attenu-guard 0.3.0 → 0.4.0

package/dist/esm/index.d.ts

@@ -30,23 +30,26 @@
  */
 export { Authority, AuthorityError } from "./authority.js";
 export type { AuthorityInit, AuthorityWire } from "./authority.js";
-export { Guard, AuthorityDenied } from "./guard.js";
-export type { CheckOptions, IssueOptions, RecordDenialOptions } from "./guard.js";
-export { Decision, Reason, ReasonCode, Disposition, DISPOSITIONS } from "./reasons.js";
-export type { DispositionValue, ReasonCodeValue, ReasonInit } from "./reasons.js";
+export { Guard, AuthorityDenied, DuplicateOutcomeError } from "./guard.js";
+export type { AdapterInfo, CheckOptions, IssueOptions, ReceiptInfo, RecordDenialOptions, RecordOutcomeOptions, } from "./guard.js";
+export { BODY_STATES, CAPTURES, DISPOSITIONS, BodyState, Capture, CompletionResult, Decision, Disposition, Reason, ReasonCode, } from "./reasons.js";
+export type { BodyStateValue, CaptureValue, DispositionValue, ReasonCodeValue, ReasonInit, } from "./reasons.js";
+export { PARAMS_C14N_VERSION, PARAMS_HASH_REASONS, ParamsHashReason, SALT_HEX_LEN, decodeSalt } from "./params.js";
+export type { ParamsHashReasonValue } from "./params.js";
+export { commit as commitParams } from "./params.js";
 export { Allow, CallLimit, Deny, EgressRank, Prefix, RowLimit, SpendCap, UnknownCeiling, ceilingFromWire, ctxFieldOf, describe, isMetered, registerCeiling, } from "./ceilings.js";
 export type { Ceiling, CeilingClass, Context } from "./ceilings.js";
-export { AuditLog, GENESIS, SCHEMA_VERSION, chainIdOf, hashEntry } from "./audit.js";
+export { AuditLog, CommittedAuditError, GENESIS, SCHEMA_VERSION, chainIdOf, hashEntry } from "./audit.js";
 export type { Anchor, AuditLogInit, LedgerEntry, Sink } from "./audit.js";
 export { Chain, ManualClock, MonotonicClock } from "./chain.js";
 export type { Clock, ChainInit, Node } from "./chain.js";
 export { StrikePolicy } from "./strikes.js";
 export type { StrikeMode, StrikePolicyInit } from "./strikes.js";
-export { EvidenceLeakError, LEDGER_FIELDS, anchorFor, delegationGraph, denials, exportBundle, parseBundle, redactionReport, verifyBundle, } from "./evidence.js";
-export type { Bundle, DelegationGraph, DenialRow, ExportOptions, GraphNode, RedactionReport, RedactionViolation, VerifyChecks, VerifyReport, } from "./evidence.js";
+export { EvidenceLeakError, LEDGER_FIELDS, SUPPORTED_BUNDLE_VERSIONS, anchorFor, delegationGraph, denials, exportBundle, parseBundle, redactionReport, verifyBundle, } from "./evidence.js";
+export type { Bundle, DelegationGraph, DenialRow, ExecutionBinding, ExportOptions, GraphNode, RedactionReport, RedactionViolation, VerifyChecks, VerifyReport, } from "./evidence.js";
 export { Ed25519Signer, Ed25519Verifier, HS256TestSigner, VerifiedChain, WireError, WireReasonCode, b64urlDecode, b64urlEncode, load, } from "./wire.js";
 export type { LoadOptions, Signer, WireReasonCodeValue } from "./wire.js";
-export { CanonicalizationError, DuplicateMemberError, LoneSurrogateError, NonFiniteNumberError, RawNumber, UnsupportedTypeError, canonicalBytes, canonicalJson, compareCodePoints, parseJson, pyNumber, sortedStrings, toPlain, } from "./canonical.js";
+export { CanonicalizationError, DuplicateMemberError, LoneSurrogateError, MAX_SAFE_INTEGER, NonFiniteNumberError, RawNumber, UnsafeIntegerError, UnsupportedTypeError, canonicalBytes, canonicalJson, compareCodePoints, parseJson, pyNumber, sortedStrings, toPlain, } from "./canonical.js";
 export type { CJson, Json } from "./canonical.js";
-export declare const VERSION = "0.3.0";
+export { VERSION } from "./version.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACvF,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAElF,OAAO,EACL,KAAK,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrF,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,eAAe,EACf,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,MAAM,EACN,eAAe,EACf,SAAS,EACT,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,IAAI,GACL,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,aAAa,EACb,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAElD,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC3E,YAAY,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,MAAM,EACN,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnH,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,KAAK,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1G,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,MAAM,EACN,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,IAAI,GACL,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,aAAa,EACb,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/index.js

@@ -29,14 +29,16 @@
  * one verifies with the other.
  */
 export { Authority, AuthorityError } from "./authority.js";
-export { Guard, AuthorityDenied } from "./guard.js";
-export { Decision, Reason, ReasonCode, Disposition, DISPOSITIONS } from "./reasons.js";
+export { Guard, AuthorityDenied, DuplicateOutcomeError } from "./guard.js";
+export { BODY_STATES, CAPTURES, DISPOSITIONS, BodyState, Capture, CompletionResult, Decision, Disposition, Reason, ReasonCode, } from "./reasons.js";
+export { PARAMS_C14N_VERSION, PARAMS_HASH_REASONS, ParamsHashReason, SALT_HEX_LEN, decodeSalt } from "./params.js";
+export { commit as commitParams } from "./params.js";
 export { Allow, CallLimit, Deny, EgressRank, Prefix, RowLimit, SpendCap, UnknownCeiling, ceilingFromWire, ctxFieldOf, describe, isMetered, registerCeiling, } from "./ceilings.js";
-export { AuditLog, GENESIS, SCHEMA_VERSION, chainIdOf, hashEntry } from "./audit.js";
+export { AuditLog, CommittedAuditError, GENESIS, SCHEMA_VERSION, chainIdOf, hashEntry } from "./audit.js";
 export { Chain, ManualClock, MonotonicClock } from "./chain.js";
 export { StrikePolicy } from "./strikes.js";
-export { EvidenceLeakError, LEDGER_FIELDS, anchorFor, delegationGraph, denials, exportBundle, parseBundle, redactionReport, verifyBundle, } from "./evidence.js";
+export { EvidenceLeakError, LEDGER_FIELDS, SUPPORTED_BUNDLE_VERSIONS, anchorFor, delegationGraph, denials, exportBundle, parseBundle, redactionReport, verifyBundle, } from "./evidence.js";
 export { Ed25519Signer, Ed25519Verifier, HS256TestSigner, VerifiedChain, WireError, WireReasonCode, b64urlDecode, b64urlEncode, load, } from "./wire.js";
-export { CanonicalizationError, DuplicateMemberError, LoneSurrogateError, NonFiniteNumberError, RawNumber, UnsupportedTypeError, canonicalBytes, canonicalJson, compareCodePoints, parseJson, pyNumber, sortedStrings, toPlain, } from "./canonical.js";
-export const VERSION = "0.3.0";
+export { CanonicalizationError, DuplicateMemberError, LoneSurrogateError, MAX_SAFE_INTEGER, NonFiniteNumberError, RawNumber, UnsafeIntegerError, UnsupportedTypeError, canonicalBytes, canonicalJson, compareCodePoints, parseJson, pyNumber, sortedStrings, toPlain, } from "./canonical.js";
+export { VERSION } from "./version.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGvF,OAAO,EACL,KAAK,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGrF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,eAAe,EACf,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAavB,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,IAAI,GACL,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,aAAa,EACb,OAAO,GACR,MAAM,gBAAgB,CAAC;AAGxB,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAU3E,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,MAAM,EACN,UAAU,GACX,MAAM,cAAc,CAAC;AAStB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEnH,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,KAAK,EACL,SAAS,EACT,IAAI,EACJ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,QAAQ,EACR,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG1G,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAcvB,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,IAAI,GACL,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,aAAa,EACb,OAAO,GACR,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/params.d.ts

@@ -0,0 +1,52 @@
+/**
+ * params.ts — the `params_c14n_v1` argument commitment (docs/execution-binding spec section 4).
+ *
+ * Two observations, two hashes: `authorized_params_hash` (on the `allow` entry, from what
+ * `Guard.check` was called with) and `invoked_params_hash` (on the `outcome` entry, from what the
+ * body-owning wrapper observed immediately before the actual invocation). Substitution between
+ * them is visible only because both exist; neither raw value is ever logged.
+ *
+ * Commitment: `SHA-256(rawSalt || UTF8(JCS(params)))`, lowercase hex — `rawSalt` is the chain's
+ * 16-byte `paramsSalt` (see chain.ts), fixed for the chain's lifetime; `JCS(params)` reuses
+ * `canonicalBytes` verbatim (RFC 8785), so the numeric domain and encoding rules are identical to
+ * every other signing surface in this library.
+ *
+ * One divergence from the Python module this mirrors, deliberately closed rather than inherited:
+ * Python's general `canonical.dumps` tolerates an out-of-range INTEGRAL float (e.g. `1e20`) —
+ * needed for a pinned JCS-divergence-class test — so `attenu_guard.params` runs its own domain
+ * pre-check in front of it. TypeScript's `canonicalBytes` has no such tolerance: because
+ * JavaScript has one numeric type, `checkSafeInteger` already rejects EVERY unsafe integer,
+ * literal or float-shaped alike (see canonical.ts's `UnsafeIntegerError`). The spec's rule for
+ * this profile is stated runtime-neutrally — "every mathematically integral number outside
+ * ±(2^53−1) is rejected, regardless of the host's numeric type" — so this module still runs its
+ * OWN independent domain check (mirroring Python's `_has_unsafe_integral_float`) rather than
+ * leaning on `canonicalBytes`'s already-strict behaviour: that behaviour is an accident of
+ * JavaScript having no int/float distinction, not a promise `params.ts` should depend on.
+ *
+ * Outside the domain (either reason): no hash, and the caller writes `paramsHashReason:
+ * "unsupported"` on the record whose hash is absent — never throws. A caller that never attempts
+ * a commitment at all writes neither field; "unsupported" and "never attempted" are deliberately
+ * distinguishable states, not folded into one.
+ */
+import { type Json } from "./canonical.js";
+export declare const PARAMS_C14N_VERSION = "params_c14n_v1";
+export declare const SALT_HEX_LEN = 32;
+/** `"unsupported"` — the one reason a params commitment can be absent. */
+export declare const ParamsHashReason: {
+    readonly UNSUPPORTED: "unsupported";
+};
+export type ParamsHashReasonValue = (typeof ParamsHashReason)[keyof typeof ParamsHashReason];
+export declare const PARAMS_HASH_REASONS: ReadonlySet<string>;
+/**
+ * The 16 raw bytes a chain's `paramsSalt` (32 lowercase hex chars, on the `root` entry) decodes
+ * to. Throws on anything else — a malformed salt must fail loudly, not silently hash against the
+ * wrong number of bytes.
+ */
+export declare function decodeSalt(paramsSaltHex: string): Buffer;
+/**
+ * `[hashHex, reason]`. `hashHex` is the lowercase-hex `params_c14n_v1` commitment, or `null` if
+ * `params` is outside the domain — in which case `reason === ParamsHashReason.UNSUPPORTED`.
+ * Exactly one of the two is non-null.
+ */
+export declare function commit(paramsValue: Json, rawSalt: Buffer): [string | null, string | null];
+//# sourceMappingURL=params.d.ts.map

package/dist/esm/params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.d.ts","sourceRoot":"","sources":["../../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAA2D,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEpG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,YAAY,KAAK,CAAC;AAE/B,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB;;CAEnB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE7F,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAA4C,CAAC;AAEjG;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAOxD;AAoBD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,CAiBzF"}

package/dist/esm/params.js

@@ -0,0 +1,92 @@
+/**
+ * params.ts — the `params_c14n_v1` argument commitment (docs/execution-binding spec section 4).
+ *
+ * Two observations, two hashes: `authorized_params_hash` (on the `allow` entry, from what
+ * `Guard.check` was called with) and `invoked_params_hash` (on the `outcome` entry, from what the
+ * body-owning wrapper observed immediately before the actual invocation). Substitution between
+ * them is visible only because both exist; neither raw value is ever logged.
+ *
+ * Commitment: `SHA-256(rawSalt || UTF8(JCS(params)))`, lowercase hex — `rawSalt` is the chain's
+ * 16-byte `paramsSalt` (see chain.ts), fixed for the chain's lifetime; `JCS(params)` reuses
+ * `canonicalBytes` verbatim (RFC 8785), so the numeric domain and encoding rules are identical to
+ * every other signing surface in this library.
+ *
+ * One divergence from the Python module this mirrors, deliberately closed rather than inherited:
+ * Python's general `canonical.dumps` tolerates an out-of-range INTEGRAL float (e.g. `1e20`) —
+ * needed for a pinned JCS-divergence-class test — so `attenu_guard.params` runs its own domain
+ * pre-check in front of it. TypeScript's `canonicalBytes` has no such tolerance: because
+ * JavaScript has one numeric type, `checkSafeInteger` already rejects EVERY unsafe integer,
+ * literal or float-shaped alike (see canonical.ts's `UnsafeIntegerError`). The spec's rule for
+ * this profile is stated runtime-neutrally — "every mathematically integral number outside
+ * ±(2^53−1) is rejected, regardless of the host's numeric type" — so this module still runs its
+ * OWN independent domain check (mirroring Python's `_has_unsafe_integral_float`) rather than
+ * leaning on `canonicalBytes`'s already-strict behaviour: that behaviour is an accident of
+ * JavaScript having no int/float distinction, not a promise `params.ts` should depend on.
+ *
+ * Outside the domain (either reason): no hash, and the caller writes `paramsHashReason:
+ * "unsupported"` on the record whose hash is absent — never throws. A caller that never attempts
+ * a commitment at all writes neither field; "unsupported" and "never attempted" are deliberately
+ * distinguishable states, not folded into one.
+ */
+import { createHash } from "node:crypto";
+import { CanonicalizationError, MAX_SAFE_INTEGER, canonicalBytes } from "./canonical.js";
+export const PARAMS_C14N_VERSION = "params_c14n_v1";
+export const SALT_HEX_LEN = 32; // 16 raw bytes, hex-encoded
+/** `"unsupported"` — the one reason a params commitment can be absent. */
+export const ParamsHashReason = {
+    UNSUPPORTED: "unsupported",
+};
+export const PARAMS_HASH_REASONS = new Set(Object.values(ParamsHashReason));
+/**
+ * The 16 raw bytes a chain's `paramsSalt` (32 lowercase hex chars, on the `root` entry) decodes
+ * to. Throws on anything else — a malformed salt must fail loudly, not silently hash against the
+ * wrong number of bytes.
+ */
+export function decodeSalt(paramsSaltHex) {
+    if (!/^[0-9a-f]{32}$/.test(paramsSaltHex)) {
+        throw new Error(`params_salt must decode to 16 raw bytes; got ${JSON.stringify(paramsSaltHex)}`);
+    }
+    return Buffer.from(paramsSaltHex, "hex");
+}
+/**
+ * `true` if `value` contains, anywhere in its structure, a number that is mathematically integral
+ * and exceeds ±`MAX_SAFE_INTEGER` — the params_c14n_v1 domain boundary, checked independently of
+ * `canonicalBytes` (see the module doc comment).
+ */
+function hasUnsafeIntegralNumber(value) {
+    if (typeof value === "number") {
+        return Number.isFinite(value) && Number.isInteger(value) && Math.abs(value) > MAX_SAFE_INTEGER;
+    }
+    if (Array.isArray(value)) {
+        return value.some(hasUnsafeIntegralNumber);
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.values(value).some(hasUnsafeIntegralNumber);
+    }
+    return false;
+}
+/**
+ * `[hashHex, reason]`. `hashHex` is the lowercase-hex `params_c14n_v1` commitment, or `null` if
+ * `params` is outside the domain — in which case `reason === ParamsHashReason.UNSUPPORTED`.
+ * Exactly one of the two is non-null.
+ */
+export function commit(paramsValue, rawSalt) {
+    if (hasUnsafeIntegralNumber(paramsValue)) {
+        return [null, ParamsHashReason.UNSUPPORTED];
+    }
+    let encoded;
+    try {
+        encoded = canonicalBytes(paramsValue); // UTF8(JCS(params)) — canonicalBytes already returns UTF-8 bytes
+    }
+    catch (e) {
+        if (e instanceof CanonicalizationError) {
+            return [null, ParamsHashReason.UNSUPPORTED];
+        }
+        throw e;
+    }
+    const h = createHash("sha256");
+    h.update(rawSalt);
+    h.update(encoded);
+    return [h.digest("hex"), null];
+}
+//# sourceMappingURL=params.js.map

package/dist/esm/params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"params.js","sourceRoot":"","sources":["../../src/params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAa,MAAM,gBAAgB,CAAC;AAEpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,4BAA4B;AAE5D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,aAAa;CAClB,CAAC;AAIX,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,WAAiB,EAAE,OAAe;IACvD,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,WAAoB,CAAC,CAAC,CAAC,iEAAiE;IACnH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC"}

package/dist/esm/reasons.d.ts

@@ -33,6 +33,13 @@ export declare const ReasonCode: {
     readonly CHAIN_CEILING: "chain_ceiling";
     /** The principal holds no authority at all in this chain. */
     readonly NO_AUTHORITY: "no_authority";
+    /** `check` refused: the node already called `complete()`. */
+    readonly NODE_FINALIZED: "node_finalized";
+    /**
+     * The CSPRNG failed while allocating `callId`; fail-closed — the call is denied and
+     * nothing is written.
+     */
+    readonly CALL_ID_UNAVAILABLE: "call_id_unavailable";
 };
 export type ReasonCodeValue = (typeof ReasonCode)[keyof typeof ReasonCode];
 /**
@@ -52,6 +59,68 @@ export declare const Disposition: {
 };
 export type DispositionValue = (typeof Disposition)[keyof typeof Disposition];
 export declare const DISPOSITIONS: ReadonlySet<string>;
+/**
+ * What the adapter's code path WILL observe for a given `check`ed call (0.9.0 execution binding)
+ * — recorded on the `allow` entry alongside `adapter` (module/version/hookPath). Describes
+ * observation CAPABILITY only, never a claim of quality: a verifier routes a call into
+ * observed/unobserved reporting from this label, never trusts it as evidence on its own.
+ */
+export declare const Capture: {
+    /** The adapter's wrapper calls the body itself, synchronously. */
+    readonly WRAPPER_SYNC: "wrapper_sync";
+    /** ... and awaits it. */
+    readonly WRAPPER_ASYNC: "wrapper_async";
+    /** The framework itself calls back after the body runs. */
+    readonly FRAMEWORK_POST_HOOK: "framework_post_hook";
+    /** The adapter sees the call authorized but never observes it finish. */
+    readonly PRE_HOOK_ONLY: "pre_hook_only";
+};
+export type CaptureValue = (typeof Capture)[keyof typeof Capture];
+export declare const CAPTURES: ReadonlySet<string>;
+/**
+ * The `outcome` record's observation of how a body-owning wrapper's call ended (0.9.0 execution
+ * binding, docs/execution-binding spec section 3) — an OBSERVATION, not a judgment about the
+ * world. There is no `executed`/`blocked`/`timeout`/`cancelled` at this layer; each of those
+ * words claims knowledge a wrapper does not always have. Adapters emitting into a richer outcome
+ * vocabulary own that mapping.
+ */
+export declare const BodyState: {
+    /** The body returned to the wrapper. */
+    readonly RETURNED: "returned";
+    /** It raised (`errorCode` required, from the exception's class/constructor name). */
+    readonly RAISED: "raised";
+    /** The wrapper stopped observing while the body may still run. */
+    readonly ABANDONED: "abandoned";
+    /** The wrapper returned a generator/stream/future it does not itself consume. */
+    readonly DEFERRED: "deferred";
+};
+export type BodyStateValue = (typeof BodyState)[keyof typeof BodyState];
+export declare const BODY_STATES: ReadonlySet<string>;
+/**
+ * `Guard.complete()`'s return value on a `schemaVersion: 2` chain ONLY (0.9.0, docs/
+ * execution-binding spec section 1): whether the node was actually finalized, and — when it
+ * refused because calls are still pending an outcome — the `callId`s it is waiting on. On a
+ * `schemaVersion: 1` chain (the default), `complete()` returns a plain `boolean`,
+ * byte-and-type IDENTICAL to every release before 0.9.0 — v1 never gained pending-call
+ * awareness, so there is nothing new for it to report and no reason to change its return type
+ * (mirrors attenu-guard Python's merge-gate fix restoring this exact split).
+ *
+ * Python's v2 return value is bool-coercible via `__bool__`, so `if guard.complete():` keeps
+ * reading naturally there. JavaScript has no such hook for `if` — `ToBoolean` on any object is
+ * unconditionally `true`, so on v2 an `if (guard.complete())` check cannot be bridged to `false`
+ * no matter what this class defines, and neither can `assert.equal`/`assert.strictEqual` from
+ * `node:assert/strict` (no coercion at all). What CAN be bridged: `valueOf()` returns
+ * `.completed`, so contexts that genuinely coerce via `==`/`!=` (loose equality), template
+ * literals, and arithmetic still read as a boolean. On v2, read `.completed` explicitly wherever
+ * you would have written `if (guard.complete())`.
+ */
+export declare class CompletionResult {
+    readonly completed: boolean;
+    readonly pendingCallIds: readonly string[];
+    constructor(completed: boolean, pendingCallIds?: readonly string[]);
+    valueOf(): boolean;
+    toString(): string;
+}
 export interface ReasonInit {
     /** Which ceiling or dimension, e.g. "max_rows". */
     constraint?: string | null;
@@ -83,10 +152,29 @@ export declare class Decision {
     readonly allowed: boolean;
     readonly reasons: readonly Reason[];
     readonly determiningNode: string | null;
-    constructor(allowed: boolean, reasons?: readonly Reason[], determiningNode?: string | null);
+    /**
+     * 0.9.0 execution binding: set only on a `schemaVersion: 2` chain (`Guard.check` /
+     * `Guard.recordDenial`); `null` on schema-version-1 chains and on any `Decision` built
+     * outside a `Guard` transition (`wouldAllow`, tests).
+     */
+    readonly callId: string | null;
+    constructor(allowed: boolean, reasons?: readonly Reason[], determiningNode?: string | null, 
+    /**
+     * 0.9.0 execution binding: set only on a `schemaVersion: 2` chain (`Guard.check` /
+     * `Guard.recordDenial`); `null` on schema-version-1 chains and on any `Decision` built
+     * outside a `Guard` transition (`wouldAllow`, tests).
+     */
+    callId?: string | null);
     /** A single human-readable line — for logs, CLIs and error messages. */
     explain(): string;
+    /**
+     * `callId` is included only when set (a `schemaVersion: 2` chain's `check`/`recordDenial`) — a
+     * v1 Decision's serialized shape stays byte-and-key identical to every release before 0.9.0,
+     * never gaining a `call_id: null` key it never had.
+     */
     toDict(): Record<string, Json>;
+    /** A copy of this Decision with `callId` set — mirrors Python's `dataclasses.replace`. */
+    withCallId(callId: string | null): Decision;
     static allow(node?: string | null): Decision;
     static deny(reasons: Reason | readonly Reason[], node?: string | null): Decision;
 }

package/dist/esm/reasons.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reasons.d.ts","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;;;;;;IASrB,4EAA4E;;;;;;;;IAU5E,6DAA6D;;CAErD,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,WAAW;IACtB,mDAAmD;;IAEnD,mEAAmE;;IAEnE,+CAA+C;;IAE/C,2EAA2E;;CAEnE,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAE9E,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,4CAA4C;IAC5C,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sCAAsC;AACtC,qBAAa,MAAM;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe;IAQ/C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAU9B,QAAQ,IAAI,MAAM;CAQnB;AAQD;;;;;GAKG;AACH,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;gBAF9B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,SAAS,MAAM,EAAO,EAC/B,eAAe,GAAE,MAAM,GAAG,IAAW;IAGhD,wEAAwE;IACxE,OAAO,IAAI,MAAM;IAMjB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAQ9B,MAAM,CAAC,KAAK,CAAC,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;IAIlD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;CAIvF"}
+{"version":3,"file":"reasons.d.ts","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;;;;;;IASrB,4EAA4E;;;;;;;;IAU5E,6DAA6D;;IAG7D,6DAA6D;;IAE7D;;;OAGG;;CAEK,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,WAAW;IACtB,mDAAmD;;IAEnD,mEAAmE;;IAEnE,+CAA+C;;IAE/C,2EAA2E;;CAEnE,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAE9E,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,OAAO;IAClB,kEAAkE;;IAElE,yBAAyB;;IAEzB,2DAA2D;;IAE3D,yEAAyE;;CAEjE,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,OAAO,CAAC,CAAC;AAElE,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAmC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS;IACpB,wCAAwC;;IAExC,qFAAqF;;IAErF,kEAAkE;;IAElE,iFAAiF;;CAEzE,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAExE,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;IAEzB,QAAQ,CAAC,SAAS,EAAE,OAAO;IAC3B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE;gBADjC,SAAS,EAAE,OAAO,EAClB,cAAc,GAAE,SAAS,MAAM,EAAO;IAGjD,OAAO,IAAI,OAAO;IAIlB,QAAQ,IAAI,MAAM;CAGnB;AAED,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,IAAI,CAAC;IACb,4CAA4C;IAC5C,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sCAAsC;AACtC,qBAAa,MAAM;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe;IAQ/C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAU9B,QAAQ,IAAI,MAAM;CAQnB;AAQD;;;;;GAKG;AACH,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;IACvC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;gBARrB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,SAAS,MAAM,EAAO,EAC/B,eAAe,GAAE,MAAM,GAAG,IAAW;IAC9C;;;;OAIG;IACM,MAAM,GAAE,MAAM,GAAG,IAAW;IAGvC,wEAAwE;IACxE,OAAO,IAAI,MAAM;IAMjB;;;;OAIG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;IAU9B,0FAA0F;IAC1F,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ;IAI3C,MAAM,CAAC,KAAK,CAAC,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;IAIlD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW,GAAG,QAAQ;CAIvF"}

package/dist/esm/reasons.js

@@ -34,6 +34,14 @@ export const ReasonCode = {
     CHAIN_CEILING: "chain_ceiling",
     /** The principal holds no authority at all in this chain. */
     NO_AUTHORITY: "no_authority",
+    // 0.9.0 execution-binding transition (schema_version=2 chains only — see guard.ts):
+    /** `check` refused: the node already called `complete()`. */
+    NODE_FINALIZED: "node_finalized",
+    /**
+     * The CSPRNG failed while allocating `callId`; fail-closed — the call is denied and
+     * nothing is written.
+     */
+    CALL_ID_UNAVAILABLE: "call_id_unavailable",
 };
 /**
  * WHY a denied scope was not in the node's authority — the ledger's answer to
@@ -51,6 +59,73 @@ export const Disposition = {
     OUT_OF_AUTHORITY: "out_of_authority",
 };
 export const DISPOSITIONS = new Set(Object.values(Disposition));
+/**
+ * What the adapter's code path WILL observe for a given `check`ed call (0.9.0 execution binding)
+ * — recorded on the `allow` entry alongside `adapter` (module/version/hookPath). Describes
+ * observation CAPABILITY only, never a claim of quality: a verifier routes a call into
+ * observed/unobserved reporting from this label, never trusts it as evidence on its own.
+ */
+export const Capture = {
+    /** The adapter's wrapper calls the body itself, synchronously. */
+    WRAPPER_SYNC: "wrapper_sync",
+    /** ... and awaits it. */
+    WRAPPER_ASYNC: "wrapper_async",
+    /** The framework itself calls back after the body runs. */
+    FRAMEWORK_POST_HOOK: "framework_post_hook",
+    /** The adapter sees the call authorized but never observes it finish. */
+    PRE_HOOK_ONLY: "pre_hook_only",
+};
+export const CAPTURES = new Set(Object.values(Capture));
+/**
+ * The `outcome` record's observation of how a body-owning wrapper's call ended (0.9.0 execution
+ * binding, docs/execution-binding spec section 3) — an OBSERVATION, not a judgment about the
+ * world. There is no `executed`/`blocked`/`timeout`/`cancelled` at this layer; each of those
+ * words claims knowledge a wrapper does not always have. Adapters emitting into a richer outcome
+ * vocabulary own that mapping.
+ */
+export const BodyState = {
+    /** The body returned to the wrapper. */
+    RETURNED: "returned",
+    /** It raised (`errorCode` required, from the exception's class/constructor name). */
+    RAISED: "raised",
+    /** The wrapper stopped observing while the body may still run. */
+    ABANDONED: "abandoned",
+    /** The wrapper returned a generator/stream/future it does not itself consume. */
+    DEFERRED: "deferred",
+};
+export const BODY_STATES = new Set(Object.values(BodyState));
+/**
+ * `Guard.complete()`'s return value on a `schemaVersion: 2` chain ONLY (0.9.0, docs/
+ * execution-binding spec section 1): whether the node was actually finalized, and — when it
+ * refused because calls are still pending an outcome — the `callId`s it is waiting on. On a
+ * `schemaVersion: 1` chain (the default), `complete()` returns a plain `boolean`,
+ * byte-and-type IDENTICAL to every release before 0.9.0 — v1 never gained pending-call
+ * awareness, so there is nothing new for it to report and no reason to change its return type
+ * (mirrors attenu-guard Python's merge-gate fix restoring this exact split).
+ *
+ * Python's v2 return value is bool-coercible via `__bool__`, so `if guard.complete():` keeps
+ * reading naturally there. JavaScript has no such hook for `if` — `ToBoolean` on any object is
+ * unconditionally `true`, so on v2 an `if (guard.complete())` check cannot be bridged to `false`
+ * no matter what this class defines, and neither can `assert.equal`/`assert.strictEqual` from
+ * `node:assert/strict` (no coercion at all). What CAN be bridged: `valueOf()` returns
+ * `.completed`, so contexts that genuinely coerce via `==`/`!=` (loose equality), template
+ * literals, and arithmetic still read as a boolean. On v2, read `.completed` explicitly wherever
+ * you would have written `if (guard.complete())`.
+ */
+export class CompletionResult {
+    completed;
+    pendingCallIds;
+    constructor(completed, pendingCallIds = []) {
+        this.completed = completed;
+        this.pendingCallIds = pendingCallIds;
+    }
+    valueOf() {
+        return this.completed;
+    }
+    toString() {
+        return String(this.completed);
+    }
+}
 /** One specific cause of a denial. */
 export class Reason {
     code;
@@ -103,10 +178,18 @@ export class Decision {
     allowed;
     reasons;
     determiningNode;
-    constructor(allowed, reasons = [], determiningNode = null) {
+    callId;
+    constructor(allowed, reasons = [], determiningNode = null, 
+    /**
+     * 0.9.0 execution binding: set only on a `schemaVersion: 2` chain (`Guard.check` /
+     * `Guard.recordDenial`); `null` on schema-version-1 chains and on any `Decision` built
+     * outside a `Guard` transition (`wouldAllow`, tests).
+     */
+    callId = null) {
         this.allowed = allowed;
         this.reasons = reasons;
         this.determiningNode = determiningNode;
+        this.callId = callId;
     }
     /** A single human-readable line — for logs, CLIs and error messages. */
     explain() {
@@ -116,12 +199,24 @@ export class Decision {
             return "denied";
         return "denied: " + this.reasons.map((r) => r.toString()).join("; ");
     }
+    /**
+     * `callId` is included only when set (a `schemaVersion: 2` chain's `check`/`recordDenial`) — a
+     * v1 Decision's serialized shape stays byte-and-key identical to every release before 0.9.0,
+     * never gaining a `call_id: null` key it never had.
+     */
     toDict() {
-        return {
+        const d = {
             allowed: this.allowed,
             reasons: this.reasons.map((r) => r.toDict()),
             determining_node: this.determiningNode,
         };
+        if (this.callId !== null)
+            d["call_id"] = this.callId;
+        return d;
+    }
+    /** A copy of this Decision with `callId` set — mirrors Python's `dataclasses.replace`. */
+    withCallId(callId) {
+        return new Decision(this.allowed, this.reasons, this.determiningNode, callId);
     }
     static allow(node = null) {
         return new Decision(true, [], node);

package/dist/esm/reasons.js.map

@@ -1 +1 @@
-{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,SAAS,EAAE,WAAW;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,oBAAoB;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,cAAc;CACpB,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,mDAAmD;IACnD,kBAAkB,EAAE,oBAAoB;IACxC,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,UAAU,EAAE,YAAY;IACxB,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAarF,sCAAsC;AACtC,MAAM,OAAO,MAAM;IACR,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAO;IACZ,SAAS,CAAO;IAChB,OAAO,CAAS;IAEzB,YAAY,IAAY,EAAE,OAAmB,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAW;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,QAAQ;IAER;IACA;IACA;IAHX,YACW,OAAgB,EAChB,UAA6B,EAAE,EAC/B,kBAAiC,IAAI;QAFrC,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAwB;QAC/B,oBAAe,GAAf,eAAe,CAAsB;IAC7C,CAAC;IAEJ,wEAAwE;IACxE,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,OAAO,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAsB,IAAI;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAmC,EAAE,OAAsB,IAAI;QACzE,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,SAAS,EAAE,WAAW;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,oBAAoB;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,cAAc;IAC5B,oFAAoF;IACpF,6DAA6D;IAC7D,cAAc,EAAE,gBAAgB;IAChC;;;OAGG;IACH,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,mDAAmD;IACnD,kBAAkB,EAAE,oBAAoB;IACxC,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,UAAU,EAAE,YAAY;IACxB,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIX,MAAM,CAAC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,kEAAkE;IAClE,YAAY,EAAE,cAAc;IAC5B,yBAAyB;IACzB,aAAa,EAAE,eAAe;IAC9B,2DAA2D;IAC3D,mBAAmB,EAAE,qBAAqB;IAC1C,yEAAyE;IACzE,aAAa,EAAE,eAAe;CACtB,CAAC;AAIX,MAAM,CAAC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wCAAwC;IACxC,QAAQ,EAAE,UAAU;IACpB,qFAAqF;IACrF,MAAM,EAAE,QAAQ;IAChB,kEAAkE;IAClE,SAAS,EAAE,WAAW;IACtB,iFAAiF;IACjF,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gBAAgB;IAEhB;IACA;IAFX,YACW,SAAkB,EAClB,iBAAoC,EAAE;QADtC,cAAS,GAAT,SAAS,CAAS;QAClB,mBAAc,GAAd,cAAc,CAAwB;IAC9C,CAAC;IAEJ,OAAO;QACL,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,QAAQ;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF;AAaD,sCAAsC;AACtC,MAAM,OAAO,MAAM;IACR,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAO;IACZ,SAAS,CAAO;IAChB,OAAO,CAAS;IAEzB,YAAY,IAAY,EAAE,OAAmB,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAW;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,QAAQ;IAER;IACA;IACA;IAMA;IATX,YACW,OAAgB,EAChB,UAA6B,EAAE,EAC/B,kBAAiC,IAAI;IAC9C;;;;OAIG;IACM,SAAwB,IAAI;QAR5B,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAwB;QAC/B,oBAAe,GAAf,eAAe,CAAsB;QAMrC,WAAM,GAAN,MAAM,CAAsB;IACpC,CAAC;IAEJ,wEAAwE;IACxE,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,OAAO,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,MAAM,CAAC,GAAyB;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,UAAU,CAAC,MAAqB;QAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAsB,IAAI;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAmC,EAAE,OAAsB,IAAI;QACzE,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/esm/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * version.ts — the package version, as its own leaf module.
+ *
+ * guard.ts needs this (to attribute a guard-supplied `adapter.version` on a bare `check()` with
+ * no wrapper — see the "Execution binding" section of guard.ts's module doc comment) and is
+ * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
+ * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
+ */
+export declare const VERSION = "0.3.0";
+//# sourceMappingURL=version.d.ts.map

package/dist/esm/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/esm/version.js

@@ -0,0 +1,10 @@
+/**
+ * version.ts — the package version, as its own leaf module.
+ *
+ * guard.ts needs this (to attribute a guard-supplied `adapter.version` on a bare `check()` with
+ * no wrapper — see the "Execution binding" section of guard.ts's module doc comment) and is
+ * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
+ * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
+ */
+export const VERSION = "0.3.0";
+//# sourceMappingURL=version.js.map

package/dist/esm/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/dist/esm/wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EASL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EASL,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEzD;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC3E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAK1C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAGF,MAAM,EAAE,MAAM,EAC/B,GAAG,SAAS;IAKd,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;CAO3E;AAwCD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAc;IAYrD,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAc,GAAG,aAAa;IAIjD,yEAAyE;IACzE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,aAAa;IAItE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,6EAA6E;IAC7E,cAAc,IAAI,MAAM;IAIxB,0EAA0E;IAC1E,eAAe,IAAI,MAAM;CAG1B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAC5C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,cAAc,EAAE,MAAM,EAAE,GAAG,SAAc;IAKrD,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAInC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,cAAc,IAAI,MAAM;CAGzB;AAMD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9C;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;CAUjB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvF;;;;;;;;;GASG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK;CAKzC;AAqJD;;;;;GAKG;AACH,qBAAa,aAAa;IAEtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM;gBAJnB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EACzC,aAAa,EAAE,SAAS,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM;IAG9B;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,OAAO,GAAG,IAAW,GAAG,QAAQ;CAG7D;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,IAAI,CAClB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,WAAgB,GACxB,aAAa,CAkKf"}
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EASL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAUL,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEzD;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;CAC3E;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAK1C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAGF,MAAM,EAAE,MAAM,EAC/B,GAAG,SAAS;IAKd,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;CAO3E;AAwCD;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,MAAM;IAC1C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAc;IAYrD,qDAAqD;IACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAc,GAAG,aAAa;IAIjD,yEAAyE;IACzE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAc,GAAG,aAAa;IAItE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIlC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,6EAA6E;IAC7E,cAAc,IAAI,MAAM;IAIxB,0EAA0E;IAC1E,eAAe,IAAI,MAAM;CAG1B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,YAAW,MAAM;IAC5C,QAAQ,CAAC,GAAG,WAAW;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,cAAc,EAAE,MAAM,EAAE,GAAG,SAAc;IAKrD,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAInC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAQ1E,cAAc,IAAI,MAAM;CAGzB;AAMD,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9C;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;CAUjB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvF;;;;;;;;;GASG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,SAAK;CAKzC;AA4JD;;;;;GAKG;AACH,qBAAa,aAAa;IAEtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM;gBAJnB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EACzC,aAAa,EAAE,SAAS,EACxB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM;IAG9B;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,OAAO,GAAG,IAAW,GAAG,QAAQ;CAG7D;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,IAAI,CAClB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,WAAgB,GACxB,aAAa,CAkKf"}

package/dist/esm/wire.js

@@ -29,7 +29,7 @@
 import { createHash, createHmac, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign, timingSafeEqual, verify as cryptoVerify, } from "node:crypto";
 import { TextDecoder } from "node:util";
 import { Authority } from "./authority.js";
-import { CanonicalizationError, DuplicateMemberError, NonFiniteNumberError, RawNumber, canonicalJson, parseJson, toPlain, } from "./canonical.js";
+import { CanonicalizationError, DuplicateMemberError, NonFiniteNumberError, RawNumber, UnsafeIntegerError, canonicalJson, parseJson, toPlain, } from "./canonical.js";
 import { ReasonCode } from "./reasons.js";
 /**
  * stdlib HMAC-SHA256 signer — the default for tests, examples and local dev,
@@ -294,6 +294,13 @@ function parseToken(token) {
         if (e instanceof NonFiniteNumberError) {
             throw new WireError(WireReasonCode.NON_FINITE, e.message);
         }
+        // Mirrors non-finite handling above: an integer past the safe binary64
+        // range is a malformed claim, not merely a non-canonical byte form — it
+        // cannot be represented at all, safely, so it is rejected before
+        // verification rather than compared byte-for-byte.
+        if (e instanceof UnsafeIntegerError) {
+            throw new WireError(WireReasonCode.MALFORMED, e.message);
+        }
         if (e instanceof CanonicalizationError) {
             throw new WireError(WireReasonCode.NON_CANONICAL, e.message);
         }