken; } });
|
|
133
|
+
Object.defineProperty(exports, "writeRegistryIfUnchanged", { enumerable: true, get: function () { return registry_js_1.writeRegistryIfUnchanged; } });
|
|
134
|
+
Object.defineProperty(exports, "registryTokenRaw", { enumerable: true, get: function () { return registry_js_1.registryTokenRaw; } });
|
|
135
|
+
Object.defineProperty(exports, "REGISTRY_VERSION_TOKEN_PREFIX", { enumerable: true, get: function () { return registry_js_1.REGISTRY_VERSION_TOKEN_PREFIX; } });
|
|
136
|
+
Object.defineProperty(exports, "REGISTRY_ABSENT_TOKEN", { enumerable: true, get: function () { return registry_js_1.REGISTRY_ABSENT_TOKEN; } });
|
|
137
|
+
// CAS attestation binder — separate cas-attestation.v1 record linking GuardExecutionProof +
|
|
138
|
+
// ExecuteIfUnchangedOutcome. Does not mutate the proof shape (ID781 option A follow-on).
|
|
139
|
+
var cas_attestation_js_1 = require("./cas-attestation.js");
|
|
140
|
+
Object.defineProperty(exports, "buildCasAttestation", { enumerable: true, get: function () { return cas_attestation_js_1.buildCasAttestation; } });
|
|
141
|
+
Object.defineProperty(exports, "isGuardExecutionProof", { enumerable: true, get: function () { return cas_attestation_js_1.isGuardExecutionProof; } });
|
|
142
|
+
Object.defineProperty(exports, "isExecuteIfUnchangedOutcome", { enumerable: true, get: function () { return cas_attestation_js_1.isExecuteIfUnchangedOutcome; } });
|
|
143
|
+
Object.defineProperty(exports, "CAS_ATTESTATION_SPEC", { enumerable: true, get: function () { return cas_attestation_js_1.CAS_ATTESTATION_SPEC; } });
|
|
144
|
+
// Remediation-loop attestation — BLOCK remediation_transaction + ALLOW proof (+ optional CAS).
|
|
145
|
+
// Pure binder; no app-side server-echo remediation_of (future stronger form — see JSDoc).
|
|
146
|
+
var remediation_loop_attestation_js_1 = require("./remediation-loop-attestation.js");
|
|
147
|
+
Object.defineProperty(exports, "buildRemediationLoopAttestation", { enumerable: true, get: function () { return remediation_loop_attestation_js_1.buildRemediationLoopAttestation; } });
|
|
148
|
+
Object.defineProperty(exports, "readRemediationTransaction", { enumerable: true, get: function () { return remediation_loop_attestation_js_1.readRemediationTransaction; } });
|
|
149
|
+
Object.defineProperty(exports, "readPriorBlockRemediation", { enumerable: true, get: function () { return remediation_loop_attestation_js_1.readPriorBlockRemediation; } });
|
|
150
|
+
Object.defineProperty(exports, "isCasAttestation", { enumerable: true, get: function () { return remediation_loop_attestation_js_1.isCasAttestation; } });
|
|
151
|
+
Object.defineProperty(exports, "REMEDIATION_LOOP_ATTESTATION_SPEC", { enumerable: true, get: function () { return remediation_loop_attestation_js_1.REMEDIATION_LOOP_ATTESTATION_SPEC; } });
|
|
113
152
|
// artifactResolver — automatic base/head contract artifacts from a pure git snapshot (upstream of
|
|
114
153
|
// preflight; produces artifacts, never decides). Companion to MISSING_ARTIFACT_CONTENT.
|
|
115
154
|
var artifact_resolver_js_1 = require("./artifact-resolver.js");
|
|
@@ -180,4 +219,14 @@ Object.defineProperty(exports, "toGeminiTools", { enumerable: true, get: functio
|
|
|
180
219
|
Object.defineProperty(exports, "protectedToolToFunctionDeclaration", { enumerable: true, get: function () { return gemini_js_1.protectedToolToFunctionDeclaration; } });
|
|
181
220
|
Object.defineProperty(exports, "bindGeminiGuardOutcome", { enumerable: true, get: function () { return gemini_js_1.bindGeminiGuardOutcome; } });
|
|
182
221
|
Object.defineProperty(exports, "defaultSerializeGeminiToolResult", { enumerable: true, get: function () { return gemini_js_1.defaultSerializeGeminiToolResult; } });
|
|
222
|
+
// Option A safe dispatcher — protected table + one framework tool call → ProofBound* only.
|
|
223
|
+
// Closes manual-binder gap; no parallel guard path (uses ProtectedTool.execute → guardToolCall).
|
|
224
|
+
var execute_tool_call_js_1 = require("./execute-tool-call.js");
|
|
225
|
+
Object.defineProperty(exports, "executeProtectedTool", { enumerable: true, get: function () { return execute_tool_call_js_1.executeProtectedTool; } });
|
|
226
|
+
Object.defineProperty(exports, "executeOpenAIToolCall", { enumerable: true, get: function () { return execute_tool_call_js_1.executeOpenAIToolCall; } });
|
|
227
|
+
Object.defineProperty(exports, "executeAnthropicToolCall", { enumerable: true, get: function () { return execute_tool_call_js_1.executeAnthropicToolCall; } });
|
|
228
|
+
Object.defineProperty(exports, "executeGeminiToolCall", { enumerable: true, get: function () { return execute_tool_call_js_1.executeGeminiToolCall; } });
|
|
229
|
+
Object.defineProperty(exports, "executeLangGraphToolCall", { enumerable: true, get: function () { return execute_tool_call_js_1.executeLangGraphToolCall; } });
|
|
230
|
+
Object.defineProperty(exports, "isGuardOutcome", { enumerable: true, get: function () { return execute_tool_call_js_1.isGuardOutcome; } });
|
|
231
|
+
Object.defineProperty(exports, "surfaceEnvelopeFields", { enumerable: true, get: function () { return execute_tool_call_js_1.surfaceEnvelopeFields; } });
|
|
183
232
|
//# sourceMappingURL=index.js.map
|
package/dist/cjs/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;AAEH,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AACtB,6CAAkE;AAAzD,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAC1C,2FAA2F;AAC3F,2DAA6F;AAApF,2HAAA,qBAAqB,OAAA;AAAE,qHAAA,eAAe,OAAA;AAAE,mHAAA,aAAa,OAAA;AAE9D,wGAAwG;AACxG,uDAK4B;AAJ1B,6HAAA,yBAAyB,OAAA;AACzB,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,qHAAA,iBAAiB,OAAA;AAMnB,sGAAsG;AACtG,+DAA+D;AAC/D,6DAA0G;AAAjG,uHAAA,gBAAgB,OAAA;AAAE,4HAAA,qBAAqB,OAAA;AAAE,+HAAA,wBAAwB,OAAA;AAE1E,6GAA6G;AAC7G,iFAOyC;AANvC,8IAAA,6BAA6B,OAAA;AAC7B,kJAAA,iCAAiC,OAAA;AACjC,kJAAA,iCAAiC,OAAA;AACjC,mJAAA,kCAAkC,OAAA;AAClC,kJAAA,iCAAiC,OAAA;AACjC,0IAAA,yBAAyB,OAAA;AAQ3B,+FAA+F;AAC/F,6FAA6F;AAC7F,uDAAkD;AAAzC,gHAAA,YAAY,OAAA;AAErB,+FAA+F;AAC/F,uDAG4B;AAF1B,uHAAA,mBAAmB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,4GAAA,QAAQ,OAAA;AAAE,kHAAA,cAAc,OAAA;AACnF,qHAAA,iBAAiB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,mHAAA,eAAe,OAAA;AAAE,6GAAA,SAAS,OAAA;AAAE,mHAAA,eAAe,OAAA;AA8B9E,8FAA8F;AAC9F,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,yHAAA,mBAAmB,OAAA;AACnB,oIAAA,8BAA8B,OAAA;AAC9B,0HAAA,oBAAoB,OAAA;AAGtB,2FAA2F;AAC3F,sFAAsF;AACtF,iEAIiC;AAH/B,+HAAA,sBAAsB,OAAA;AACtB,mIAAA,0BAA0B,OAAA;AAC1B,0HAAA,iBAAiB,OAAA;AASnB,mGAAmG;AACnG,+CAUwB;AATtB,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,oHAAA,oBAAoB,OAAA;AACpB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,gHAAA,gBAAgB,OAAA;AAChB,qHAAA,qBAAqB,OAAA;AACrB,2HAAA,2BAA2B,OAAA;AAC3B,mHAAA,mBAAmB,OAAA;AAgBrB,0GAA0G;AAC1G,2FAA2F;AAC3F,+DAOgC;AAN9B,kIAAA,0BAA0B,OAAA;AAC1B,mHAAA,WAAW,OAAA;AACX,gIAAA,wBAAwB,OAAA;AACxB,oIAAA,4BAA4B,OAAA;AAC5B,0HAAA,kBAAkB,OAAA;AAClB,8HAAA,sBAAsB,OAAA;AAYxB,yGAAyG;AACzG,8CAQ8B;AAP5B,6GAAA,oBAAoB,OAAA;AACpB,0GAAA,iBAAiB,OAAA;AACjB,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AAGjB,sFAAsF;AACtF,gDAM+B;AAL7B,+GAAA,qBAAqB,OAAA;AACrB,6GAAA,mBAAmB,OAAA;AACnB,qGAAA,WAAW,OAAA;AACX,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAQlB,uGAAuG;AACvG,8CAM8B;AAL5B,6GAAA,oBAAoB,OAAA;AACpB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AAQjB,mFAAmF;AACnF,0DAMoC;AALlC,yHAAA,0BAA0B,OAAA;AAC1B,uHAAA,wBAAwB,OAAA;AACxB,+GAAA,gBAAgB,OAAA;AAChB,4HAAA,6BAA6B,OAAA;AAC7B,oHAAA,qBAAqB,OAAA;AAQvB,4FAA4F;AAC5F,yFAAyF;AACzF,2DAK8B;AAJ5B,yHAAA,mBAAmB,OAAA;AACnB,2HAAA,qBAAqB,OAAA;AACrB,iIAAA,2BAA2B,OAAA;AAC3B,0HAAA,oBAAoB,OAAA;AAQtB,+FAA+F;AAC/F,0FAA0F;AAC1F,qFAM2C;AALzC,kJAAA,+BAA+B,OAAA;AAC/B,6IAAA,0BAA0B,OAAA;AAC1B,4IAAA,yBAAyB,OAAA;AACzB,mIAAA,gBAAgB,OAAA;AAChB,oJAAA,iCAAiC,OAAA;AAQnC,kGAAkG;AAClG,wFAAwF;AACxF,+DAAiG;AAAxF,wHAAA,OAAO,OAAoB;AAAE,sHAAA,cAAc,OAAA;AAAE,kHAAA,UAAU,OAAA;AAKhE,uDAA6D;AAApD,6GAAA,SAAS,OAAA;AAAE,gHAAA,YAAY,OAAA;AAEhC,qGAAqG;AACrG,uDAAkF;AAAzE,qHAAA,iBAAiB,OAAA;AAAE,6HAAA,yBAAyB,OAAA;AAarD,uGAAuG;AACvG,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAMrB,oGAAoG;AACpG,mDAA8C;AAArC,4GAAA,UAAU,OAAA;AAKnB,yGAAyG;AACzG,mDAAyE;AAAhE,4GAAA,UAAU,OAAA;AAAE,2HAAA,yBAAyB,OAAA;AAK9C,uGAAuG;AACvG,2DAAsD;AAA7C,oHAAA,cAAc,OAAA;AAOvB,gGAAgG;AAChG,qGAAqG;AACrG,2GAA2G;AAC3G,yDAI6B;AAH3B,kHAAA,aAAa,OAAA;AACb,0HAAA,qBAAqB,OAAA;AACrB,+HAAA,0BAA0B,OAAA;AAQ5B,2FAA2F;AAC3F,kEAAkE;AAClE,uFAAuF;AACvF,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAUlC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,+FAA+F;AAC/F,0FAA0F;AAC1F,wDAOiC;AAN/B,sHAAA,sBAAsB,OAAA;AACtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,mIAAA,mCAAmC,OAAA;AAUrC,8FAA8F;AAC9F,wGAAwG;AACxG,kDAO8B;AAN5B,gHAAA,mBAAmB,OAAA;AACnB,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AACb,+HAAA,kCAAkC,OAAA;AAClC,mHAAA,sBAAsB,OAAA;AACtB,6HAAA,gCAAgC,OAAA;AAWlC,2FAA2F;AAC3F,iGAAiG;AACjG,+DAQgC;AAP9B,4HAAA,oBAAoB,OAAA;AACpB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,6HAAA,qBAAqB,OAAA;AACrB,gIAAA,wBAAwB,OAAA;AACxB,sHAAA,cAAc,OAAA;AACd,6HAAA,qBAAqB,OAAA"}
|
package/dist/cjs/merge-gate.d.ts
CHANGED
|
@@ -95,8 +95,16 @@ export type GateDecision = {
|
|
|
95
95
|
* Named honesty residual on an otherwise-green check (§4.2). Usually present when
|
|
96
96
|
* inescapable_merge is false; may also name an app-binding gap while inescapable_merge
|
|
97
97
|
* remains true (published callers cannot supply that fact yet — residual only, no flip).
|
|
98
|
+
*
|
|
99
|
+
* Compat: always the FIRST residual in evaluation order (same priority as pre-array
|
|
100
|
+
* single-slot assembly). Prefer `residuals` when co-occurrence matters.
|
|
98
101
|
*/
|
|
99
102
|
residual?: GateReason;
|
|
103
|
+
/**
|
|
104
|
+
* ALL applicable honesty residuals in evaluation order (no duplicates).
|
|
105
|
+
* Empty array when none. Additive — singular `residual` remains for published callers.
|
|
106
|
+
*/
|
|
107
|
+
residuals: GateReason[];
|
|
100
108
|
detail: {
|
|
101
109
|
prHeadSha: string;
|
|
102
110
|
bound_head_sha: string | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;;;sEAGsE;AACtE,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB;AACtB,6GAA6G;GAC3G,oCAAoC;AACtC,6FAA6F;GAC3F,8BAA8B;AAChC;;;;GAIG;GACD,wBAAwB,CAAC;AAE7B,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B
|
|
1
|
+
{"version":3,"file":"merge-gate.d.ts","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;;;sEAGsE;AACtE,MAAM,MAAM,UAAU,GAClB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,YAAY,GACZ,sBAAsB,GACtB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,oBAAoB,GACpB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,oBAAoB;AACtB,6GAA6G;GAC3G,oCAAoC;AACtC,6FAA6F;GAC3F,8BAA8B;AAChC;;;;GAIG;GACD,wBAAwB,CAAC;AAE7B,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E;8EAC8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IACxB,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;IACnE,gBAAgB,CAAC,EAAE,UAAU,GAAG,0BAA0B,GAAG,kBAAkB,GAAG,MAAM,GAAG,MAAM,CAAC;IAClG,wFAAwF;IACxF,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wGAAwG;AACxG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,eAAe,CAAC;IAE5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvF,CAAC;AAwCF;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,CA2GnE"}
|
package/dist/cjs/merge-gate.js
CHANGED
|
@@ -74,7 +74,9 @@ function gateDecision(input) {
|
|
|
74
74
|
decision: receipt ? String(receipt.decision) : null,
|
|
75
75
|
};
|
|
76
76
|
const fail = (state, reason) => ({
|
|
77
|
-
merge_allowed: false, state, reason, enforcement_state, inescapable_merge: false,
|
|
77
|
+
merge_allowed: false, state, reason, enforcement_state, inescapable_merge: false,
|
|
78
|
+
residuals: [],
|
|
79
|
+
detail,
|
|
78
80
|
});
|
|
79
81
|
// 1) incomplete head → pending/failure (fail-closed on missing evaluation input).
|
|
80
82
|
if (!input.prHeadSha || String(input.prHeadSha).trim() === '') {
|
|
@@ -121,14 +123,17 @@ function gateDecision(input) {
|
|
|
121
123
|
// absent would break every published caller who cannot yet supply it. Honesty for that
|
|
122
124
|
// axis is residual-only (below).
|
|
123
125
|
const inescapable_merge = enforcement_state === 'ENFORCING' && protection.admin_bypass_possible === false;
|
|
124
|
-
|
|
126
|
+
// Collect ALL applicable honesty residuals in evaluation order (no overwrite, no duplicates).
|
|
127
|
+
// Priority for singular `residual` = residuals[0] (first / highest priority) — preserves the
|
|
128
|
+
// pre-array single-slot priority: protection-axis → app-binding → change_set_not_rebound.
|
|
129
|
+
const residuals = [];
|
|
125
130
|
if (!inescapable_merge) {
|
|
126
131
|
if (enforcement_state === 'ENFORCING')
|
|
127
|
-
|
|
132
|
+
residuals.push('admin_bypass_open'); // required, but admins can override
|
|
128
133
|
else if (enforcement_state === 'ADVISORY')
|
|
129
|
-
|
|
134
|
+
residuals.push('protection_advisory_only'); // posted but not required
|
|
130
135
|
else
|
|
131
|
-
|
|
136
|
+
residuals.push('protection_not_configured'); // ABSENT or UNKNOWN — cannot attest
|
|
132
137
|
}
|
|
133
138
|
else {
|
|
134
139
|
// Claim is still true (existing contract). Residual names app-binding honesty only when
|
|
@@ -137,24 +142,26 @@ function gateDecision(input) {
|
|
|
137
142
|
// confirmed app-bound — no residual
|
|
138
143
|
}
|
|
139
144
|
else if (protection.required_check_app_bound === false) {
|
|
140
|
-
|
|
145
|
+
residuals.push('required_check_app_not_bound');
|
|
141
146
|
}
|
|
142
147
|
else {
|
|
143
|
-
|
|
148
|
+
residuals.push('required_check_app_binding_unknown'); // field absent: unknown ≠ not bound
|
|
144
149
|
}
|
|
145
150
|
}
|
|
146
|
-
// Optional change-set re-bind skipped: record the gap, do not flip the claim
|
|
147
|
-
//
|
|
148
|
-
// fingerprint_mismatch (hard fail when a re-bind was requested and disagreed).
|
|
149
|
-
if (rc.expected_fingerprint == null
|
|
150
|
-
|
|
151
|
+
// Optional change-set re-bind skipped: record the gap, do not flip the claim.
|
|
152
|
+
// Co-occurs with protection/app residuals (previously dropped when singular residual was set).
|
|
153
|
+
// Distinct from fingerprint_mismatch (hard fail when a re-bind was requested and disagreed).
|
|
154
|
+
if (rc.expected_fingerprint == null) {
|
|
155
|
+
residuals.push('change_set_not_rebound');
|
|
151
156
|
}
|
|
157
|
+
const residual = residuals.length > 0 ? residuals[0] : undefined;
|
|
152
158
|
return {
|
|
153
159
|
merge_allowed: true,
|
|
154
160
|
state: 'success',
|
|
155
161
|
reason: 'allow_current_head',
|
|
156
162
|
enforcement_state,
|
|
157
163
|
inescapable_merge,
|
|
164
|
+
residuals,
|
|
158
165
|
...(residual ? { residual } : {}),
|
|
159
166
|
detail,
|
|
160
167
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;
|
|
1
|
+
{"version":3,"file":"merge-gate.js","sourceRoot":"","sources":["../../src/merge-gate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AA6JH,oCA2GC;AApJD,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAA4B;IAC3C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;qGACqG;AACrG,SAAS,MAAM,CAAC,CAA4B;IAC1C,OAAO,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,WAAW,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2GAA2G;AAC3G,SAAS,YAAY,CAAC,OAAoB,EAAE,cAAuB;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,cAAc,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACpC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1H,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,KAAK,0BAA0B,CAAC;AAChE,CAAC;AAED,gHAAgH;AAChH,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,KAAwB;IACnD,MAAM,EAAE,GAAoB,KAAK,CAAC,eAAe,IAAK,EAAsB,CAAC;IAC7E,MAAM,UAAU,GAAoB,EAAE,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC7G,MAAM,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;IAEjD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,IAAI,KAAK,CAAC;IACpE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,cAAc,IAAI,KAAK,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAChE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KACpD,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,MAAkB,EAAgB,EAAE,CAAC,CAAC;QAC1E,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK;QAChF,SAAS,EAAE,EAAE;QACb,MAAM;KACP,CAAC,CAAC;IAEH,kFAAkF;IAClF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,oCAAoC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IACD,+EAA+E;IAC/E,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC;IACD,oGAAoG;IACpG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC;IACnC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qGAAqG;IACrG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;IACD,iDAAiD;IACjD,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,EAAE,CAAC,oBAAoB,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,8EAA8E;IAC9E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,qFAAqF;IACrF,oGAAoG;IACpG,2EAA2E;IAC3E,8FAA8F;IAC9F,2FAA2F;IAC3F,qCAAqC;IACrC,MAAM,iBAAiB,GAAG,iBAAiB,KAAK,WAAW,IAAI,UAAU,CAAC,qBAAqB,KAAK,KAAK,CAAC;IAE1G,8FAA8F;IAC9F,6FAA6F;IAC7F,0FAA0F;IAC1F,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,iBAAiB,KAAK,WAAW;YAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAU,oCAAoC;aACpH,IAAI,iBAAiB,KAAK,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B;;YAC5G,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAqC,oCAAoC;IAC5H,CAAC;SAAM,CAAC;QACN,wFAAwF;QACxF,6DAA6D;QAC7D,IAAI,UAAU,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACjD,oCAAoC;QACtC,CAAC;aAAM,IAAI,UAAU,CAAC,wBAAwB,KAAK,KAAK,EAAE,CAAC;YACzD,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC,oCAAoC;QAC5F,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,EAAE,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,oBAAoB;QAC5B,iBAAiB;QACjB,iBAAiB;QACjB,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;KACP,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,125 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Remediation-loop attestation (audit item 7 completion) — pure binder that ties a prior
|
|
3
|
+
* BLOCK decision (with its remediation transaction) to a later ALLOW execution chain
|
|
4
|
+
* (GuardExecutionProof + optional cas-attestation.v1).
|
|
5
|
+
*
|
|
6
|
+
* Does NOT modify cas-attestation.ts, execution-proof.ts, or envelope types.
|
|
7
|
+
* Does NOT claim that the patch fixed required_changes, that recheck_scope was honored
|
|
8
|
+
* server-side, that no other changes rode along, or that the new decision was caused by
|
|
9
|
+
* the remediation — see limits (always set).
|
|
10
|
+
*
|
|
11
|
+
* Linkage mechanism (measured, app remediation-transaction.js):
|
|
12
|
+
* resubmission.reference_fingerprint + fingerprint_profile + modified_is_not_permission
|
|
13
|
+
* + next_preflight_required + recheck_scope. No decision_id prev-link on re-preflight.
|
|
14
|
+
*
|
|
15
|
+
* Future stronger form (NOT built here): server-echoed remediation_of on the re-authorize
|
|
16
|
+
* path would bind decision_id→decision_id; this record only links measured fingerprints.
|
|
17
|
+
*
|
|
18
|
+
* DecisionResultEnvelope (SDK typed) does NOT declare remediation_transaction /
|
|
19
|
+
* required_changes / resubmission — those ride on BLOCK envelopes at runtime when the app
|
|
20
|
+
* attaches them. Access is via a narrow validated reader (measured field names only).
|
|
21
|
+
*/
|
|
22
|
+
import type { DecisionResultEnvelope } from './types.js';
|
|
23
|
+
import type { GuardExecutionProof } from './execution-proof.js';
|
|
24
|
+
import type { CasAttestation } from './cas-attestation.js';
|
|
25
|
+
/** Machine-readable schema id — mirrors cas-attestation.v1 / guard-execution-proof.v1 style. */
|
|
26
|
+
export declare const REMEDIATION_LOOP_ATTESTATION_SPEC: "remediation-loop-attestation.v1";
|
|
27
|
+
/**
|
|
28
|
+
* Explicit non-claims. Always set (same discipline as CasAttestation.limits).
|
|
29
|
+
* Readers that treat missing fields as "ok" are wrong.
|
|
30
|
+
*/
|
|
31
|
+
export type RemediationLoopAttestationLimits = {
|
|
32
|
+
/** Does not claim the host patch addressed required_changes (semantic, unverifiable here). */
|
|
33
|
+
does_not_claim_patch_addressed_required_changes: true;
|
|
34
|
+
/** Does not claim recheck_scope was honored server-side on the re-preflight. */
|
|
35
|
+
does_not_claim_recheck_scope_honored: true;
|
|
36
|
+
/** Does not claim no unrelated changes rode along in the new change set. */
|
|
37
|
+
does_not_claim_no_other_changes: true;
|
|
38
|
+
/** Does not claim the new ALLOW was caused by the remediation (correlation ≠ causation). */
|
|
39
|
+
does_not_claim_allow_caused_by_remediation: true;
|
|
40
|
+
/**
|
|
41
|
+
* Unchanged input is not permission (mirrors resubmission.modified_is_not_permission /
|
|
42
|
+
* unchanged_input → deterministic_block). Attestation refuses when fingerprints match.
|
|
43
|
+
*/
|
|
44
|
+
does_not_claim_unchanged_input_is_permission: true;
|
|
45
|
+
/** Same host-bypass residual — package cannot force the host to re-preflight or CAS-commit. */
|
|
46
|
+
does_not_claim_host_cannot_bypass: true;
|
|
47
|
+
};
|
|
48
|
+
/** Measured remediation_transaction shape (app remediation-transaction.js, fixed key order). */
|
|
49
|
+
export type RemediationTransactionView = {
|
|
50
|
+
required_changes: unknown[];
|
|
51
|
+
resubmission: {
|
|
52
|
+
reference_fingerprint: string;
|
|
53
|
+
fingerprint_profile?: string;
|
|
54
|
+
modified_is_not_permission?: boolean;
|
|
55
|
+
unchanged_input?: string;
|
|
56
|
+
modified_input?: string;
|
|
57
|
+
};
|
|
58
|
+
next_preflight_required?: boolean;
|
|
59
|
+
recheck_scope?: unknown;
|
|
60
|
+
};
|
|
61
|
+
/**
|
|
62
|
+
* Frozen remediation-loop-attestation.v1 record.
|
|
63
|
+
* References are lifted from measured identifiers only; derived flags are only what is
|
|
64
|
+
* honestly computable from the typed inputs.
|
|
65
|
+
*/
|
|
66
|
+
export type RemediationLoopAttestation = {
|
|
67
|
+
attestation_spec: typeof REMEDIATION_LOOP_ATTESTATION_SPEC;
|
|
68
|
+
references: {
|
|
69
|
+
block: {
|
|
70
|
+
decision_id: string;
|
|
71
|
+
reference_fingerprint: string;
|
|
72
|
+
required_changes_count: number;
|
|
73
|
+
recheck_scope: unknown | null;
|
|
74
|
+
fingerprint_profile: string | null;
|
|
75
|
+
next_preflight_required: boolean | null;
|
|
76
|
+
};
|
|
77
|
+
allow: {
|
|
78
|
+
decision_id: string | null;
|
|
79
|
+
change_fp: string;
|
|
80
|
+
};
|
|
81
|
+
cas: {
|
|
82
|
+
status: string;
|
|
83
|
+
authorized_and_committed: boolean;
|
|
84
|
+
} | null;
|
|
85
|
+
};
|
|
86
|
+
derived: {
|
|
87
|
+
/** reference_fingerprint !== allow.change_fp (required for closure). */
|
|
88
|
+
input_changed: true;
|
|
89
|
+
/**
|
|
90
|
+
* True only when cas-attestation is supplied AND cas.derived.authorized_and_committed.
|
|
91
|
+
* Absent cas → false (recheck+authorize linkage only, not CAS commit).
|
|
92
|
+
*/
|
|
93
|
+
loop_committed: boolean;
|
|
94
|
+
};
|
|
95
|
+
limits: RemediationLoopAttestationLimits;
|
|
96
|
+
};
|
|
97
|
+
/**
|
|
98
|
+
* Read remediation_transaction from a BLOCK envelope object.
|
|
99
|
+
* Typed DecisionResultEnvelope does not declare this field (measured absent from
|
|
100
|
+
* decision-result.v1.d.ts); app attaches it at runtime on BLOCK. Measured names only
|
|
101
|
+
* (remediation-transaction.js).
|
|
102
|
+
*/
|
|
103
|
+
export declare function readRemediationTransaction(envelope: unknown): RemediationTransactionView | null;
|
|
104
|
+
/**
|
|
105
|
+
* Validate prior envelope is a BLOCK with a usable remediation transaction.
|
|
106
|
+
* Returns measured identifiers or null if shape invalid.
|
|
107
|
+
*/
|
|
108
|
+
export declare function readPriorBlockRemediation(envelope: unknown): {
|
|
109
|
+
decision_id: string;
|
|
110
|
+
reference_fingerprint: string;
|
|
111
|
+
required_changes_count: number;
|
|
112
|
+
recheck_scope: unknown | null;
|
|
113
|
+
fingerprint_profile: string | null;
|
|
114
|
+
next_preflight_required: boolean | null;
|
|
115
|
+
} | null;
|
|
116
|
+
export declare function isCasAttestation(x: unknown): x is CasAttestation;
|
|
117
|
+
/**
|
|
118
|
+
* Bind prior BLOCK envelope + ALLOW proof (+ optional cas-attestation) into
|
|
119
|
+
* remediation-loop-attestation.v1.
|
|
120
|
+
*
|
|
121
|
+
* Validation-first: TypeError on invalid shapes / not-BLOCK / missing remediation tx /
|
|
122
|
+
* missing allow change_fp / unchanged fingerprint (modified_is_not_permission).
|
|
123
|
+
*/
|
|
124
|
+
export declare function buildRemediationLoopAttestation(priorBlockEnvelope: DecisionResultEnvelope | Record<string, unknown>, allowProof: GuardExecutionProof, casAttestation?: CasAttestation | null): RemediationLoopAttestation;
|
|
125
|
+
//# sourceMappingURL=remediation-loop-attestation.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"remediation-loop-attestation.d.ts","sourceRoot":"","sources":["../../src/remediation-loop-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,gGAAgG;AAChG,eAAO,MAAM,iCAAiC,EAAG,iCAA0C,CAAC;AAE5F;;;GAGG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,8FAA8F;IAC9F,+CAA+C,EAAE,IAAI,CAAC;IACtD,gFAAgF;IAChF,oCAAoC,EAAE,IAAI,CAAC;IAC3C,4EAA4E;IAC5E,+BAA+B,EAAE,IAAI,CAAC;IACtC,4FAA4F;IAC5F,0CAA0C,EAAE,IAAI,CAAC;IACjD;;;OAGG;IACH,4CAA4C,EAAE,IAAI,CAAC;IACnD,+FAA+F;IAC/F,iCAAiC,EAAE,IAAI,CAAC;CACzC,CAAC;AAWF,gGAAgG;AAChG,MAAM,MAAM,0BAA0B,GAAG;IACvC,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,YAAY,EAAE;QACZ,qBAAqB,EAAE,MAAM,CAAC;QAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0BAA0B,CAAC,EAAE,OAAO,CAAC;QACrC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,gBAAgB,EAAE,OAAO,iCAAiC,CAAC;IAC3D,UAAU,EAAE;QACV,KAAK,EAAE;YACL,WAAW,EAAE,MAAM,CAAC;YACpB,qBAAqB,EAAE,MAAM,CAAC;YAC9B,sBAAsB,EAAE,MAAM,CAAC;YAC/B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;YAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;YACnC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAC;SACzC,CAAC;QACF,KAAK,EAAE;YACL,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;YAC3B,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;QACF,GAAG,EAAE;YACH,MAAM,EAAE,MAAM,CAAC;YACf,wBAAwB,EAAE,OAAO,CAAC;SACnC,GAAG,IAAI,CAAC;KACV,CAAC;IACF,OAAO,EAAE;QACP,wEAAwE;QACxE,aAAa,EAAE,IAAI,CAAC;QACpB;;;WAGG;QACH,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,MAAM,EAAE,gCAAgC,CAAC;CAC1C,CAAC;AAIF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB,0BAA0B,GAAG,IAAI,CA4BnC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAC;CACzC,GAAG,IAAI,CAgBP;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,cAAc,CAQhE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,kBAAkB,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpE,UAAU,EAAE,mBAAmB,EAC/B,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,GACrC,0BAA0B,CA+E5B"}
|
|
@@ -0,0 +1,186 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Remediation-loop attestation (audit item 7 completion) — pure binder that ties a prior
|
|
4
|
+
* BLOCK decision (with its remediation transaction) to a later ALLOW execution chain
|
|
5
|
+
* (GuardExecutionProof + optional cas-attestation.v1).
|
|
6
|
+
*
|
|
7
|
+
* Does NOT modify cas-attestation.ts, execution-proof.ts, or envelope types.
|
|
8
|
+
* Does NOT claim that the patch fixed required_changes, that recheck_scope was honored
|
|
9
|
+
* server-side, that no other changes rode along, or that the new decision was caused by
|
|
10
|
+
* the remediation — see limits (always set).
|
|
11
|
+
*
|
|
12
|
+
* Linkage mechanism (measured, app remediation-transaction.js):
|
|
13
|
+
* resubmission.reference_fingerprint + fingerprint_profile + modified_is_not_permission
|
|
14
|
+
* + next_preflight_required + recheck_scope. No decision_id prev-link on re-preflight.
|
|
15
|
+
*
|
|
16
|
+
* Future stronger form (NOT built here): server-echoed remediation_of on the re-authorize
|
|
17
|
+
* path would bind decision_id→decision_id; this record only links measured fingerprints.
|
|
18
|
+
*
|
|
19
|
+
* DecisionResultEnvelope (SDK typed) does NOT declare remediation_transaction /
|
|
20
|
+
* required_changes / resubmission — those ride on BLOCK envelopes at runtime when the app
|
|
21
|
+
* attaches them. Access is via a narrow validated reader (measured field names only).
|
|
22
|
+
*/
|
|
23
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
24
|
+
exports.REMEDIATION_LOOP_ATTESTATION_SPEC = void 0;
|
|
25
|
+
exports.readRemediationTransaction = readRemediationTransaction;
|
|
26
|
+
exports.readPriorBlockRemediation = readPriorBlockRemediation;
|
|
27
|
+
exports.isCasAttestation = isCasAttestation;
|
|
28
|
+
exports.buildRemediationLoopAttestation = buildRemediationLoopAttestation;
|
|
29
|
+
const cas_attestation_js_1 = require("./cas-attestation.js");
|
|
30
|
+
const cas_attestation_js_2 = require("./cas-attestation.js");
|
|
31
|
+
/** Machine-readable schema id — mirrors cas-attestation.v1 / guard-execution-proof.v1 style. */
|
|
32
|
+
exports.REMEDIATION_LOOP_ATTESTATION_SPEC = 'remediation-loop-attestation.v1';
|
|
33
|
+
const LIMITS = Object.freeze({
|
|
34
|
+
does_not_claim_patch_addressed_required_changes: true,
|
|
35
|
+
does_not_claim_recheck_scope_honored: true,
|
|
36
|
+
does_not_claim_no_other_changes: true,
|
|
37
|
+
does_not_claim_allow_caused_by_remediation: true,
|
|
38
|
+
does_not_claim_unchanged_input_is_permission: true,
|
|
39
|
+
does_not_claim_host_cannot_bypass: true,
|
|
40
|
+
});
|
|
41
|
+
// ── Narrow readers (runtime fields not on DecisionResultEnvelope type) ───────
|
|
42
|
+
/**
|
|
43
|
+
* Read remediation_transaction from a BLOCK envelope object.
|
|
44
|
+
* Typed DecisionResultEnvelope does not declare this field (measured absent from
|
|
45
|
+
* decision-result.v1.d.ts); app attaches it at runtime on BLOCK. Measured names only
|
|
46
|
+
* (remediation-transaction.js).
|
|
47
|
+
*/
|
|
48
|
+
function readRemediationTransaction(envelope) {
|
|
49
|
+
if (!envelope || typeof envelope !== 'object')
|
|
50
|
+
return null;
|
|
51
|
+
const e = envelope;
|
|
52
|
+
const tx = e.remediation_transaction;
|
|
53
|
+
if (!tx || typeof tx !== 'object')
|
|
54
|
+
return null;
|
|
55
|
+
const t = tx;
|
|
56
|
+
if (!Array.isArray(t.required_changes))
|
|
57
|
+
return null;
|
|
58
|
+
const resub = t.resubmission;
|
|
59
|
+
if (!resub || typeof resub !== 'object')
|
|
60
|
+
return null;
|
|
61
|
+
const r = resub;
|
|
62
|
+
if (typeof r.reference_fingerprint !== 'string' || !r.reference_fingerprint)
|
|
63
|
+
return null;
|
|
64
|
+
return {
|
|
65
|
+
required_changes: t.required_changes,
|
|
66
|
+
resubmission: {
|
|
67
|
+
reference_fingerprint: r.reference_fingerprint,
|
|
68
|
+
fingerprint_profile: typeof r.fingerprint_profile === 'string' ? r.fingerprint_profile : undefined,
|
|
69
|
+
modified_is_not_permission: typeof r.modified_is_not_permission === 'boolean'
|
|
70
|
+
? r.modified_is_not_permission
|
|
71
|
+
: undefined,
|
|
72
|
+
unchanged_input: typeof r.unchanged_input === 'string' ? r.unchanged_input : undefined,
|
|
73
|
+
modified_input: typeof r.modified_input === 'string' ? r.modified_input : undefined,
|
|
74
|
+
},
|
|
75
|
+
next_preflight_required: typeof t.next_preflight_required === 'boolean' ? t.next_preflight_required : undefined,
|
|
76
|
+
recheck_scope: 'recheck_scope' in t ? t.recheck_scope : undefined,
|
|
77
|
+
};
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* Validate prior envelope is a BLOCK with a usable remediation transaction.
|
|
81
|
+
* Returns measured identifiers or null if shape invalid.
|
|
82
|
+
*/
|
|
83
|
+
function readPriorBlockRemediation(envelope) {
|
|
84
|
+
if (!envelope || typeof envelope !== 'object')
|
|
85
|
+
return null;
|
|
86
|
+
const e = envelope;
|
|
87
|
+
if (e.decision !== 'BLOCK')
|
|
88
|
+
return null;
|
|
89
|
+
if (typeof e.decision_id !== 'string' || !e.decision_id)
|
|
90
|
+
return null;
|
|
91
|
+
const tx = readRemediationTransaction(envelope);
|
|
92
|
+
if (!tx)
|
|
93
|
+
return null;
|
|
94
|
+
return {
|
|
95
|
+
decision_id: e.decision_id,
|
|
96
|
+
reference_fingerprint: tx.resubmission.reference_fingerprint,
|
|
97
|
+
required_changes_count: tx.required_changes.length,
|
|
98
|
+
recheck_scope: tx.recheck_scope !== undefined ? tx.recheck_scope : null,
|
|
99
|
+
fingerprint_profile: tx.resubmission.fingerprint_profile ?? null,
|
|
100
|
+
next_preflight_required: tx.next_preflight_required !== undefined ? tx.next_preflight_required : null,
|
|
101
|
+
};
|
|
102
|
+
}
|
|
103
|
+
function isCasAttestation(x) {
|
|
104
|
+
if (!x || typeof x !== 'object')
|
|
105
|
+
return false;
|
|
106
|
+
const a = x;
|
|
107
|
+
return a.attestation_spec === cas_attestation_js_2.CAS_ATTESTATION_SPEC
|
|
108
|
+
&& a.derived != null
|
|
109
|
+
&& typeof a.derived === 'object'
|
|
110
|
+
&& a.cas != null
|
|
111
|
+
&& typeof a.cas === 'object';
|
|
112
|
+
}
|
|
113
|
+
/**
|
|
114
|
+
* Bind prior BLOCK envelope + ALLOW proof (+ optional cas-attestation) into
|
|
115
|
+
* remediation-loop-attestation.v1.
|
|
116
|
+
*
|
|
117
|
+
* Validation-first: TypeError on invalid shapes / not-BLOCK / missing remediation tx /
|
|
118
|
+
* missing allow change_fp / unchanged fingerprint (modified_is_not_permission).
|
|
119
|
+
*/
|
|
120
|
+
function buildRemediationLoopAttestation(priorBlockEnvelope, allowProof, casAttestation) {
|
|
121
|
+
const block = readPriorBlockRemediation(priorBlockEnvelope);
|
|
122
|
+
if (!block) {
|
|
123
|
+
throw new TypeError('@coderifts/agent-guard: buildRemediationLoopAttestation requires a BLOCK envelope '
|
|
124
|
+
+ 'with a valid remediation_transaction '
|
|
125
|
+
+ '(required_changes[], resubmission.reference_fingerprint) — measured app shape; '
|
|
126
|
+
+ 'not declared on DecisionResultEnvelope types');
|
|
127
|
+
}
|
|
128
|
+
if (!(0, cas_attestation_js_1.isGuardExecutionProof)(allowProof)) {
|
|
129
|
+
throw new TypeError('@coderifts/agent-guard: buildRemediationLoopAttestation requires a valid '
|
|
130
|
+
+ 'guard-execution-proof.v1 object');
|
|
131
|
+
}
|
|
132
|
+
const allowChangeFp = allowProof.binds_to != null && typeof allowProof.binds_to.change_fp === 'string'
|
|
133
|
+
? allowProof.binds_to.change_fp
|
|
134
|
+
: null;
|
|
135
|
+
if (!allowChangeFp) {
|
|
136
|
+
throw new TypeError('@coderifts/agent-guard: buildRemediationLoopAttestation requires allow proof '
|
|
137
|
+
+ 'binds_to.change_fp (measured identifier for the new change set)');
|
|
138
|
+
}
|
|
139
|
+
// Unchanged input is explicitly not permission (resubmission.modified_is_not_permission).
|
|
140
|
+
if (block.reference_fingerprint === allowChangeFp) {
|
|
141
|
+
throw new TypeError('@coderifts/agent-guard: buildRemediationLoopAttestation: input_unchanged '
|
|
142
|
+
+ '(reference_fingerprint === allow change_fp); modified_is_not_permission — '
|
|
143
|
+
+ 'refuse to attest loop closure');
|
|
144
|
+
}
|
|
145
|
+
let casRef = null;
|
|
146
|
+
let loop_committed = false;
|
|
147
|
+
if (casAttestation != null && casAttestation !== undefined) {
|
|
148
|
+
if (!isCasAttestation(casAttestation)) {
|
|
149
|
+
throw new TypeError('@coderifts/agent-guard: buildRemediationLoopAttestation casAttestation must be '
|
|
150
|
+
+ 'cas-attestation.v1 when provided');
|
|
151
|
+
}
|
|
152
|
+
casRef = Object.freeze({
|
|
153
|
+
status: String(casAttestation.cas.status),
|
|
154
|
+
authorized_and_committed: casAttestation.derived.authorized_and_committed === true,
|
|
155
|
+
});
|
|
156
|
+
loop_committed = casAttestation.derived.authorized_and_committed === true;
|
|
157
|
+
}
|
|
158
|
+
const record = {
|
|
159
|
+
attestation_spec: exports.REMEDIATION_LOOP_ATTESTATION_SPEC,
|
|
160
|
+
references: Object.freeze({
|
|
161
|
+
block: Object.freeze({
|
|
162
|
+
decision_id: block.decision_id,
|
|
163
|
+
reference_fingerprint: block.reference_fingerprint,
|
|
164
|
+
required_changes_count: block.required_changes_count,
|
|
165
|
+
recheck_scope: block.recheck_scope,
|
|
166
|
+
fingerprint_profile: block.fingerprint_profile,
|
|
167
|
+
next_preflight_required: block.next_preflight_required,
|
|
168
|
+
}),
|
|
169
|
+
allow: Object.freeze({
|
|
170
|
+
decision_id: allowProof.decision_id,
|
|
171
|
+
change_fp: allowChangeFp,
|
|
172
|
+
}),
|
|
173
|
+
cas: casRef,
|
|
174
|
+
}),
|
|
175
|
+
derived: Object.freeze({
|
|
176
|
+
input_changed: true,
|
|
177
|
+
loop_committed,
|
|
178
|
+
}),
|
|
179
|
+
limits: LIMITS,
|
|
180
|
+
};
|
|
181
|
+
return freezeLoopAttestation(record);
|
|
182
|
+
}
|
|
183
|
+
function freezeLoopAttestation(a) {
|
|
184
|
+
return Object.freeze(a);
|
|
185
|
+
}
|
|
186
|
+
//# sourceMappingURL=remediation-loop-attestation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"remediation-loop-attestation.js","sourceRoot":"","sources":["../../src/remediation-loop-attestation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAqGH,gEA8BC;AAMD,8DAuBC;AAED,4CAQC;AASD,0EAmFC;AAlQD,6DAA6D;AAE7D,6DAA4D;AAE5D,gGAAgG;AACnF,QAAA,iCAAiC,GAAG,iCAA0C,CAAC;AAwB5F,MAAM,MAAM,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC7D,+CAA+C,EAAE,IAAI;IACrD,oCAAoC,EAAE,IAAI;IAC1C,+BAA+B,EAAE,IAAI;IACrC,0CAA0C,EAAE,IAAI;IAChD,4CAA4C,EAAE,IAAI;IAClD,iCAAiC,EAAE,IAAI;CACxC,CAAC,CAAC;AAqDH,gFAAgF;AAEhF;;;;;GAKG;AACH,SAAgB,0BAA0B,CACxC,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,uBAAuB,CAAC;IACrC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,CAAC,GAAG,EAA6B,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,YAAY,EAAE;YACZ,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,mBAAmB,EACjB,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;YAC/E,0BAA0B,EACxB,OAAO,CAAC,CAAC,0BAA0B,KAAK,SAAS;gBAC/C,CAAC,CAAC,CAAC,CAAC,0BAA0B;gBAC9B,CAAC,CAAC,SAAS;YACf,eAAe,EAAE,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACtF,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;SACpF;QACD,uBAAuB,EACrB,OAAO,CAAC,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;QACxF,aAAa,EAAE,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,QAAiB;IAQzD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,EAAE,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,qBAAqB,EAAE,EAAE,CAAC,YAAY,CAAC,qBAAqB;QAC5D,sBAAsB,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM;QAClD,aAAa,EAAE,EAAE,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACvE,mBAAmB,EAAE,EAAE,CAAC,YAAY,CAAC,mBAAmB,IAAI,IAAI;QAChE,uBAAuB,EACrB,EAAE,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI;KAC/E,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,CAAU;IACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAqE,CAAC;IAChF,OAAO,CAAC,CAAC,gBAAgB,KAAK,yCAAoB;WAC7C,CAAC,CAAC,OAAO,IAAI,IAAI;WACjB,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAC7B,CAAC,CAAC,GAAG,IAAI,IAAI;WACb,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,+BAA+B,CAC7C,kBAAoE,EACpE,UAA+B,EAC/B,cAAsC;IAEtC,MAAM,KAAK,GAAG,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CACjB,oFAAoF;cAClF,uCAAuC;cACvC,iFAAiF;cACjF,8CAA8C,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,0CAAqB,EAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CACjB,2EAA2E;cACzE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GACjB,UAAU,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAC9E,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS;QAC/B,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,+EAA+E;cAC7E,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,IAAI,KAAK,CAAC,qBAAqB,KAAK,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,2EAA2E;cACzE,4EAA4E;cAC5E,+BAA+B,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAoD,IAAI,CAAC;IACnE,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,IAAI,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3D,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CACjB,iFAAiF;kBAC/E,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YACzC,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI;SACnF,CAAC,CAAC;QACH,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAA+B;QACzC,gBAAgB,EAAE,yCAAiC;QACnD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;aACvD,CAAC;YACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,SAAS,EAAE,aAAa;aACzB,CAAC;YACF,GAAG,EAAE,MAAM;SACZ,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,aAAa,EAAE,IAAa;YAC5B,cAAc;SACf,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC;IAEF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,qBAAqB,CAAC,CAA6B;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
|