/**
 * @coderifts/agent-guard — fail-closed guard for AI agent tool calls.
 *
 * Preflight contract changes before they execute. Security core FROZEN (agent-guard-api v1.0).
 *
 * An additive orchestration layer (withCodeRifts) now sits ALONGSIDE the frozen security core: it
 * composes the frozen primitives behind one entry point and reports a separate, narrower
 * composition-level assurance. It never modifies or re-decides any frozen primitive.
 *
 * @example
 * ```ts
 * import { guardToolCall } from '@coderifts/agent-guard';
 * import { CodeRifts } from '@coderifts/sdk';
 *
 * const client = new CodeRifts({ apiKey: 'cr_live_...' });
 * const outcome = await guardToolCall(
 *   { toolName: 'Edit', arguments: { path: 'openapi.yaml', ... }, filesTouched: ['openapi.yaml'] },
 *   async (envelope, redactedCall) => applyTheEdit(redactedCall),
 *   { client },
 * );
 * if (!outcome.executed) console.error('blocked:', outcome.verdict);
 * ```
 */
export { buildDenyTeaching, mappedCauses, NEXT_ACTION } from './deny-teaching.js';
export type { DenyTeaching, NextAction } from './deny-teaching.js';
export { guardToolCall } from './guard.js';
export { CODERIFTS_POLICY, POLICY_MARKER, POLICY_ABSENT_WARN, withPolicy, policyPresenceOf, detectPolicyPresence, observePolicyPresence, warnPolicyAbsentOnce, resetPolicyWarnForTests, } from './policy.js';
export type { PolicyPresence, PolicyMessage, WithPolicyOptions, } from './policy.js';
export { builtinDetector, DETECTOR_VERSION } from './detector.js';
export { bindReceiptToEnvelope, computeBodyHash, canonicalJson } from './receipt-binding.js';
export type { BindResult, BindCause, BindContext, VerifyReceiptResultLike } from './receipt-binding.js';
export { verifyReceiptChainLinkage, previousReceiptCommitment, decodeReceiptBodyPrev, RECEIPT_PREV_NULL, } from './receipt-chain.js';
export type { ReceiptChainLinkageResult, ReceiptChainLinkageReason, } from './receipt-chain.js';
export { evaluateEnvelope, computeArtifactDigest, computeBundleFingerprint } from './enforcement-gate.js';
export type { GateResult } from './enforcement-gate.js';
export { checkExecutionTimeFingerprint, authorizedFingerprintFromEnvelope, computeCanonicalBundleFingerprint, isUnmeasurableExecutionStateReason, EXECUTION_STATE_UNMEASURABLE_NOTE, EXECUTION_TIME_FP_REASONS, } from './execution-time-fingerprint.js';
export type { CheckExecutionTimeFingerprintArgs, ExecutionTimeFingerprintVerdict, ExecutionTimeFpReason, BundleFingerprintContext, } from './execution-time-fingerprint.js';
export { readDecision } from './read-decision.js';
export type { ReadDecisionResult, ReadDecisionReason } from './read-decision.js';
export { SessionTaintTracker, SESSION_TAINT_VERSION, updateSession, evaluate, computeTainted, emptySessionState, projectState, classifyCommand, pathClass, deriveKeySignal, } from './session-taint.js';
export type { SessionState, SessionTaintConfig, SessionTaintObservation, SessionEval, PendingRename, PathClass, CmdClass, } from './session-taint.js';
export type { ReceiptVerifiedEnvelope, GuardConfig, ToolCallDescriptor, ExecuteFactory, ApprovedVerdict, GuardOutcome, GuardVerdict, UnavailableVerdict, AvailabilityCause, IntegrityCause, UnavailableCause, TriggerDetector, LkgStore, GuardEvent, CodeRifts, DecisionResultEnvelope, ExecutionAction, Artifact, GuardExecutionProof, ExecutionResultHash, GuardToolCallContext, CommitObservation, CommitObservationStatus, CommitHostAttestation, CommitObservationBlast, } from './types.js';
export { observeCommit, hashObservedContent } from './commit-observation.js';
export { deliverMonitoring, formatMonitoringDeliveryLine, monitoringDeliveryFailClosed, verifyAckHmac, ackBytes, DEFAULT_MONITORING_SINK_TIMEOUT_MS, } from './monitoring-delivery.js';
export { tryIssueMonitoringAttestation, kidFromMonitoringAttestation, monitorAttestSigningInput, receiptDigestOfToken, MONITOR_ATTEST_VERSION, MONITOR_ATTEST_SIGNING_PREFIX, MONITOR_ATTEST_ENVELOPE_TAG, } from './monitoring-attestation.js';
export type { MonitoringAttestationConfig, MonitoringAttestationSigner, } from './monitoring-attestation.js';
export { tryIssueCoverageAttestation, kidFromCoverageAttestation, coverageAttestSigningInput, COVERAGE_ATTEST_VERSION, COVERAGE_ATTEST_SIGNING_PREFIX, COVERAGE_ATTEST_ENVELOPE_TAG, } from './coverage-attestation.js';
export type { CoverageAttestationConfig, CoverageAttestationSigner, } from './coverage-attestation.js';
export type { MonitoringDelivery, MonitoringDeliveryStatus, MonitoringDeliveryEvidence, MonitoringSink, MonitoringSinkHttp, MonitoringSinkCallback, MonitoringSinkPayload, } from './monitoring-delivery.js';
export { buildExecutionProof, hashExecutionResult, assertEnforcedReceiptInvariant, EXECUTION_PROOF_SPEC, } from './execution-proof.js';
export { renderFinalAnswerProof, attachProofToAgentResponse, deriveProofBanner, } from './final-answer-proof.js';
export type { RenderFinalAnswerProofOptions, AttachProofToAgentResponseOptions, FinalAnswerProofFormat, FinalAnswerProofBanner, } from './final-answer-proof.js';
export { assessFreshness, assessWriteStylePrior, contentByteIdentical, computePathSetTreeHash, freshnessAllowsEnforce, isWriteStyleCall, isMutatingCall, artifactIdsForResolve, collectFreshnessCallContext, buildFreshnessBasis, } from './freshness.js';
export type { FreshnessOutcome, FreshnessCheckLevel, FreshnessAssessInput, FreshnessAssessResult, WriteStylePriorInput, WriteStylePriorResult, FreshnessWiringState, FreshnessBasis, FreshnessCallContext, PriorContentResolver, FreshnessDegradeReason, } from './freshness.js';
export { buildConditionalWriteBasis, tokensEqual, conditionalWriteResidual, RESIDUAL_UNCONDITIONAL_WRITE, executeIfUnchanged, StaleVersionTokenAbort, } from './conditional-write.js';
export type { VersionToken, VersionedContent, ConditionalWriteReport, ConditionalWriteBasis, ConditionalWriteCallContext, ExecuteIfUnchangedOutcome, ExecuteIfUnchangedArgs, ConditionalWriteGuarantee, IndeterminateReason, } from './conditional-write.js';
export { createFsVersionToken, readVersionedFile, writeFileIfUnchanged, createFsPriorContentResolver, fsTokenContentHash, FS_VERSION_TOKEN_PREFIX, FS_ABSENT_TOKEN, assertSafeCasPath, UnsafeCasPathError, fsObjectIdentity, identitiesEqual, } from './cas-adapters/fs.js';
export type { FsObjectIdentity } from './cas-adapters/fs.js';
export { createApiVersionToken, writeApiIfUnchanged, apiTokenRaw, API_VERSION_TOKEN_PREFIX, API_ABSENT_TOKEN, } from './cas-adapters/api.js';
export type { WriteApiIfUnchangedArgs, ApiHostWriteReport, ApiWriteResult, } from './cas-adapters/api.js';
export { createDbVersionToken, writeDbIfUnchanged, dbTokenRaw, DB_VERSION_TOKEN_PREFIX, DB_ABSENT_TOKEN, } from './cas-adapters/db.js';
export type { WriteDbIfUnchangedArgs, DbHostWriteReport, DbWriteResult, } from './cas-adapters/db.js';
export { createRegistryVersionToken, writeRegistryIfUnchanged, registryTokenRaw, REGISTRY_VERSION_TOKEN_PREFIX, REGISTRY_ABSENT_TOKEN, } from './cas-adapters/registry.js';
export type { WriteRegistryIfUnchangedArgs, RegistryHostCasReport, RegistryWriteResult, } from './cas-adapters/registry.js';
export { buildCasAttestation, isGuardExecutionProof, isExecuteIfUnchangedOutcome, evaluateCasEvidence, extractExecutorAttestationToken, strictCommitObservation, CAS_ATTESTATION_SPEC, COMMIT_EVIDENCE_MISSING, } from './cas-attestation.js';
export type { CasAttestation, CasAttestationCas, CasAttestationLimits, CasEvidence, CasEvidenceClass, ExecutorAttestationConfig, EvaluateCasEvidenceOpts, CommitLabel, StrictCommitObservation, } from './cas-attestation.js';
export { buildRemediationLoopAttestation, readRemediationTransaction, readPriorBlockRemediation, isCasAttestation, REMEDIATION_LOOP_ATTESTATION_SPEC, } from './remediation-loop-attestation.js';
export type { RemediationLoopAttestation, RemediationLoopAttestationLimits, RemediationTransactionView, } from './remediation-loop-attestation.js';
export { resolve as resolveArtifacts, classifyByName, blobMapKey } from './artifact-resolver.js';
export type { ResolveInput, ResolveConfig, ResolveResult, ResolvedArtifact, ResolveCoverage, UnresolvedEntry, UnresolvedReason, BlobValue, SsotSelection, ArtifactType as ResolverArtifactType, } from './artifact-resolver.js';
export { matchGlob, globToRegExp } from './resolver-glob.js';
export { guardToolRegistry, RegistryConstructionError } from './tool-registry.js';
export type { RawTool, ProtectedTool, ToolMutationClass, EnforcementCoverage, RegistryCoverageReport, GuardToolRegistryConfig, RegistryResult, ToolBinder, RegistryConstructionErrorCode, } from './tool-registry.js';
export { gateDecision } from './merge-gate.js';
export type { GateDecisionInput, GateDecision, ReceiptView, RequiredContext, ProtectionState, GateReason, GateStatusState, EnforcementState, } from './merge-gate.js';
export { deployGate, asVerifiedDeployReceiptView, isVerifiedDeployReceiptView, DEPLOY_RECEIPT_VIEW_SPEC, } from './deploy-gate.js';
export type { DeployGateInput, DeployGateDecision, DeployReceiptView, VerifiedDeployReceiptView, DeployRequiredContext, DeployEnforcementState, DeployTarget, DeployGateReason, DeployTokenReceipt, DeployVerificationObservation, DeployVerificationMode, } from './deploy-gate.js';
export { verifyDeployReceiptToken } from './deploy-receipt-token.js';
export type { DeployTokenVerifyResult, DeployTokenVerifyStatus } from './deploy-receipt-token.js';
export { readNextAgentStep, NEXT_AGENT_ACTIONS, NEXT_STEP_NOTE } from './next-agent-step.js';
export type { NextAgentStep, NextAgentAction } from './next-agent-step.js';
export { bindDeploy, DEPLOY_REPAIRABLE_REASONS } from './deploy-bind.js';
export type { BindDeployInput, BindDeployResult, HostAssertedEnvironment, } from './deploy-bind.js';
export { coverageReport } from './coverage-report.js';
export type { CoverageReportInput, CoverageReport, Applicability, PlacementId, PlacementStrength, OverallCoverage, HonestClaimKey, PerPlacementRow, RuntimePlacementInput, MergePlacementInput, DeployPlacementInput, ContentPlacementInput, } from './coverage-report.js';
export { runAutoRecheckLoop, normalizeAutoRecheck, clampMaxAttempts, AUTO_RECHECK_MAX_CAP, } from './auto-recheck.js';
export type { AutoRecheckConfig, AutoRecheckApplyFixContext, RecheckTrailEntry, RecheckStopReason, RecheckObservation, } from './auto-recheck.js';
export { runAutoDerive, normalizeAutoDerive, defaultFsReader, AUTO_DERIVE_SOURCE, AUTO_DERIVE_READ_TIMEOUT_MS, } from './auto-derive.js';
export type { AutoDeriveConfig, AutoDeriveReaders, AutoDeriveReader, AutoDeriveObservation, AutoDeriveMode, AutoDeriveTarget, DerivedArtifact, } from './auto-derive.js';
export { withCodeRifts, foldTableSettledCalls, guardedFractionAmongRoutes, PROFILE_ENFORCING_STRICT_V1, PROFILE_ENFORCING_ATOMIC_V1, UNVERSIONED_PROFILE_NOTICE, _resetUnversionedProfileNoticeForTest, } from './with-coderifts.js';
export { createMutatorRegister, ATOMIC_INVARIANTS, ATOMIC_PROFILE_UNSATISFIED, atomicOutcome, isEnforcingAtomic, PROFILE_ENFORCING_ATOMIC_V2, isEnforcingAtomicV2, atomicConstructionProblems, CREDENTIAL_BOUNDARY_BARE_REJECTED, ATOMIC_V2_MAX_AGE_MS_CAP, } from './atomic-profile.js';
export type { AtomicOutcome, MutatorRegister, VerifiedCredentialBoundary } from './atomic-profile.js';
export { verifyPostureReceipt, POSTURE_RECEIPT_V, POSTURE_CLOCK_SKEW_TOLERANCE_MS, } from './posture-receipt.js';
export type { PostureVerifyStatus, PostureVerifyResult, PostureVerifyInput, PostureReceiptPayload, } from './posture-receipt.js';
export type { WithCodeRiftsInput, WithCodeRiftsResult, WithCodeRiftsRegistryConfig, WithCodeRiftsProfile, WithCodeRiftsAtomicProfile, CompositionAssurance, SettledCallObservation, CallRoute, CallTerminal, TableSettledCallRouteCounts, ReceiptThreadHandle, ReceiptCursorSkipReason, } from './with-coderifts.js';
export { isExecutionGrantEnabled, readExecutionGrantToken, } from './execution-grant.js';
export type { ExecutionGrantConfig, ExecutionGrantObservation, ExecutionGrantCallContext, } from './execution-grant.js';
export { createCoverageObserver, freezeCoverageObserved, formatCoverageObservedLine, } from './coverage-observed.js';
export type { CoverageObservedClass, CoverageDispatch, CoverageObserved, CoverageObservedUnknown, CoverageObservedIncomplete, CoverageObservedComplete, CoverageObservedHandle, CoverageObserver, } from './coverage-observed.js';
export { withCodeRiftsOpenAI, openAIToolAdapter, toOpenAITools, protectedToolToOpenAI, bindOpenAIGuardOutcome, defaultSerializeOpenAIToolResult, } from './adapters/openai.js';
export type { OpenAIFunctionTool, WithCodeRiftsOpenAIResult, OpenAIToolMessage, ProofBoundOpenAIToolMessage, BindOpenAIGuardOutcomeArgs, } from './adapters/openai.js';
export { withCodeRiftsAnthropic, anthropicToolAdapter, toAnthropicTools, protectedToolToAnthropic, bindAnthropicGuardOutcome, defaultSerializeAnthropicToolResult, } from './adapters/anthropic.js';
export type { AnthropicTool, WithCodeRiftsAnthropicResult, AnthropicToolResult, ProofBoundAnthropicToolResult, BindAnthropicGuardOutcomeArgs, } from './adapters/anthropic.js';
export { withCodeRiftsLangGraph, langGraphToolAdapter, toLangGraphTools, protectedToolToLangGraph, bindLangGraphTools, isLangGraphReactAgentTool, LangGraphToolsNotStructuredError, bindLangGraphGuardOutcome, defaultSerializeLangGraphToolResult, } from './adapters/langgraph.js';
export type { LangGraphToolDescriptor, WithCodeRiftsLangGraphResult, LangGraphToolMessage, ProofBoundLangGraphToolMessage, BindLangGraphGuardOutcomeArgs, } from './adapters/langgraph.js';
export { formatGateRefusalBody, freshnessRefusalTeaching, FRESHNESS_RESOLVER_FIX, } from './gate-refusal.js';
export { inferFsPathFromArgs, inferFullFileWriteContent, wrapWriteWithFsCas, measureFsAuthorization, measureFsAuthorizationToken, } from './cas-adapters/fs-default-wire.js';
export type { FsCasWireOptions, FsAuthorizationMeasurement } from './cas-adapters/fs-default-wire.js';
export { withCodeRiftsGemini, geminiToolAdapter, toGeminiTools, protectedToolToFunctionDeclaration, bindGeminiGuardOutcome, defaultSerializeGeminiToolResult, } from './adapters/gemini.js';
export type { GeminiFunctionDeclaration, GeminiTool, WithCodeRiftsGeminiResult, GeminiFunctionResponse, ProofBoundGeminiFunctionResponse, BindGeminiGuardOutcomeArgs, } from './adapters/gemini.js';
export { bindLangChainToolOutcome, defaultSerializeLangChainToolResult, LANGCHAIN_ARTIFACT_SPEC, } from './adapters/langchain.js';
export type { LangChainToolOutput, LangChainToolArtifact, ProofBoundLangChainToolOutput, BindLangChainToolOutcomeArgs, } from './adapters/langchain.js';
export { bindCrewAIToolOutcome, defaultSerializeCrewAIToolResult, } from './adapters/crewai.js';
export type { CrewAIToolResult, ProofBoundCrewAIToolResult, BindCrewAIToolOutcomeArgs, } from './adapters/crewai.js';
export { withCodeRiftsVercel, vercelToolAdapter, toVercelTools, protectedToolToVercel, bindVercelGuardOutcome, defaultSerializeVercelToolResult, } from './adapters/vercel.js';
export type { VercelTool, VercelToolExecutionOptions, WithCodeRiftsVercelResult, VercelToolResult, ProofBoundVercelToolResult, BindVercelGuardOutcomeArgs, } from './adapters/vercel.js';
export { executeProtectedTool, executeOpenAIToolCall, executeAnthropicToolCall, executeGeminiToolCall, executeLangGraphToolCall, executeVercelToolCall, isGuardOutcome, surfaceEnvelopeFields, } from './execute-tool-call.js';
export type { ProtectedToolTableInput, SurfacedEnvelopeFields, ExecuteOpenAIToolCallArgs, ExecuteAnthropicToolCallArgs, ExecuteGeminiToolCallArgs, ExecuteLangGraphToolCallArgs, ExecuteVercelToolCallArgs, } from './execute-tool-call.js';
export { TOOLSET_ATTEST_VERSION, TOOLSET_ATTEST_SIGNING_PREFIX, TOOLSET_ATTEST_ENVELOPE_TAG, TOOLSET_ATTEST_STATEMENT, computeToolsetDigest, declarationEntriesFromTools, toolsetAttestSigningInput, tryIssueToolsetAttestation, kidFromToolsetAttestation, } from './toolset-attestation.js';
export type { ToolsetAttestationConfig, ToolsetAttestationSigner, ToolsetDeclarationEntry, } from './toolset-attestation.js';
export { offlineReceiptVerifier, missingReceiptDecision } from './offline-verify.js';
export { decideUnguardedMutation, isDeclaredMutatingClass, ADVISORY_ENV_VAR, type GuardedMutationPolicy, type UnguardedMutationDecision, } from './unguarded-mutation.js';
export type { PinnedKeyring, MissingReceiptPolicy } from './offline-verify.js';
//# sourceMappingURL=index.d.ts.map