attenu-guard 0.3.1 → 0.4.0

package/dist/cjs/reasons.js

@@ -11,7 +11,7 @@
  * the Python library's `attenu_guard.reasons` value for value.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Decision = exports.Reason = exports.DISPOSITIONS = exports.Disposition = exports.ReasonCode = void 0;
+exports.Decision = exports.Reason = exports.CompletionResult = exports.BODY_STATES = exports.BodyState = exports.CAPTURES = exports.Capture = exports.DISPOSITIONS = exports.Disposition = exports.ReasonCode = void 0;
 /**
  * Stable string constants for machine-readable denial reasons. Never rename an
  * existing value; add new ones instead.
@@ -37,6 +37,14 @@ exports.ReasonCode = {
     CHAIN_CEILING: "chain_ceiling",
     /** The principal holds no authority at all in this chain. */
     NO_AUTHORITY: "no_authority",
+    // 0.9.0 execution-binding transition (schema_version=2 chains only — see guard.ts):
+    /** `check` refused: the node already called `complete()`. */
+    NODE_FINALIZED: "node_finalized",
+    /**
+     * The CSPRNG failed while allocating `callId`; fail-closed — the call is denied and
+     * nothing is written.
+     */
+    CALL_ID_UNAVAILABLE: "call_id_unavailable",
 };
 /**
  * WHY a denied scope was not in the node's authority — the ledger's answer to
@@ -54,6 +62,74 @@ exports.Disposition = {
     OUT_OF_AUTHORITY: "out_of_authority",
 };
 exports.DISPOSITIONS = new Set(Object.values(exports.Disposition));
+/**
+ * What the adapter's code path WILL observe for a given `check`ed call (0.9.0 execution binding)
+ * — recorded on the `allow` entry alongside `adapter` (module/version/hookPath). Describes
+ * observation CAPABILITY only, never a claim of quality: a verifier routes a call into
+ * observed/unobserved reporting from this label, never trusts it as evidence on its own.
+ */
+exports.Capture = {
+    /** The adapter's wrapper calls the body itself, synchronously. */
+    WRAPPER_SYNC: "wrapper_sync",
+    /** ... and awaits it. */
+    WRAPPER_ASYNC: "wrapper_async",
+    /** The framework itself calls back after the body runs. */
+    FRAMEWORK_POST_HOOK: "framework_post_hook",
+    /** The adapter sees the call authorized but never observes it finish. */
+    PRE_HOOK_ONLY: "pre_hook_only",
+};
+exports.CAPTURES = new Set(Object.values(exports.Capture));
+/**
+ * The `outcome` record's observation of how a body-owning wrapper's call ended (0.9.0 execution
+ * binding, docs/execution-binding spec section 3) — an OBSERVATION, not a judgment about the
+ * world. There is no `executed`/`blocked`/`timeout`/`cancelled` at this layer; each of those
+ * words claims knowledge a wrapper does not always have. Adapters emitting into a richer outcome
+ * vocabulary own that mapping.
+ */
+exports.BodyState = {
+    /** The body returned to the wrapper. */
+    RETURNED: "returned",
+    /** It raised (`errorCode` required, from the exception's class/constructor name). */
+    RAISED: "raised",
+    /** The wrapper stopped observing while the body may still run. */
+    ABANDONED: "abandoned",
+    /** The wrapper returned a generator/stream/future it does not itself consume. */
+    DEFERRED: "deferred",
+};
+exports.BODY_STATES = new Set(Object.values(exports.BodyState));
+/**
+ * `Guard.complete()`'s return value on a `schemaVersion: 2` chain ONLY (0.9.0, docs/
+ * execution-binding spec section 1): whether the node was actually finalized, and — when it
+ * refused because calls are still pending an outcome — the `callId`s it is waiting on. On a
+ * `schemaVersion: 1` chain (the default), `complete()` returns a plain `boolean`,
+ * byte-and-type IDENTICAL to every release before 0.9.0 — v1 never gained pending-call
+ * awareness, so there is nothing new for it to report and no reason to change its return type
+ * (mirrors attenu-guard Python's merge-gate fix restoring this exact split).
+ *
+ * Python's v2 return value is bool-coercible via `__bool__`, so `if guard.complete():` keeps
+ * reading naturally there. JavaScript has no such hook for `if` — `ToBoolean` on any object is
+ * unconditionally `true`, so on v2 an `if (guard.complete())` check cannot be bridged to `false`
+ * no matter what this class defines, and neither can `assert.equal`/`assert.strictEqual` from
+ * `node:assert/strict` (no coercion at all). What CAN be bridged: `valueOf()` returns
+ * `.completed`, so contexts that genuinely coerce via `==`/`!=` (loose equality), template
+ * literals, and arithmetic still read as a boolean. On v2, read `.completed` explicitly wherever
+ * you would have written `if (guard.complete())`.
+ */
+class CompletionResult {
+    completed;
+    pendingCallIds;
+    constructor(completed, pendingCallIds = []) {
+        this.completed = completed;
+        this.pendingCallIds = pendingCallIds;
+    }
+    valueOf() {
+        return this.completed;
+    }
+    toString() {
+        return String(this.completed);
+    }
+}
+exports.CompletionResult = CompletionResult;
 /** One specific cause of a denial. */
 class Reason {
     code;
@@ -107,10 +183,18 @@ class Decision {
     allowed;
     reasons;
     determiningNode;
-    constructor(allowed, reasons = [], determiningNode = null) {
+    callId;
+    constructor(allowed, reasons = [], determiningNode = null, 
+    /**
+     * 0.9.0 execution binding: set only on a `schemaVersion: 2` chain (`Guard.check` /
+     * `Guard.recordDenial`); `null` on schema-version-1 chains and on any `Decision` built
+     * outside a `Guard` transition (`wouldAllow`, tests).
+     */
+    callId = null) {
         this.allowed = allowed;
         this.reasons = reasons;
         this.determiningNode = determiningNode;
+        this.callId = callId;
     }
     /** A single human-readable line — for logs, CLIs and error messages. */
     explain() {
@@ -120,12 +204,24 @@ class Decision {
             return "denied";
         return "denied: " + this.reasons.map((r) => r.toString()).join("; ");
     }
+    /**
+     * `callId` is included only when set (a `schemaVersion: 2` chain's `check`/`recordDenial`) — a
+     * v1 Decision's serialized shape stays byte-and-key identical to every release before 0.9.0,
+     * never gaining a `call_id: null` key it never had.
+     */
     toDict() {
-        return {
+        const d = {
             allowed: this.allowed,
             reasons: this.reasons.map((r) => r.toDict()),
             determining_node: this.determiningNode,
         };
+        if (this.callId !== null)
+            d["call_id"] = this.callId;
+        return d;
+    }
+    /** A copy of this Decision with `callId` set — mirrors Python's `dataclasses.replace`. */
+    withCallId(callId) {
+        return new Decision(this.allowed, this.reasons, this.determiningNode, callId);
     }
     static allow(node = null) {
         return new Decision(true, [], node);

package/dist/cjs/reasons.js.map

@@ -1 +1 @@
-{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAIH;;;GAGG;AACU,QAAA,UAAU,GAAG;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,SAAS,EAAE,WAAW;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,oBAAoB;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,cAAc;CACpB,CAAC;AAIX;;;;GAIG;AACU,QAAA,WAAW,GAAG;IACzB,mDAAmD;IACnD,kBAAkB,EAAE,oBAAoB;IACxC,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,UAAU,EAAE,YAAY;IACxB,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIE,QAAA,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,CAAC;AAarF,sCAAsC;AACtC,MAAa,MAAM;IACR,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAO;IACZ,SAAS,CAAO;IAChB,OAAO,CAAS;IAEzB,YAAY,IAAY,EAAE,OAAmB,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;CACF;AAjCD,wBAiCC;AAED,SAAS,WAAW,CAAC,KAAW;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAa,QAAQ;IAER;IACA;IACA;IAHX,YACW,OAAgB,EAChB,UAA6B,EAAE,EAC/B,kBAAiC,IAAI;QAFrC,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAwB;QAC/B,oBAAe,GAAf,eAAe,CAAsB;IAC7C,CAAC;IAEJ,wEAAwE;IACxE,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,OAAO,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAsB,IAAI;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAmC,EAAE,OAAsB,IAAI;QACzE,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AA9BD,4BA8BC"}
+{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAIH;;;GAGG;AACU,QAAA,UAAU,GAAG;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,SAAS,EAAE,WAAW;IACtB,4EAA4E;IAC5E,kBAAkB,EAAE,oBAAoB;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,6DAA6D;IAC7D,YAAY,EAAE,cAAc;IAC5B,oFAAoF;IACpF,6DAA6D;IAC7D,cAAc,EAAE,gBAAgB;IAChC;;;OAGG;IACH,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAIX;;;;GAIG;AACU,QAAA,WAAW,GAAG;IACzB,mDAAmD;IACnD,kBAAkB,EAAE,oBAAoB;IACxC,mEAAmE;IACnE,cAAc,EAAE,gBAAgB;IAChC,+CAA+C;IAC/C,UAAU,EAAE,YAAY;IACxB,2EAA2E;IAC3E,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIE,QAAA,YAAY,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACU,QAAA,OAAO,GAAG;IACrB,kEAAkE;IAClE,YAAY,EAAE,cAAc;IAC5B,yBAAyB;IACzB,aAAa,EAAE,eAAe;IAC9B,2DAA2D;IAC3D,mBAAmB,EAAE,qBAAqB;IAC1C,yEAAyE;IACzE,aAAa,EAAE,eAAe;CACtB,CAAC;AAIE,QAAA,QAAQ,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAO,CAAC,CAAC,CAAC;AAE7E;;;;;;GAMG;AACU,QAAA,SAAS,GAAG;IACvB,wCAAwC;IACxC,QAAQ,EAAE,UAAU;IACpB,qFAAqF;IACrF,MAAM,EAAE,QAAQ;IAChB,kEAAkE;IAClE,SAAS,EAAE,WAAW;IACtB,iFAAiF;IACjF,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIE,QAAA,WAAW,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAS,CAAC,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,gBAAgB;IAEhB;IACA;IAFX,YACW,SAAkB,EAClB,iBAAoC,EAAE;QADtC,cAAS,GAAT,SAAS,CAAS;QAClB,mBAAc,GAAd,cAAc,CAAwB;IAC9C,CAAC;IAEJ,OAAO;QACL,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,QAAQ;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF;AAbD,4CAaC;AAaD,sCAAsC;AACtC,MAAa,MAAM;IACR,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAO;IACZ,SAAS,CAAO;IAChB,OAAO,CAAS;IAEzB,YAAY,IAAY,EAAE,OAAmB,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;CACF;AAjCD,wBAiCC;AAED,SAAS,WAAW,CAAC,KAAW;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAa,QAAQ;IAER;IACA;IACA;IAMA;IATX,YACW,OAAgB,EAChB,UAA6B,EAAE,EAC/B,kBAAiC,IAAI;IAC9C;;;;OAIG;IACM,SAAwB,IAAI;QAR5B,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAwB;QAC/B,oBAAe,GAAf,eAAe,CAAsB;QAMrC,WAAM,GAAN,MAAM,CAAsB;IACpC,CAAC;IAEJ,wEAAwE;IACxE,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/C,OAAO,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,MAAM,CAAC,GAAyB;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,UAAU,CAAC,MAAqB;QAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAsB,IAAI;QACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAmC,EAAE,OAAsB,IAAI;QACzE,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAhDD,4BAgDC"}

package/dist/cjs/version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * version.ts — the package version, as its own leaf module.
+ *
+ * guard.ts needs this (to attribute a guard-supplied `adapter.version` on a bare `check()` with
+ * no wrapper — see the "Execution binding" section of guard.ts's module doc comment) and is
+ * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
+ * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
+ */
+export declare const VERSION = "0.3.0";
+//# sourceMappingURL=version.d.ts.map

package/dist/cjs/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/cjs/version.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = void 0;
+/**
+ * version.ts — the package version, as its own leaf module.
+ *
+ * guard.ts needs this (to attribute a guard-supplied `adapter.version` on a bare `check()` with
+ * no wrapper — see the "Execution binding" section of guard.ts's module doc comment) and is
+ * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
+ * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
+ */
+exports.VERSION = "0.3.0";
+//# sourceMappingURL=version.js.map

package/dist/cjs/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACU,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/esm/adapters/langgraph.d.ts

@@ -35,6 +35,22 @@
  * this adapter does not prescribe which. It guarantees only that the tool body
  * never executes on a denial.
  *
+ * ## Execution binding (0.9.0, reference wiring for this adapter)
+ *
+ * When `guard`'s chain was issued with `schemaVersion: 2` (see `Guard.issue`), `guardNode` also
+ * passes `capture`/`adapter`/`authorizedParams` to `check` and calls `guard.recordOutcome` once
+ * the wrapped callable finishes — `Capture.WRAPPER_ASYNC` when `fn` is a genuine `async function`
+ * (`fn.constructor.name === "AsyncFunction"`, the same test Python's `inspect.iscoroutinefunction`
+ * makes), `Capture.WRAPPER_SYNC` otherwise. `authorizedParams`/`invokedParams` are
+ * `{args: [...]}` built from exactly what the wrapped callable is called with — JavaScript has no
+ * separate `kwargs`, so unlike the Python adapter's `{args, kwargs}` this carries only `args`; a
+ * LangGraph.js node in any case receives one state object, not Python's `(*args, **kwargs)`. They
+ * are unchanged between the two observations here, since this decorator itself never mutates
+ * them; a framework that DOES mutate arguments between authorization and invocation is where a
+ * real substitution would become visible. On a `schemaVersion: 1` chain (the default), this
+ * adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
+ * `recordOutcome` call. Every other framework adapter is unchanged in this release.
+ *
  * ## Delegation
  *
  * Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
@@ -52,7 +68,7 @@
 import { type Guard } from "../guard.js";
 import type { Authority } from "../authority.js";
 import type { Context } from "../ceilings.js";
-import type { Decision } from "../reasons.js";
+import { type Decision } from "../reasons.js";
 /** Options shared by every guarded wrapper. */
 export interface GuardOptions {
     /**
@@ -81,7 +97,9 @@ export type GuardedNode<F extends (...args: any[]) => any> = F & {
  * `guard.check(toolScope, {context, tool})`. On a denial this throws
  * `AuthorityDenied` and the wrapped callable is NEVER invoked. Otherwise it
  * calls through with the original arguments and returns the result unchanged —
- * including a promise, which is passed along untouched.
+ * including a promise, which is passed along untouched. On a `schemaVersion: 2`
+ * guard, also binds the call's outcome via `guard.recordOutcome` — see the
+ * module doc comment's "Execution binding" section.
  *
  * Use the Guard for the SPECIFIC agent this callable belongs to, not the
  * orchestrator's broader one, so a denial reflects that node's real, narrowed
@@ -125,7 +143,13 @@ export interface GuardToolOptions extends GuardOptions {
  * The context function receives the raw invoke arguments. `ToolNode` passes a
  * tool call object, so the arguments the model proposed are at `input.args`;
  * a direct `tool.invoke({...})` passes them at the top level. `toolArgs` below
- * reads either shape.
+ * reads either shape — and, on a `schemaVersion: 2` guard, feeds a single
+ * IMMUTABLE snapshot taken BEFORE `tool.invoke` runs, reused for both
+ * `authorizedParams` and `invokedParams`: this adapter's closest analogue of "the
+ * exact tool-call JSON object" the execution-binding spec names (see the module
+ * doc comment's "Execution binding" section; this is the one construct in this
+ * adapter that wraps a tool BODY, so it is the reference wiring for
+ * `recordOutcome`, mirroring `guardNode` above).
  */
 export declare function guardTool<T extends ToolLike>(guard: Guard, tool: T, options?: GuardToolOptions): T;
 /** Marker properties, so a caller can tell a guarded tool from a bare one. */

package/dist/esm/adapters/langgraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAmB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsBhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CA4BH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAqC,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAgEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsGhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CAkIH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}

package/dist/esm/adapters/langgraph.js

@@ -35,6 +35,22 @@
  * this adapter does not prescribe which. It guarantees only that the tool body
  * never executes on a denial.
  *
+ * ## Execution binding (0.9.0, reference wiring for this adapter)
+ *
+ * When `guard`'s chain was issued with `schemaVersion: 2` (see `Guard.issue`), `guardNode` also
+ * passes `capture`/`adapter`/`authorizedParams` to `check` and calls `guard.recordOutcome` once
+ * the wrapped callable finishes — `Capture.WRAPPER_ASYNC` when `fn` is a genuine `async function`
+ * (`fn.constructor.name === "AsyncFunction"`, the same test Python's `inspect.iscoroutinefunction`
+ * makes), `Capture.WRAPPER_SYNC` otherwise. `authorizedParams`/`invokedParams` are
+ * `{args: [...]}` built from exactly what the wrapped callable is called with — JavaScript has no
+ * separate `kwargs`, so unlike the Python adapter's `{args, kwargs}` this carries only `args`; a
+ * LangGraph.js node in any case receives one state object, not Python's `(*args, **kwargs)`. They
+ * are unchanged between the two observations here, since this decorator itself never mutates
+ * them; a framework that DOES mutate arguments between authorization and invocation is where a
+ * real substitution would become visible. On a `schemaVersion: 1` chain (the default), this
+ * adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
+ * `recordOutcome` call. Every other framework adapter is unchanged in this release.
+ *
  * ## Delegation
  *
  * Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
@@ -50,6 +66,71 @@
  *     const tools = guardTools(researcher, [crmQuery], { scopes: { crm_query: "crm.read" } });
  */
 import { AuthorityDenied } from "../guard.js";
+import { BodyState, Capture } from "../reasons.js";
+import { VERSION } from "../version.js";
+/**
+ * An IMMUTABLE snapshot of the call's arguments, taken BEFORE the wrapped callable runs and
+ * reused for BOTH `authorizedParams` (`check`) and `invokedParams` (`recordOutcome`) — so a
+ * callable that mutates its own inputs in place cannot make this adapter observe two different
+ * values for what was actually one call's arguments (see the module doc comment's "Execution
+ * binding" section; no `kwargs` — JavaScript has no separate keyword-argument bag).
+ */
+function snapshotParams(args) {
+    const raw = { args: [...args] };
+    try {
+        return structuredClone(raw);
+    }
+    catch {
+        // Best-effort: something in here isn't structured-cloneable (a live socket, a function, ...).
+        // Fall back to the shallow copy — a residual risk only if THAT specific object is later
+        // mutated in place, a rare edge case documented here rather than silently claimed away.
+        return raw;
+    }
+}
+/**
+ * `true` if `result` is a generator/async-generator/promise-like value whose consumption this
+ * wrapper does not itself observe — spec's `deferred`: "the record covers the call, not the
+ * eventual exhaustion." A promise counts too (the closest JavaScript analogue of Python's
+ * `asyncio.Future`/`concurrent.futures.Future`): the async branch here already `await`s `fn`
+ * itself, so a bare promise surfacing as `result` there means `fn` returned ANOTHER promise
+ * without awaiting it, which is exactly the same "not actually consumed" situation.
+ */
+function isDeferredResult(result) {
+    if (result === null || typeof result !== "object")
+        return false;
+    const r = result;
+    if (typeof r["next"] === "function" && typeof r[Symbol.iterator] === "function")
+        return true;
+    if (typeof r["next"] === "function" && typeof r[Symbol.asyncIterator] === "function")
+        return true;
+    if (typeof r["then"] === "function")
+        return true;
+    return false;
+}
+function bodyStateFor(result) {
+    return isDeferredResult(result) ? BodyState.DEFERRED : BodyState.RETURNED;
+}
+/**
+ * `true` for the JavaScript analogue of Python's `asyncio.CancelledError`: an `AbortController`/
+ * `AbortSignal`-driven abort, surfaced as a `DOMException`/`Error` named `"AbortError"` — the
+ * standard shape Node and the Fetch/Web platform both use. There is no single universal async
+ * cancellation exception type in JavaScript the way `asyncio.CancelledError` is in Python, so this
+ * is the best-grounded, most widely applicable translation rather than a exact 1:1 port.
+ */
+function isAbortError(exc) {
+    return exc instanceof Error && exc.name === "AbortError";
+}
+/** The class/constructor name of a thrown value — JavaScript's nearest analogue of Python's `type(exc).__name__`. */
+function errorCodeOf(exc) {
+    if (exc instanceof Error)
+        return exc.constructor.name || "Error";
+    if (exc === null)
+        return "null";
+    return typeof exc === "object" ? "object" : typeof exc;
+}
+function elapsedMs(start) {
+    return Math.round(performance.now() - start);
+}
 /**
  * Wrap a callable so every call is authorized through `guard` first.
  *
@@ -57,7 +138,9 @@ import { AuthorityDenied } from "../guard.js";
  * `guard.check(toolScope, {context, tool})`. On a denial this throws
  * `AuthorityDenied` and the wrapped callable is NEVER invoked. Otherwise it
  * calls through with the original arguments and returns the result unchanged —
- * including a promise, which is passed along untouched.
+ * including a promise, which is passed along untouched. On a `schemaVersion: 2`
+ * guard, also binds the call's outcome via `guard.recordOutcome` — see the
+ * module doc comment's "Execution binding" section.
  *
  * Use the Guard for the SPECIFIC agent this callable belongs to, not the
  * orchestrator's broader one, so a denial reflects that node's real, narrowed
@@ -65,18 +148,102 @@ import { AuthorityDenied } from "../guard.js";
  */
 export function guardNode(guard, toolScope, fn, options = {}) {
     const resolvedTool = options.tool !== undefined ? options.tool : (fn.name || null);
-    const wrapped = function (...args) {
+    const isAsyncFn = fn.constructor.name === "AsyncFunction";
+    // guard.schemaVersion never changes for a guard's lifetime, so it is safe (and correct: a
+    // wrapper's sync-vs-async SHAPE must be fixed at definition time, not per-call) to decide it
+    // once, here, at decoration time.
+    const v2 = guard.schemaVersion === 2;
+    const capture = isAsyncFn ? Capture.WRAPPER_ASYNC : Capture.WRAPPER_SYNC;
+    const adapterInfo = {
+        module: "attenu-guard/adapters/langgraph",
+        version: VERSION,
+        hookPath: `guardNode:${fn.name || toolScope}`,
+    };
+    function authorize(args, snapshot) {
         const context = options.contextFn ? options.contextFn(...args) : {};
+        const extra = v2 ? { capture, adapter: adapterInfo, authorizedParams: snapshot ?? undefined } : {};
         const decision = guard.check(toolScope, {
             context,
             tool: resolvedTool,
             disposition: options.disposition ?? null,
             metered: options.metered ?? false,
+            ...extra,
         });
         if (!decision.allowed)
             throw new AuthorityDenied(decision);
-        return fn.apply(this, args);
-    };
+        return decision;
+    }
+    let wrapped;
+    if (isAsyncFn && v2) {
+        wrapped = (async function (...args) {
+            const snapshot = snapshotParams(args);
+            const decision = authorize(args, snapshot);
+            const start = performance.now();
+            try {
+                const result = await fn.apply(this, args);
+                guard.recordOutcome(decision.callId, bodyStateFor(result), {
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                return result;
+            }
+            catch (exc) {
+                // The wrapper stopped observing while the body may still run — exactly spec's
+                // `abandoned`, not `raised`. Still re-thrown: cancellation must propagate normally.
+                if (isAbortError(exc)) {
+                    guard.recordOutcome(decision.callId, BodyState.ABANDONED, {
+                        invokedParams: snapshot,
+                        durationMs: elapsedMs(start),
+                    });
+                }
+                else {
+                    guard.recordOutcome(decision.callId, BodyState.RAISED, {
+                        errorCode: errorCodeOf(exc),
+                        invokedParams: snapshot,
+                        durationMs: elapsedMs(start),
+                    });
+                }
+                throw exc;
+            }
+        });
+    }
+    else if (isAsyncFn) {
+        // v1 (schemaVersion: 1, the default): EXACTLY the pre-0.9.0 shape — a plain SYNC wrapper
+        // that authorizes, then returns fn(...args) UNAWAITED. The caller awaits the returned
+        // promise itself, as it always has; `wrapped` is never itself an async function on v1, even
+        // when `fn` is.
+        wrapped = (function (...args) {
+            authorize(args, null);
+            return fn.apply(this, args);
+        });
+    }
+    else {
+        wrapped = (function (...args) {
+            if (!v2) {
+                authorize(args, null);
+                return fn.apply(this, args);
+            }
+            const snapshot = snapshotParams(args);
+            const decision = authorize(args, snapshot);
+            const start = performance.now();
+            try {
+                const result = fn.apply(this, args);
+                guard.recordOutcome(decision.callId, bodyStateFor(result), {
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                return result;
+            }
+            catch (exc) {
+                guard.recordOutcome(decision.callId, BodyState.RAISED, {
+                    errorCode: errorCodeOf(exc),
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                throw exc;
+            }
+        });
+    }
     Object.defineProperties(wrapped, {
         name: { value: fn.name, configurable: true },
         guard: { value: guard, enumerable: true },
@@ -106,26 +273,138 @@ export function addGuardedNode(graph, name, guard, toolScope, fn, options = {})
  * The context function receives the raw invoke arguments. `ToolNode` passes a
  * tool call object, so the arguments the model proposed are at `input.args`;
  * a direct `tool.invoke({...})` passes them at the top level. `toolArgs` below
- * reads either shape.
+ * reads either shape — and, on a `schemaVersion: 2` guard, feeds a single
+ * IMMUTABLE snapshot taken BEFORE `tool.invoke` runs, reused for both
+ * `authorizedParams` and `invokedParams`: this adapter's closest analogue of "the
+ * exact tool-call JSON object" the execution-binding spec names (see the module
+ * doc comment's "Execution binding" section; this is the one construct in this
+ * adapter that wraps a tool BODY, so it is the reference wiring for
+ * `recordOutcome`, mirroring `guardNode` above).
  */
 export function guardTool(guard, tool, options = {}) {
     const scope = options.scope ?? tool.name;
     const label = options.tool !== undefined ? options.tool : tool.name;
-    const guardedInvoke = (input, config) => {
+    const isAsyncInvoke = tool.invoke.constructor.name === "AsyncFunction";
+    // guard.schemaVersion never changes for a guard's lifetime — decided once, at wrap time, same
+    // as guardNode.
+    const v2 = guard.schemaVersion === 2;
+    const capture = isAsyncInvoke ? Capture.WRAPPER_ASYNC : Capture.WRAPPER_SYNC;
+    const adapterInfo = {
+        module: "attenu-guard/adapters/langgraph",
+        version: VERSION,
+        hookPath: `guardTool:${tool.name}`,
+    };
+    function snapshotToolParams(input) {
+        const raw = toolArgs(input);
+        try {
+            return structuredClone(raw);
+        }
+        catch {
+            return raw;
+        }
+    }
+    function authorize(input, config, snapshot) {
         const context = options.contextFn ? options.contextFn(input, config) : {};
+        const extra = v2 ? { capture, adapter: adapterInfo, authorizedParams: snapshot ?? undefined } : {};
         const decision = guard.check(scope, {
             context,
             tool: label,
             disposition: options.disposition ?? null,
             metered: options.metered ?? false,
+            ...extra,
         });
-        if (!decision.allowed) {
-            if (options.onDenied)
-                return options.onDenied(decision, input);
+        if (!decision.allowed)
             throw new AuthorityDenied(decision);
+        return decision;
+    }
+    /** `authorize`, but returns `{denied: ...}` instead of throwing when `onDenied` is set. */
+    function authorizeOrDenied(input, config, snapshot) {
+        try {
+            return { decision: authorize(input, config, snapshot) };
         }
-        return tool.invoke(input, config);
-    };
+        catch (exc) {
+            if (exc instanceof AuthorityDenied && options.onDenied) {
+                return { denied: options.onDenied(exc.decision, input) };
+            }
+            throw exc;
+        }
+    }
+    let guardedInvoke;
+    if (isAsyncInvoke && v2) {
+        guardedInvoke = async (input, config) => {
+            const snapshot = snapshotToolParams(input);
+            const outcome = authorizeOrDenied(input, config, snapshot);
+            if ("denied" in outcome)
+                return outcome.denied;
+            const start = performance.now();
+            try {
+                const result = await tool.invoke(input, config);
+                guard.recordOutcome(outcome.decision.callId, bodyStateFor(result), {
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                return result;
+            }
+            catch (exc) {
+                if (isAbortError(exc)) {
+                    guard.recordOutcome(outcome.decision.callId, BodyState.ABANDONED, {
+                        invokedParams: snapshot,
+                        durationMs: elapsedMs(start),
+                    });
+                }
+                else {
+                    guard.recordOutcome(outcome.decision.callId, BodyState.RAISED, {
+                        errorCode: errorCodeOf(exc),
+                        invokedParams: snapshot,
+                        durationMs: elapsedMs(start),
+                    });
+                }
+                throw exc;
+            }
+        };
+    }
+    else if (isAsyncInvoke) {
+        // v1: EXACTLY the pre-0.9.0 shape — a plain SYNC function that authorizes, then returns
+        // tool.invoke(...) UNAWAITED (the caller — typically ToolNode's own `await` — consumes the
+        // returned promise itself, as it always has).
+        guardedInvoke = (input, config) => {
+            const outcome = authorizeOrDenied(input, config, null);
+            if ("denied" in outcome)
+                return outcome.denied;
+            return tool.invoke(input, config);
+        };
+    }
+    else {
+        guardedInvoke = (input, config) => {
+            if (!v2) {
+                const outcome = authorizeOrDenied(input, config, null);
+                if ("denied" in outcome)
+                    return outcome.denied;
+                return tool.invoke(input, config);
+            }
+            const snapshot = snapshotToolParams(input);
+            const outcome = authorizeOrDenied(input, config, snapshot);
+            if ("denied" in outcome)
+                return outcome.denied;
+            const start = performance.now();
+            try {
+                const result = tool.invoke(input, config);
+                guard.recordOutcome(outcome.decision.callId, bodyStateFor(result), {
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                return result;
+            }
+            catch (exc) {
+                guard.recordOutcome(outcome.decision.callId, BodyState.RAISED, {
+                    errorCode: errorCodeOf(exc),
+                    invokedParams: snapshot,
+                    durationMs: elapsedMs(start),
+                });
+                throw exc;
+            }
+        };
+    }
     return new Proxy(tool, {
         get(target, prop, receiver) {
             if (prop === "invoke")