@emilia-protocol/gate 0.11.0 → 0.13.0

package/action-packs.js

@@ -1,141 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-// EMILIA Gate default action packs: the high-risk families that should require
-// pre-execution human authorization before a machine mutates the world.
-
-export const ACTION_RISK_MANIFEST_VERSION = 'EP-ACTION-RISK-MANIFEST-v0.1';
-
-export const HIGH_RISK_ACTION_PACKS = Object.freeze([
-  Object.freeze({
-    id: 'money_movement.release',
-    label: 'Money movement',
-    action_type: 'payment.release',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'mcp', tool: 'release_payment' },
-    why: 'Moves funds or releases value. Requires a named human signoff, not an agent-only key.',
-    execution_binding: {
-      required_fields: ['action_type', 'amount_usd', 'currency', 'payment_instruction_id', 'beneficiary_account_hash'],
-    },
-  }),
-  Object.freeze({
-    id: 'money_movement.bank_details_change',
-    label: 'Bank-detail change',
-    action_type: 'payment.bank_details.change',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'mcp', tool: 'change_bank_details' },
-    why: 'Changes where future money flows. Treats payee, beneficiary, vendor, and payroll account changes as high-risk by category.',
-    execution_binding: {
-      required_fields: ['action_type', 'account_holder_id', 'payment_instruction_id', 'bank_account_hash'],
-    },
-  }),
-  Object.freeze({
-    id: 'production.deploy',
-    label: 'Production deploy',
-    action_type: 'deploy.production',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'quorum',
-    match: { protocol: 'mcp', tool: 'deploy_production' },
-    why: 'Changes live production behavior. Quorum is the cryptographic two-person rule for hard operational cuts.',
-    execution_binding: {
-      required_fields: ['action_type', 'repo', 'commit_sha', 'environment', 'artifact_digest'],
-    },
-  }),
-  Object.freeze({
-    id: 'permissions.admin_change',
-    label: 'Permission or admin change',
-    action_type: 'permission.admin.change',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'quorum',
-    match: { protocol: 'mcp', tool: 'change_permissions' },
-    why: 'Changes who can act next. Privilege changes deserve stronger proof than the session that requested them.',
-    execution_binding: {
-      required_fields: ['action_type', 'principal_id', 'role', 'scope'],
-    },
-  }),
-  Object.freeze({
-    id: 'data.bulk_export',
-    label: 'Bulk data export',
-    action_type: 'data.export',
-    risk: 'high',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'mcp', tool: 'export_customer_data' },
-    why: 'Moves sensitive data out of its system of record. The recipient and purpose must be bound to the approval.',
-    execution_binding: {
-      required_fields: ['action_type', 'dataset', 'recipient', 'purpose', 'row_count_max'],
-    },
-  }),
-  Object.freeze({
-    id: 'records.delete',
-    label: 'Record deletion',
-    action_type: 'record.delete',
-    risk: 'high',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'mcp', tool: 'delete_record' },
-    why: 'Destroys or hides state. The record identity and pre-state must be bound before deletion.',
-    execution_binding: {
-      required_fields: ['action_type', 'record_type', 'record_id', 'before_state_hash'],
-    },
-  }),
-  Object.freeze({
-    id: 'regulated.decision_override',
-    label: 'Regulated decision override',
-    action_type: 'regulated.decision.override',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'quorum',
-    match: { protocol: 'mcp', tool: 'override_regulated_decision' },
-    why: 'Changes a decision with legal, benefit, credit, clinical, or safety impact. Requires named accountability.',
-    execution_binding: {
-      required_fields: ['action_type', 'case_id', 'decision_id', 'subject_id', 'override_reason'],
-    },
-  }),
-]);
-
-export const DEFAULT_PASS_THROUGH_ACTIONS = Object.freeze([
-  Object.freeze({
-    id: 'observe.read_status',
-    label: 'Read-only status',
-    action_type: 'read.status',
-    receipt_required: false,
-    match: { protocol: 'mcp', tool: 'read_status' },
-  }),
-]);
-
-export function createDefaultActionRiskManifest({ includePassThrough = true, extraActions = [] } = {}) {
-  return {
-    '@version': ACTION_RISK_MANIFEST_VERSION,
-    actions: [
-      ...HIGH_RISK_ACTION_PACKS.map((a) => ({
-        ...a,
-        match: { ...a.match },
-        execution_binding: a.execution_binding
-          ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
-          : undefined,
-      })),
-      ...(includePassThrough ? DEFAULT_PASS_THROUGH_ACTIONS.map((a) => ({ ...a, match: { ...a.match } })) : []),
-      ...extraActions,
-    ],
-  };
-}
-
-export const DEFAULT_GATE_MANIFEST = Object.freeze(createDefaultActionRiskManifest());
-
-export function highRiskActionTypes(actions = HIGH_RISK_ACTION_PACKS) {
-  return actions.filter((a) => a.receipt_required).map((a) => a.action_type);
-}
-
-export default {
-  ACTION_RISK_MANIFEST_VERSION,
-  HIGH_RISK_ACTION_PACKS,
-  DEFAULT_PASS_THROUGH_ACTIONS,
-  DEFAULT_GATE_MANIFEST,
-  createDefaultActionRiskManifest,
-  highRiskActionTypes,
-};
+// Compatibility entry point for the TypeScript action-packs module.
+export * from './dist/action-packs.js';
+export { default } from './dist/action-packs.js';

package/adapters/_kit.js

@@ -1,105 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — System-of-Record adapter kit. One enforcement contract shared by
- * every adapter (GitHub, Stripe, Supabase, AWS, ...): map a destructive op to a
- * gate selector + the observed system-of-record fields, run it through
- * gate.run(), and FAIL CLOSED — if the gate refuses, the real client call is
- * never made and we throw EMILIA_RECEIPT_REQUIRED.
- *
- * An op spec is: { selector, observed(params) -> {fields...},
- * actuator?(params, observed) -> {fields...}, perform(client, actuator) -> result }.
- * `observed` must return the same material fields the action pack binds, drawn
- * from the call params (the system-of-record facts), so a receipt for resource A
- * cannot authorize a mutation of resource B.
- */
-import { canonicalize, hashCanonical } from '../execution-binding.js';
-
-export { hashCanonical };
-
-function deepFreeze(value) {
-  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
-    for (const child of Object.values(value)) deepFreeze(child);
-    Object.freeze(value);
-  }
-  return value;
-}
-
-/** Canonical plain-data snapshot used at the actuator boundary. */
-export function canonicalActuatorObject(value) {
-  return deepFreeze(JSON.parse(canonicalize(value)));
-}
-
-/** Build an EP-ACTION-RISK-MANIFEST-v0.1 from a frozen action pack (deep-copied). */
-export function manifestFromPack(pack, extraActions = []) {
-  return {
-    '@version': 'EP-ACTION-RISK-MANIFEST-v0.1',
-    actions: [
-      ...pack.map((a) => ({
-        ...a,
-        match: { ...a.match },
-        execution_binding: a.execution_binding
-          ? { ...a.execution_binding, required_fields: [...a.execution_binding.required_fields] }
-          : undefined,
-        ...(a.business_authorization
-          ? { business_authorization: canonicalActuatorObject(a.business_authorization) }
-          : {}),
-      })),
-      ...extraActions,
-    ],
-  };
-}
-
-/**
- * Create an adapter from a system name + op map.
- * @returns {{ ops:object, OPS:string[], guard:(gate,client,{op,params,receipt})=>Promise<{result,reliance,execution}> }}
- */
-export function createAdapter({ system, ops }) {
-  if (!system || !ops || typeof ops !== 'object') throw new Error('createAdapter requires { system, ops }');
-  const OPS = Object.freeze(Object.keys(ops));
-
-  async function guard(gate, client, { op, params = {}, receipt = null } = {}) {
-    if (!gate || typeof gate.run !== 'function') throw new Error(`${system} adapter requires an EMILIA Gate (with .run)`);
-    const spec = ops[op];
-    if (!spec) throw new Error(`${system} adapter: unknown op "${op}" (expected one of: ${OPS.join(', ')})`);
-    if (!receipt) {
-      const refused = await gate.run(
-        { selector: spec.selector, receipt: null, observedAction: null },
-        () => { throw new Error('unreachable_adapter_effect'); },
-      );
-      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${refused.authorization.reason}`);
-      e.code = 'EMILIA_RECEIPT_REQUIRED';
-      e.status = refused.status;
-      e.gate = refused.authorization;
-      e.challenge = refused.body;
-      throw e;
-    }
-    // Snapshot before any asynchronous verification. Caller-owned params may be
-    // mutated while gate.run() awaits evidence/storage; neither the observation
-    // nor the eventual provider call may follow that mutable reference.
-    const input = canonicalActuatorObject(params);
-    const observedAction = canonicalActuatorObject(spec.observed(input));
-    // Default to the verified fields only. Operations that need a preimage for a
-    // bound digest (SQL, RLS, secret values, queries) must opt in with an explicit
-    // actuator() constructor. The unrestricted caller object is never passed.
-    const actuator = canonicalActuatorObject(
-      typeof spec.actuator === 'function' ? spec.actuator(input, observedAction) : observedAction,
-    );
-    const out = await gate.run(
-      { selector: spec.selector, receipt, observedAction },
-      () => spec.perform(client, actuator),
-    );
-    if (!out.ok) {
-      const e = new Error(`EMILIA Gate refused ${system}:${op} — ${out.authorization.reason}`);
-      e.code = 'EMILIA_RECEIPT_REQUIRED';
-      e.status = out.status;
-      e.gate = out.authorization;
-      e.challenge = out.body;
-      throw e;
-    }
-    return { result: out.result, reliance: out.packet, execution: out.execution };
-  }
-
-  return { ops, OPS, guard };
-}
-
-export default { createAdapter, manifestFromPack, hashCanonical, canonicalActuatorObject };
+// Compatibility entry point for the TypeScript _kit adapter module.
+export * from '../dist/adapters/_kit.js';
+export { default } from '../dist/adapters/_kit.js';

package/adapters/aws.js

@@ -1,109 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — AWS System-of-Record adapter (IAM + network).
- *
- * "Install this before your agent can change cloud permissions or open the
- * network." Wraps the high-blast-radius AWS operations — attach IAM policy,
- * create access key, delete user, and open a security-group ingress — so they
- * never reach AWS without a valid, sufficiently-assured, non-replayed receipt
- * bound to THIS principal/policy/group. Privilege and network changes default
- * to quorum (the two-person rule).
- *
- *   import { IAMClient, EC2Client } from '@aws-sdk/...';
- *   import { createGate } from '@emilia-protocol/gate';
- *   import { createAwsManifest, guardAwsMutation } from '@emilia-protocol/gate/adapters/aws';
- *
- *   const gate = createGate({ manifest: createAwsManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
- *   // client: { iam: { attachUserPolicy, createAccessKey, deleteUser }, ec2: { authorizeSecurityGroupIngress } }
- *   await guardAwsMutation(gate, client, {
- *     op: 'iam.attach_policy', params: { user: 'svc-bot', policy_arn: 'arn:aws:iam::aws:policy/AdministratorAccess' }, receipt,
- *   });
- */
-import { createAdapter, manifestFromPack } from './_kit.js';
-
-export const AWS_ACTION_PACK = Object.freeze([
-  Object.freeze({
-    id: 'aws.iam.attach_policy', label: 'IAM attach policy', action_type: 'aws.iam.attach_policy',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'aws', tool: 'attach_user_policy' },
-    why: 'Grants permissions. Privilege escalation deserves the two-person rule.',
-    execution_binding: { required_fields: ['action_type', 'user', 'policy_arn'] },
-  }),
-  Object.freeze({
-    id: 'aws.iam.create_access_key', label: 'IAM create access key', action_type: 'aws.iam.create_access_key',
-    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
-    match: { protocol: 'aws', tool: 'create_access_key' },
-    why: 'Mints long-lived credentials. Bind the user to a named approval.',
-    execution_binding: { required_fields: ['action_type', 'user'] },
-  }),
-  Object.freeze({
-    id: 'aws.iam.delete_user', label: 'IAM delete user', action_type: 'aws.iam.delete_user',
-    risk: 'high', receipt_required: true, assurance_class: 'class_a',
-    match: { protocol: 'aws', tool: 'delete_user' },
-    why: 'Destroys an identity. Bind the target user.',
-    execution_binding: { required_fields: ['action_type', 'user'] },
-  }),
-  Object.freeze({
-    id: 'aws.ec2.authorize_ingress', label: 'Open security-group ingress', action_type: 'aws.ec2.authorize_ingress',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
-    why: 'Opens the network. Bind group/CIDR/port so 0.0.0.0/0:22 cannot slip through.',
-    execution_binding: { required_fields: ['action_type', 'group_id', 'cidr', 'protocol', 'from_port', 'to_port'] },
-  }),
-]);
-
-const OPS = {
-  'iam.attach_policy': {
-    selector: { protocol: 'aws', tool: 'attach_user_policy' },
-    observed: (p) => ({ action_type: 'aws.iam.attach_policy', user: p.user, policy_arn: p.policy_arn }),
-    perform: (client, p) => client.iam.attachUserPolicy({ UserName: p.user, PolicyArn: p.policy_arn }),
-  },
-  'iam.create_access_key': {
-    selector: { protocol: 'aws', tool: 'create_access_key' },
-    observed: (p) => ({ action_type: 'aws.iam.create_access_key', user: p.user }),
-    perform: (client, p) => client.iam.createAccessKey({ UserName: p.user }),
-  },
-  'iam.delete_user': {
-    selector: { protocol: 'aws', tool: 'delete_user' },
-    observed: (p) => ({ action_type: 'aws.iam.delete_user', user: p.user }),
-    perform: (client, p) => client.iam.deleteUser({ UserName: p.user }),
-  },
-  'ec2.authorize_ingress': {
-    selector: { protocol: 'aws', tool: 'authorize_security_group_ingress' },
-    observed: (p) => ({
-      action_type: 'aws.ec2.authorize_ingress',
-      group_id: p.group_id,
-      cidr: p.cidr,
-      protocol: p.protocol ?? 'tcp',
-      from_port: p.from_port,
-      to_port: p.to_port ?? p.from_port,
-    }),
-    perform: (client, p) => client.ec2.authorizeSecurityGroupIngress({
-      GroupId: p.group_id,
-      CidrIp: p.cidr,
-      FromPort: p.from_port,
-      ToPort: p.to_port,
-      IpProtocol: p.protocol,
-    }),
-  },
-};
-
-const adapter = createAdapter({ system: 'aws', ops: OPS });
-export const AWS_OPS = adapter.OPS;
-
-export function createAwsManifest(extraActions = []) {
-  return manifestFromPack(AWS_ACTION_PACK, extraActions);
-}
-
-/**
- * Guard a high-blast-radius AWS mutation behind the gate.
- * @param {object} gate    a gate built with createAwsManifest()
- * @param {object} client  { iam: {attachUserPolicy, createAccessKey, deleteUser}, ec2: {authorizeSecurityGroupIngress} }
- * @param {object} o       { op, params, receipt }
- * @throws Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches AWS
- */
-export function guardAwsMutation(gate, client, args) {
-  return adapter.guard(gate, client, args);
-}
-
-export default { AWS_ACTION_PACK, AWS_OPS, createAwsManifest, guardAwsMutation };
+// Compatibility entry point for the TypeScript aws adapter module.
+export * from '../dist/adapters/aws.js';
+export { default } from '../dist/adapters/aws.js';

package/adapters/cloudflare.js

@@ -1,55 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — Cloudflare System-of-Record adapter.
- * Guards DNS record delete, zone delete, and WAF/firewall disable so they never
- * reach Cloudflare without a receipt bound to THIS zone. Client injected.
- */
-import { createAdapter, manifestFromPack } from './_kit.js';
-
-export const CLOUDFLARE_ACTION_PACK = Object.freeze([
-  Object.freeze({
-    id: 'cloudflare.dns.delete', label: 'Delete DNS record', action_type: 'cloudflare.dns.delete',
-    risk: 'high', receipt_required: true, assurance_class: 'class_a',
-    match: { protocol: 'cloudflare', tool: 'delete_dns_record' },
-    why: 'Removing DNS can take a service offline or enable takeover. Bind zone+record.',
-    execution_binding: { required_fields: ['action_type', 'zone', 'record_id'] },
-  }),
-  Object.freeze({
-    id: 'cloudflare.zone.delete', label: 'Delete zone', action_type: 'cloudflare.zone.delete',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'cloudflare', tool: 'delete_zone' },
-    why: 'Deletes an entire zone. Quorum.',
-    execution_binding: { required_fields: ['action_type', 'zone'] },
-  }),
-  Object.freeze({
-    id: 'cloudflare.firewall.disable', label: 'Disable firewall rule', action_type: 'cloudflare.firewall.disable',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
-    why: 'Disabling WAF/firewall opens the perimeter. Quorum + bind zone+rule.',
-    execution_binding: { required_fields: ['action_type', 'zone', 'rule_id'] },
-  }),
-]);
-
-const OPS = {
-  'dns.delete': {
-    selector: { protocol: 'cloudflare', tool: 'delete_dns_record' },
-    observed: (p) => ({ action_type: 'cloudflare.dns.delete', zone: p.zone, record_id: p.record_id }),
-    perform: (c, p) => c.deleteDnsRecord({ zone: p.zone, recordId: p.record_id }),
-  },
-  'zone.delete': {
-    selector: { protocol: 'cloudflare', tool: 'delete_zone' },
-    observed: (p) => ({ action_type: 'cloudflare.zone.delete', zone: p.zone }),
-    perform: (c, p) => c.deleteZone({ zone: p.zone }),
-  },
-  'firewall.disable': {
-    selector: { protocol: 'cloudflare', tool: 'set_firewall_rule' },
-    observed: (p) => ({ action_type: 'cloudflare.firewall.disable', zone: p.zone, rule_id: p.rule_id }),
-    perform: (c, p) => c.setFirewallRule({ zone: p.zone, ruleId: p.rule_id, enabled: false }),
-  },
-};
-
-const adapter = createAdapter({ system: 'cloudflare', ops: OPS });
-export const CLOUDFLARE_OPS = adapter.OPS;
-export function createCloudflareManifest(extra = []) { return manifestFromPack(CLOUDFLARE_ACTION_PACK, extra); }
-export function guardCloudflareMutation(gate, client, args) { return adapter.guard(gate, client, args); }
-export default { CLOUDFLARE_ACTION_PACK, CLOUDFLARE_OPS, createCloudflareManifest, guardCloudflareMutation };
+// Compatibility entry point for the TypeScript cloudflare adapter module.
+export * from '../dist/adapters/cloudflare.js';
+export { default } from '../dist/adapters/cloudflare.js';

package/adapters/gcp.js

@@ -1,71 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — Google Cloud System-of-Record adapter.
- *
- * "Install this before your agent can change cloud permissions or delete a
- * project." Guards the high-blast-radius GCP operations — IAM policy set,
- * service-account key create, project delete, storage bucket delete — so they
- * never reach GCP without a receipt bound to THIS resource/member/role. Client
- * is injected (the @google-cloud SDKs or a thin wrapper).
- */
-import { createAdapter, manifestFromPack } from './_kit.js';
-
-export const GCP_ACTION_PACK = Object.freeze([
-  Object.freeze({
-    id: 'gcp.iam.set_policy', label: 'GCP IAM set policy', action_type: 'gcp.iam.set_policy',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'gcp', tool: 'set_iam_policy' },
-    why: 'Grants cloud permissions. Bind resource+member+role; quorum.',
-    execution_binding: { required_fields: ['action_type', 'resource', 'member', 'role'] },
-  }),
-  Object.freeze({
-    id: 'gcp.sa_key.create', label: 'GCP service-account key create', action_type: 'gcp.sa_key.create',
-    risk: 'critical', receipt_required: true, assurance_class: 'class_a',
-    match: { protocol: 'gcp', tool: 'create_service_account_key' },
-    why: 'Mints long-lived cloud credentials. Bind the service account.',
-    execution_binding: { required_fields: ['action_type', 'service_account'] },
-  }),
-  Object.freeze({
-    id: 'gcp.project.delete', label: 'GCP project delete', action_type: 'gcp.project.delete',
-    risk: 'critical', receipt_required: true, assurance_class: 'quorum',
-    match: { protocol: 'gcp', tool: 'delete_project' },
-    why: 'Deletes an entire project. Quorum.',
-    execution_binding: { required_fields: ['action_type', 'project'] },
-  }),
-  Object.freeze({
-    id: 'gcp.storage.bucket_delete', label: 'GCP bucket delete', action_type: 'gcp.storage.bucket_delete',
-    risk: 'high', receipt_required: true, assurance_class: 'class_a',
-    match: { protocol: 'gcp', tool: 'delete_bucket' },
-    why: 'Destroys a storage bucket and its objects. Bind the bucket.',
-    execution_binding: { required_fields: ['action_type', 'bucket'] },
-  }),
-]);
-
-const OPS = {
-  'iam.set_policy': {
-    selector: { protocol: 'gcp', tool: 'set_iam_policy' },
-    observed: (p) => ({ action_type: 'gcp.iam.set_policy', resource: p.resource, member: p.member, role: p.role }),
-    perform: (c, p) => c.setIamPolicy({ resource: p.resource, member: p.member, role: p.role }),
-  },
-  'sa_key.create': {
-    selector: { protocol: 'gcp', tool: 'create_service_account_key' },
-    observed: (p) => ({ action_type: 'gcp.sa_key.create', service_account: p.service_account }),
-    perform: (c, p) => c.createServiceAccountKey({ service_account: p.service_account }),
-  },
-  'project.delete': {
-    selector: { protocol: 'gcp', tool: 'delete_project' },
-    observed: (p) => ({ action_type: 'gcp.project.delete', project: p.project }),
-    perform: (c, p) => c.deleteProject({ project: p.project }),
-  },
-  'storage.bucket_delete': {
-    selector: { protocol: 'gcp', tool: 'delete_bucket' },
-    observed: (p) => ({ action_type: 'gcp.storage.bucket_delete', bucket: p.bucket }),
-    perform: (c, p) => c.deleteBucket({ bucket: p.bucket }),
-  },
-};
-
-const adapter = createAdapter({ system: 'gcp', ops: OPS });
-export const GCP_OPS = adapter.OPS;
-export function createGcpManifest(extraActions = []) { return manifestFromPack(GCP_ACTION_PACK, extraActions); }
-export function guardGcpMutation(gate, client, args) { return adapter.guard(gate, client, args); }
-export default { GCP_ACTION_PACK, GCP_OPS, createGcpManifest, guardGcpMutation };
+// Compatibility entry point for the TypeScript gcp adapter module.
+export * from '../dist/adapters/gcp.js';
+export { default } from '../dist/adapters/gcp.js';

package/adapters/github.js

@@ -1,110 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — GitHub System-of-Record adapter.
- *
- * "Install this before your agent can touch production GitHub." Wraps destructive
- * Octokit operations so the mutation NEVER reaches GitHub without a valid,
- * sufficiently-assured, non-replayed human/quorum receipt bound to THIS repo —
- * and on success returns a reliance packet proving exactly what was authorized
- * and what executed.
- *
- *   import { Octokit } from '@octokit/rest';
- *   import { createGate } from '@emilia-protocol/gate';
- *   import { createGithubManifest, guardGithubMutation } from '@emilia-protocol/gate/adapters/github';
- *
- *   const gate = createGate({ manifest: createGithubManifest(), trustedKeys: [ISSUER], store: sharedConsumptionStore });
- *   const octokit = new Octokit({ auth });
- *   await guardGithubMutation(gate, octokit, {
- *     op: 'repo.delete', params: { owner, repo }, receipt,  // throws if no valid receipt
- *   });
- *
- * The receipt's claim must carry the same owner/repo (and username/permission or
- * branch) as the call — a receipt for repo A cannot authorize deleting repo B.
- */
-import { createAdapter, manifestFromPack } from './_kit.js';
-
-export const GITHUB_ACTION_PACK = Object.freeze([
-  Object.freeze({
-    id: 'github.repo.delete',
-    label: 'GitHub repo delete',
-    action_type: 'github.repo.delete',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'github', tool: 'delete_repo' },
-    why: 'Destroys a repository and its history. Bind owner/repo to a named human approval.',
-    execution_binding: { required_fields: ['action_type', 'owner', 'repo'] },
-  }),
-  Object.freeze({
-    id: 'github.permission.change',
-    label: 'GitHub permission change',
-    action_type: 'github.permission.change',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'quorum',
-    match: { protocol: 'github', tool: 'update_collaborator_permission' },
-    why: 'Changes who can act on the repo. Privilege change deserves the two-person rule.',
-    execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'username', 'permission'] },
-  }),
-  Object.freeze({
-    id: 'github.branch_protection.remove',
-    label: 'GitHub branch-protection removal',
-    action_type: 'github.branch_protection.remove',
-    risk: 'critical',
-    receipt_required: true,
-    assurance_class: 'class_a',
-    match: { protocol: 'github', tool: 'delete_branch_protection' },
-    why: 'Removes the guard rails on a protected branch.',
-    execution_binding: { required_fields: ['action_type', 'owner', 'repo', 'branch'] },
-  }),
-]);
-
-const OPS = {
-  'repo.delete': {
-    selector: { protocol: 'github', tool: 'delete_repo' },
-    observed: (p) => ({ action_type: 'github.repo.delete', owner: p.owner, repo: p.repo }),
-    perform: (octokit, p) => octokit.repos.delete({ owner: p.owner, repo: p.repo }),
-  },
-  'permission.change': {
-    selector: { protocol: 'github', tool: 'update_collaborator_permission' },
-    observed: (p) => ({
-      action_type: 'github.permission.change',
-      owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
-    }),
-    perform: (octokit, p) => octokit.repos.addCollaborator({
-      owner: p.owner, repo: p.repo, username: p.username, permission: p.permission,
-    }),
-  },
-  'branch_protection.remove': {
-    selector: { protocol: 'github', tool: 'delete_branch_protection' },
-    observed: (p) => ({ action_type: 'github.branch_protection.remove', owner: p.owner, repo: p.repo, branch: p.branch }),
-    perform: (octokit, p) => octokit.repos.deleteBranchProtection({ owner: p.owner, repo: p.repo, branch: p.branch }),
-  },
-};
-
-const adapter = createAdapter({ system: 'github', ops: OPS });
-export const GITHUB_OPS = adapter.OPS;
-
-/** Build an action-risk manifest for the GitHub destructive ops (plus any extras). */
-export function createGithubManifest(extraActions = []) {
-  return manifestFromPack(GITHUB_ACTION_PACK, extraActions);
-}
-
-/**
- * Guard a destructive GitHub mutation behind the gate. The call never reaches
- * GitHub unless a valid, sufficiently-assured, non-replayed receipt bound to
- * THIS repo is present.
- * @param {object} gate     a gate built with createGithubManifest()
- * @param {object} octokit  an Octokit-like client (@octokit/rest or compatible)
- * @param {object} o
- * @param {string} o.op     'repo.delete' | 'permission.change' | 'branch_protection.remove'
- * @param {object} o.params { owner, repo, [username], [permission], [branch] }
- * @param {object} o.receipt the EMILIA receipt authorizing THIS exact op
- * @returns {Promise<{ result:any, reliance:object, execution:object }>}
- * @throws  Error{code:'EMILIA_RECEIPT_REQUIRED'} if refused — the call never reaches GitHub
- */
-export function guardGithubMutation(gate, octokit, args) {
-  return adapter.guard(gate, octokit, args);
-}
-
-export default { GITHUB_ACTION_PACK, GITHUB_OPS, createGithubManifest, guardGithubMutation };
+// Compatibility entry point for the TypeScript github adapter module.
+export * from '../dist/adapters/github.js';
+export { default } from '../dist/adapters/github.js';