@sponsio/sdk 0.1.0-alpha.3 → 0.2.0-alpha.10

package/dist/cloud/privacy.js

@@ -0,0 +1,170 @@
+/**
+ * What may leave this machine.
+ *
+ * Port of ``sponsio/bridge/privacy.py``. Enforcement already happened
+ * here — the det checks are pure and local — so nothing in this file can
+ * change a verdict. It only narrows what the console is shown, which is
+ * what makes it cheap: the run's shape is all the cloud needs to render
+ * a dashboard, count a finding, or meter usage.
+ */
+import { createHash } from "node:crypto";
+export const LEVELS = ["full", "shape", "hashed", "metadata", "tool_calls"];
+const DEFAULT = "full";
+const STRICTEST = "tool_calls";
+function isLevel(v) {
+    return LEVELS.includes(v);
+}
+/**
+ * The level in force. The environment beats the argument, deliberately:
+ * the person who decides what may leave a machine is the operator of
+ * that machine, not the author of the agent running on it.
+ */
+export function resolve(explicit) {
+    const env = (process.env.SPONSIO_PRIVACY ?? "").trim().toLowerCase();
+    if (isLevel(env))
+        return env;
+    if (env) {
+        // An unrecognised value is far more likely to be a typo in a
+        // deployment that meant to tighten than a request to loosen, so it
+        // fails closed, to the strictest level there is.
+        return STRICTEST;
+    }
+    if (explicit && isLevel(explicit))
+        return explicit;
+    return DEFAULT;
+}
+function typeOf(value) {
+    if (value === null || value === undefined)
+        return "<null>";
+    if (typeof value === "boolean")
+        return "<bool>";
+    if (typeof value === "number") {
+        // The one place the two runtimes cannot agree. JavaScript has a
+        // single number type, so a value Python reports as ``<float>``
+        // because it was written 250.0 arrives here indistinguishable from
+        // 250 and is reported ``<int>``. Reporting every number as a float
+        // to match would misdescribe every integer, which is worse: a shape
+        // is read to answer "what did the agent pass", and the answer for
+        // this runtime is that it passed a number JavaScript calls integral.
+        return Number.isInteger(value) ? "<int>" : "<float>";
+    }
+    if (typeof value === "string")
+        return `<str:${value.length}>`;
+    if (Array.isArray(value))
+        return `<list:${value.length}>`;
+    if (typeof value === "object") {
+        const parts = Object.entries(value).map(([k, v]) => `${k}: ${typeOf(v)}`);
+        return `{${parts.join(", ")}}`;
+    }
+    return `<${typeof value}>`;
+}
+/**
+ * The structure of an argument set, with every value replaced.
+ *
+ * Lengths survive for strings and lists because "the model passed a
+ * 40 000-character path" is a debugging fact and not content, and it is
+ * the one an oversize-argument rule fires on.
+ */
+export function shape(args) {
+    if (args === null || args === undefined)
+        return "";
+    if (typeof args === "object" && !Array.isArray(args)) {
+        const parts = Object.entries(args).map(([k, v]) => `"${k}": ${typeOf(v)}`);
+        return `{${parts.join(", ")}}`;
+    }
+    return typeOf(args);
+}
+/**
+ * ``json.dumps`` as Python writes it, which is what the other runtime
+ * hashes and displays.
+ *
+ * ``JSON.stringify`` omits the spaces Python puts after ``,`` and
+ * ``:``. That is invisible in a console and decisive in a digest: the
+ * same arguments hashed to different values on the two sides, so
+ * duplicate and loop detection disagreed about whether two calls were
+ * the same call. ``sortKeys`` additionally makes two calls that differ
+ * only in key order agree, which is what the digest is for.
+ */
+export function pyJson(value, sortKeys = false) {
+    const seen = new WeakSet();
+    const walk = (v) => {
+        if (v === null || v === undefined)
+            return "null";
+        if (typeof v === "string")
+            return JSON.stringify(v);
+        if (typeof v === "number" || typeof v === "boolean")
+            return JSON.stringify(v);
+        if (typeof v !== "object")
+            return JSON.stringify(String(v));
+        if (seen.has(v))
+            return JSON.stringify("[circular]");
+        seen.add(v);
+        if (Array.isArray(v))
+            return "[" + v.map(walk).join(", ") + "]";
+        const o = v;
+        const keys = sortKeys ? Object.keys(o).sort() : Object.keys(o);
+        return "{" + keys.map((k) => `${JSON.stringify(k)}: ${walk(o[k])}`).join(", ") + "}";
+    };
+    try {
+        return walk(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+/**
+ * A stable short hash of an argument set. An equality token, not a
+ * signature, which is why twelve hex characters is enough: it is what
+ * lets duplicate and loop detection keep working with no content.
+ */
+export function digest(args) {
+    if (args === null || args === undefined)
+        return "";
+    return ("sha256:" +
+        createHash("sha256").update(pyJson(args, true)).digest("hex").slice(0, 12));
+}
+/** What ``argsPreview`` carries at this level. */
+export function preview(args, level, fullPreview) {
+    if (level === "full")
+        return fullPreview;
+    if (level === "shape")
+        return shape(args);
+    if (level === "hashed")
+        return digest(args);
+    return "";
+}
+/**
+ * What a model turn may quote of itself. A response is the most
+ * content-bearing field in the payload, so it goes one level earlier
+ * than arguments do.
+ */
+export function say(text, level) {
+    return level === "metadata" || level === "tool_calls" ? "" : text;
+}
+/**
+ * Whether a step of this type is recorded at all.
+ *
+ * Only ``tool_calls`` drops whole steps. Every other level keeps the
+ * shape of the run and empties fields; this one keeps the action lane
+ * alone, because that is what the customer asked for by name.
+ */
+export function keepsStep(stepType, level) {
+    return level === "tool_calls" ? stepType === "tool_call" : true;
+}
+/**
+ * A stamp for the run, so a reader knows what they are not seeing.
+ *
+ * A dashboard showing empty arguments has to be able to say whether the
+ * agent passed none or the deployment declined to send them.
+ */
+export function describe(level) {
+    return {
+        level,
+        sendsArguments: level === "full",
+        sendsArgumentShapes: level === "full" || level === "shape",
+        sendsOutputText: level === "full" || level === "shape" || level === "hashed",
+        sendsClaimValues: level === "full" || level === "shape" || level === "hashed",
+        sendsOutputLane: level !== "tool_calls",
+    };
+}
+//# sourceMappingURL=privacy.js.map

package/dist/cloud/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../../src/cloud/privacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAGrF,MAAM,OAAO,GAAiB,MAAM,CAAC;AACrC,MAAM,SAAS,GAAiB,YAAY,CAAC;AAE7C,SAAS,OAAO,CAAC,CAAS;IACxB,OAAQ,MAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,QAAiB;IACvC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7B,IAAI,GAAG,EAAE,CAAC;QACR,6DAA6D;QAC7D,mEAAmE;QACnE,iDAAiD;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,gEAAgE;QAChE,+DAA+D;QAC/D,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,KAAK,CAAC,MAAM,GAAG,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,KAAK,CAAC,MAAM,GAAG,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAChE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CACjC,CAAC;QACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,IAAa;IACjC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,GAAG,CAC/D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC;QACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,MAAM,CAAC,KAAc,EAAE,QAAQ,GAAG,KAAK;IACrD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE;QAClC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAChE,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACvF,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,CACL,SAAS;QACT,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,OAAO,CACrB,IAAa,EACb,KAAmB,EACnB,WAAmB;IAEnB,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAmB;IACnD,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAmB;IAC7D,OAAO,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC1C,OAAO;QACL,KAAK;QACL,cAAc,EAAE,KAAK,KAAK,MAAM;QAChC,mBAAmB,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;QAC1D,eAAe,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QAC5E,gBAAgB,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QAC7E,eAAe,EAAE,KAAK,KAAK,YAAY;KACxC,CAAC;AACJ,CAAC"}

package/dist/cloud/view-model.d.ts

@@ -0,0 +1,49 @@
+/**
+ * One finished run, in the shape the cloud stores.
+ *
+ * Port of the projection in ``sponsio/bridge/session.py``. Field names
+ * are Python's, not new ones: the server, the console and the findings
+ * pipeline all read this object, and a TypeScript run that spelled
+ * ``argsPreview`` differently would upload successfully and then appear
+ * as a run with no arguments and no rules.
+ */
+import type { DetFormula } from "../core/patterns.js";
+import type { AgentTurnSpan } from "../core/spans.js";
+import type { DetViolation } from "../index.js";
+import * as privacy from "./privacy.js";
+/** Parity with ``bridge.spans.slug``. */
+export declare function slug(text: string): string;
+/**
+ * One line, truncated. Truncation happens before the value leaves the
+ * machine, so an argument that should never have been sent cannot be
+ * reconstructed from what was.
+ */
+export declare function argsPreview(args: unknown, limit?: number): string;
+/** A run id with enough entropy that two runs cannot silently become one. */
+export declare function newSessionId(): string;
+export interface RunSpan {
+    span: AgentTurnSpan;
+    /** The violations the check produced, in the order it produced them. */
+    violations: DetViolation[];
+    /** What kind of step this was; only ``tool_call`` survives `tool_calls`. */
+    type?: string;
+}
+export interface ViewModelInput {
+    agentId: string;
+    mode: string;
+    sessionId: string;
+    startedAt: number;
+    contracts: DetFormula[];
+    spans: RunSpan[];
+    privacyLevel: privacy.PrivacyLevel;
+    /** Which book this run enforced, when it came from the cloud. */
+    rulebookStamp?: string;
+}
+/**
+ * Build the run object.
+ *
+ * The privacy level is applied here rather than at the transport, so
+ * there is one place that decides what leaves and no path around it.
+ */
+export declare function buildViewModel(input: ViewModelInput): Record<string, unknown>;
+//# sourceMappingURL=view-model.d.ts.map

package/dist/cloud/view-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-model.d.ts","sourceRoot":"","sources":["../../src/cloud/view-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAKxC,yCAAyC;AACzC,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,SAAM,GAAG,MAAM,CAO9D;AA4BD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB,wEAAwE;IACxE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;IACnC,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuG7E"}

package/dist/cloud/view-model.js

@@ -0,0 +1,172 @@
+/**
+ * One finished run, in the shape the cloud stores.
+ *
+ * Port of the projection in ``sponsio/bridge/session.py``. Field names
+ * are Python's, not new ones: the server, the console and the findings
+ * pipeline all read this object, and a TypeScript run that spelled
+ * ``argsPreview`` differently would upload successfully and then appear
+ * as a run with no arguments and no rules.
+ */
+import { randomBytes } from "node:crypto";
+import * as privacy from "./privacy.js";
+import { pyJson } from "./privacy.js";
+const SLUG = /[^a-z0-9]+/g;
+/** Parity with ``bridge.spans.slug``. */
+export function slug(text) {
+    return String(text).trim().toLowerCase().replace(SLUG, "-").replace(/^-|-$/g, "") || "rule";
+}
+/**
+ * One line, truncated. Truncation happens before the value leaves the
+ * machine, so an argument that should never have been sent cannot be
+ * reconstructed from what was.
+ */
+export function argsPreview(args, limit = 160) {
+    if (args === null || args === undefined)
+        return "";
+    // Python's json.dumps spacing, so the same call renders identically in
+    // the console whichever runtime recorded it.
+    let text = pyJson(args);
+    text = text.split(/\s+/).join(" ");
+    return text.length <= limit ? text : text.slice(0, limit - 1) + "…";
+}
+/** Statuses the console has a colour for. */
+const KNOWN_ACTIONS = new Set([
+    "blocked", "escalated", "redirected", "retrying", "warned", "observed",
+]);
+function stepStatus(span, violations) {
+    if (!violations.length)
+        return "ok";
+    const acted = violations.find((v) => v.action && KNOWN_ACTIONS.has(v.action));
+    if (acted?.action)
+        return acted.action;
+    return span.blocked ? "blocked" : "observed";
+}
+/**
+ * Hex from the system CSPRNG, as Python's ``secrets.token_hex`` does.
+ *
+ * ``Math.random()`` is not one, and this is the one place where that
+ * matters: the server keys a run by its id and upserts, so two runs
+ * sharing an id silently become one and the older is overwritten with no
+ * error. A booting fleet seeds ``Math.random`` from a clock they share.
+ */
+function hex(chars) {
+    return randomBytes(Math.ceil(chars / 2))
+        .toString("hex")
+        .slice(0, chars);
+}
+/** A run id with enough entropy that two runs cannot silently become one. */
+export function newSessionId() {
+    return "run-" + hex(16);
+}
+function firstContractName(span) {
+    for (const child of span.children ?? []) {
+        const named = child;
+        if (named.contractName)
+            return named.contractName;
+    }
+    return undefined;
+}
+/**
+ * Build the run object.
+ *
+ * The privacy level is applied here rather than at the transport, so
+ * there is one place that decides what leaves and no path around it.
+ */
+export function buildViewModel(input) {
+    const { privacyLevel: level } = input;
+    const byLabel = new Map(input.contracts.map((c) => [c.desc, c]));
+    const violationCounts = new Map();
+    const traceId = hex(32);
+    const steps = [];
+    input.spans.forEach((entry, idx) => {
+        const type = entry.type ?? "tool_call";
+        if (!privacy.keepsStep(type, level))
+            return;
+        const rawArgs = entry.span.attributes.args;
+        const violations = entry.violations.map((v) => {
+            const contract = byLabel.get(v.desc);
+            const label = v.desc;
+            violationCounts.set(label, (violationCounts.get(label) ?? 0) + 1);
+            return {
+                contractId: slug(label),
+                contractLabel: label,
+                category: "Prohibited",
+                kind: "guarantee",
+                severity: "HIGH",
+                pipeline: "det",
+                enforcement: {
+                    strategy: v.action === "escalated" ? "EscalateToHuman" : "DetBlock",
+                    action: v.action ?? "observed",
+                },
+                evidence: `Runtime det violation: ${label}`,
+                reason: label,
+                // The rule's identity, which is what the cloud groups findings
+                // by. Without it a violation carries only its English sentence
+                // and a reworded rule loses its own history.
+                pattern: contract?.patternName ?? v.ruleId ?? "",
+                args: contract?.args ?? [],
+            };
+        });
+        steps.push({
+            id: `s${idx}`,
+            serviceName: entry.span.agentId || input.agentId,
+            traceId,
+            spanId: "0".repeat(16),
+            type,
+            tool: entry.span.action,
+            argsPreview: privacy.preview(rawArgs, level, argsPreview(rawArgs)),
+            durationMs: Number((entry.span.durationMs() ?? 0).toFixed(2)),
+            status: stepStatus(entry.span, entry.violations),
+            verdict: {
+                blocked: entry.span.blocked,
+                contractsChecked: entry.span.totalContractsChecked,
+                violations,
+            },
+        });
+    });
+    const contracts = input.contracts.map((c) => ({
+        id: slug(c.desc),
+        label: c.desc,
+        status: (violationCounts.get(c.desc) ?? 0) > 0 ? "watching" : "armed",
+        pipeline: "det",
+        violationCount: violationCounts.get(c.desc) ?? 0,
+        pattern: c.patternName,
+        args: c.args ?? [],
+        source: "policy",
+        boundAgents: [],
+    }));
+    const total = steps.length;
+    const failed = steps.filter((s) => s.status !== "ok").length;
+    const blocked = steps.filter((s) => s.status === "blocked").length;
+    const vm = {
+        session: {
+            id: input.sessionId,
+            agentId: input.agentId,
+            mode: input.mode,
+            startedAt: input.startedAt,
+        },
+        agents: [{ id: input.agentId, label: input.agentId }],
+        edges: [],
+        steps,
+        contracts,
+        summary: {
+            passRate: total ? (total - failed) / total : 1,
+            totalSteps: total,
+            detBlocks: blocked,
+            stoRetries: 0,
+            escalations: steps.filter((s) => s.status === "escalated").length,
+            contractsArmed: contracts.filter((c) => c.violationCount === 0).length,
+            contractsTotal: contracts.length,
+            stopped: blocked,
+        },
+        // So a reader can tell "the agent passed no arguments" from "this
+        // deployment does not send them".
+        privacy: privacy.describe(level),
+    };
+    if (input.rulebookStamp) {
+        vm.rulebook = input.rulebookStamp;
+        vm.rulebookRef = input.rulebookStamp;
+    }
+    return vm;
+}
+//# sourceMappingURL=view-model.js.map

package/dist/cloud/view-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-model.js","sourceRoot":"","sources":["../../src/cloud/view-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B,yCAAyC;AACzC,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa,EAAE,KAAK,GAAG,GAAG;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnD,uEAAuE;IACvE,6CAA6C;IAC7C,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;AACtE,CAAC;AAED,6CAA6C;AAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU;CACvE,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,IAAmB,EAAE,UAA0B;IACjE,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;SACrC,QAAQ,CAAC,KAAK,CAAC;SACf,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAsBD,SAAS,iBAAiB,CAAC,IAAc;IACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,KAA6C,CAAC;QAC5D,IAAI,KAAK,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO;QAE5C,MAAM,OAAO,GAAI,KAAK,CAAC,IAAI,CAAC,UAAiC,CAAC,IAAI,CAAC;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;gBACvB,aAAa,EAAE,KAAK;gBACpB,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE;oBACX,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;oBACnE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,UAAU;iBAC/B;gBACD,QAAQ,EAAE,0BAA0B,KAAK,EAAE;gBAC3C,MAAM,EAAE,KAAK;gBACb,+DAA+D;gBAC/D,+DAA+D;gBAC/D,6CAA6C;gBAC7C,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE;gBAChD,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;aAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,IAAI,GAAG,EAAE;YACb,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;YAChD,OAAO;YACP,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;YACvB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAClE,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC;YAChD,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBAC3B,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;gBAClD,UAAU;aACX;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChB,KAAK,EAAE,CAAC,CAAC,IAAI;QACb,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;QACrE,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChD,OAAO,EAAE,CAAC,CAAC,WAAW;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,EAAc;KAC5B,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEnE,MAAM,EAAE,GAA4B;QAClC,OAAO,EAAE;YACP,EAAE,EAAE,KAAK,CAAC,SAAS;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACrD,KAAK,EAAE,EAAE;QACT,KAAK;QACL,SAAS;QACT,OAAO,EAAE;YACP,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9C,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YACjE,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,MAAM;YACtE,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,OAAO,EAAE,OAAO;SACjB;QACD,kEAAkE;QAClE,kCAAkC;QAClC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;KACjC,CAAC;IAEF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,EAAE,CAAC,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC;QAClC,EAAE,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/contract.d.ts

@@ -11,16 +11,16 @@
  *     contracts: [
  *       contract("refund policy gate")
  *         .assume("called `issue_refund`")
- *         .enforce("must call `check_policy` before `issue_refund`"),
+ *         .guarantees("must call `check_policy` before `issue_refund`"),
  *       contract("rate cap")
- *         .enforce("tool `issue_refund` at most 3 times"),
+ *         .guarantees("tool `issue_refund` at most 3 times"),
  *     ],
  *   });
  *
- * Repeated ``.assume`` / ``.enforce`` calls AND-combine (matching
+ * Repeated ``.assume`` / ``.guarantees`` calls AND-combine (matching
  * the Python builder). If ``.assume`` is omitted the contract is
- * unconditional and the enforcement formula is used as-is. If
- * ``.assume`` is present the formula is ``A -> E``.
+ * unconditional and the guarantee formula is used as-is. If
+ * ``.assume`` is present the formula is ``A -> G``.
  *
  * The builder satisfies ``DetFormula`` structurally, so it can be
  * passed directly to ``Sponsio({ contracts: [...] })`` — no ``build()``
@@ -33,23 +33,23 @@ export declare class ContractBuilder implements DetFormula {
     readonly patternName: string;
     readonly liveness: boolean;
     private _assumption;
-    private _enforcement;
+    private _guarantee;
     constructor(desc?: string);
     /** Add an assumption clause (A side). Repeated calls AND-combine. */
     assume(clause: string | DetFormula): ContractBuilder;
-    /** Add an enforcement clause (E side). Repeated calls AND-combine. */
-    enforce(clause: string | DetFormula): ContractBuilder;
+    /** Add a guarantee clause (G side). Repeated calls AND-combine. */
+    guarantees(clause: string | DetFormula): ContractBuilder;
     /**
      * The compiled LTL formula. Accessed at `Sponsio` construction time.
      *
-     * - If both A and E are set: ``G(A -> E)``. We wrap in ``G`` because
-     *   the evaluator runs from ``pos=0``; a bare ``Implies(A, E)`` would
+     * - If both A and G are set: ``G(A -> G_)``. We wrap in ``G`` because
+     *   the evaluator runs from ``pos=0``; a bare ``Implies(A, G_)`` would
      *   short-circuit whenever ``A`` was false at step 0 regardless of
      *   later events. ``G`` lifts the implication to every step so the
-     *   enforcement fires whenever the assumption holds.
-     * - If only E: ``E`` (unconditional; the pattern factories already
+     *   guarantee fires whenever the assumption holds.
+     * - If only G: ``G_`` (unconditional; the pattern factories already
      *   emit safety properties wrapped in ``G`` where needed).
-     * - If neither: throws — every contract needs an enforcement.
+     * - If neither: throws — every contract needs a guarantee.
      */
     get formula(): Formula;
     private _clone;

package/dist/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAmB,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAc;IAC1C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAS;IAEnC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,YAAY,CAAiB;gBAEzB,IAAI,CAAC,EAAE,MAAM;IAMzB,qEAAqE;IACrE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe;IAOpD,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe;IAOrD;;;;;;;;;;;OAWG;IACH,IAAI,OAAO,IAAI,OAAO,CASrB;IAED,OAAO,CAAC,MAAM;CAMf;AAeD,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAEvD"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAmB,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAc;IAC1C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAS;IAEnC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,UAAU,CAAiB;gBAEvB,IAAI,CAAC,EAAE,MAAM;IAMzB,qEAAqE;IACrE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe;IAOpD,mEAAmE;IACnE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,eAAe;IAOxD;;;;;;;;;;;OAWG;IACH,IAAI,OAAO,IAAI,OAAO,CASrB;IAED,OAAO,CAAC,MAAM;CAMf;AAeD,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAEvD"}

package/dist/contract.js

@@ -11,16 +11,16 @@
  *     contracts: [
  *       contract("refund policy gate")
  *         .assume("called `issue_refund`")
- *         .enforce("must call `check_policy` before `issue_refund`"),
+ *         .guarantees("must call `check_policy` before `issue_refund`"),
  *       contract("rate cap")
- *         .enforce("tool `issue_refund` at most 3 times"),
+ *         .guarantees("tool `issue_refund` at most 3 times"),
  *     ],
  *   });
  *
- * Repeated ``.assume`` / ``.enforce`` calls AND-combine (matching
+ * Repeated ``.assume`` / ``.guarantees`` calls AND-combine (matching
  * the Python builder). If ``.assume`` is omitted the contract is
- * unconditional and the enforcement formula is used as-is. If
- * ``.assume`` is present the formula is ``A -> E``.
+ * unconditional and the guarantee formula is used as-is. If
+ * ``.assume`` is present the formula is ``A -> G``.
  *
  * The builder satisfies ``DetFormula`` structurally, so it can be
  * passed directly to ``Sponsio({ contracts: [...] })`` — no ``build()``
@@ -33,11 +33,11 @@ export class ContractBuilder {
     patternName = "contract";
     liveness = false;
     _assumption;
-    _enforcement;
+    _guarantee;
     constructor(desc) {
         this.desc = desc ?? "contract";
         this._assumption = null;
-        this._enforcement = null;
+        this._guarantee = null;
     }
     /** Add an assumption clause (A side). Repeated calls AND-combine. */
     assume(clause) {
@@ -46,37 +46,37 @@ export class ContractBuilder {
         next._assumption = next._assumption ? new And(next._assumption, f) : f;
         return next;
     }
-    /** Add an enforcement clause (E side). Repeated calls AND-combine. */
-    enforce(clause) {
+    /** Add a guarantee clause (G side). Repeated calls AND-combine. */
+    guarantees(clause) {
         const next = this._clone();
-        const f = toFormula(clause, "enforce");
-        next._enforcement = next._enforcement ? new And(next._enforcement, f) : f;
+        const f = toFormula(clause, "guarantees");
+        next._guarantee = next._guarantee ? new And(next._guarantee, f) : f;
         return next;
     }
     /**
      * The compiled LTL formula. Accessed at `Sponsio` construction time.
      *
-     * - If both A and E are set: ``G(A -> E)``. We wrap in ``G`` because
-     *   the evaluator runs from ``pos=0``; a bare ``Implies(A, E)`` would
+     * - If both A and G are set: ``G(A -> G_)``. We wrap in ``G`` because
+     *   the evaluator runs from ``pos=0``; a bare ``Implies(A, G_)`` would
      *   short-circuit whenever ``A`` was false at step 0 regardless of
      *   later events. ``G`` lifts the implication to every step so the
-     *   enforcement fires whenever the assumption holds.
-     * - If only E: ``E`` (unconditional; the pattern factories already
+     *   guarantee fires whenever the assumption holds.
+     * - If only G: ``G_`` (unconditional; the pattern factories already
      *   emit safety properties wrapped in ``G`` where needed).
-     * - If neither: throws — every contract needs an enforcement.
+     * - If neither: throws — every contract needs a guarantee.
      */
     get formula() {
-        if (!this._enforcement) {
-            throw new Error(`contract(${JSON.stringify(this.desc)}): .enforce(...) is required`);
+        if (!this._guarantee) {
+            throw new Error(`contract(${JSON.stringify(this.desc)}): .guarantees(...) is required`);
         }
         return this._assumption
-            ? new G(new Implies(this._assumption, this._enforcement))
-            : this._enforcement;
+            ? new G(new Implies(this._assumption, this._guarantee))
+            : this._guarantee;
     }
     _clone() {
         const next = new ContractBuilder(this.desc);
         next._assumption = this._assumption;
-        next._enforcement = this._enforcement;
+        next._guarantee = this._guarantee;
         return next;
     }
 }

package/dist/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAGlE,MAAM,OAAO,eAAe;IACjB,IAAI,CAAS;IACb,WAAW,GAAW,UAAU,CAAC;IACjC,QAAQ,GAAY,KAAK,CAAC;IAE3B,WAAW,CAAiB;IAC5B,YAAY,CAAiB;IAErC,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,MAA2B;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,OAAO,CAAC,MAA2B;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,OAAO;QACT,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW;YACrB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IACxB,CAAC;IAEO,MAAM;QACZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,KAAa;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,KAAK,MAAM,+BAA+B,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAGlE,MAAM,OAAO,eAAe;IACjB,IAAI,CAAS;IACb,WAAW,GAAW,UAAU,CAAC;IACjC,QAAQ,GAAY,KAAK,CAAC;IAE3B,WAAW,CAAiB;IAC5B,UAAU,CAAiB;IAEnC,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,qEAAqE;IACrE,MAAM,CAAC,MAA2B;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,UAAU,CAAC,MAA2B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,OAAO;QACT,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW;YACrB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACtB,CAAC;IAEO,MAAM;QACZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,KAAa;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,KAAK,MAAM,+BAA+B,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/config-loader.d.ts

@@ -31,7 +31,7 @@ export interface LoadedConfig {
     /**
      * Det contracts the TS SDK can consume. NL strings get run through
      * ``parseNl`` in the ctor; pre-built ``DetFormula`` entries (from
-     * structured patterns, raw LTL, or A/E composition) are pushed
+     * structured patterns, raw LTL, or A/G composition) are pushed
      * straight onto the contract list — no NL parsing required.
      */
     contracts: (string | DetFormula)[];

package/dist/core/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/core/config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAgBhD,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,SAAS,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IACnC,iEAAiE;IACjE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,yEAAyE;IACzE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,cAAc,GAAG,kBAAkB,CAAC;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,GAClB,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;mCAC+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAsD5E"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/core/config-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AA+BhD,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,SAAS,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IACnC,iEAAiE;IACjE,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,yEAAyE;IACzE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,cAAc,GAAG,kBAAkB,CAAC;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,GAClB,gBAAgB,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;mCAC+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CA6D5E"}