@bli-cockpit/cli 0.2.54 → 0.2.56

package/dist/adapters/attribution-core.js

@@ -1,7 +1,3 @@
-import crypto from "node:crypto";
-import { realpathSync } from "node:fs";
-import path from "node:path";
-import { normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, stableWorktreeFingerprint, } from "../repo-identity.js";
 /**
  * Shared deterministic attribution core for agent session transcripts (Codex
  * and Claude Code). Both adapters extract source-shaped signals, normalize them
@@ -13,565 +9,17 @@ import { normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOr
  * A session is attributed only when exactly one worktree clearly wins (best
  * score ≥ threshold AND beats the runner-up by the margin). Close calls stay
  * ambiguous instead of being duplicated across repos or guessed.
+ *
+ * This file is the table of contents; every responsibility below lives in an
+ * `attribution-core-*.ts` sibling and is re-exported here so the module's
+ * public surface never moves:
+ *   -types      scoring weights, thresholds, and shared shapes (BLI-3637)
+ *   -score      scoreSignalsAgainstWorktrees, the entry point
+ *   -fallbacks  folder/known-repo/transcript-origin rescue paths + terminal
+ *               reasons, tried in order once no worktree wins outright
+ *   -paths      cross-platform path containment/worktree matching, plus the
+ *               session-id/hash/score-clamp value normalizers beside them
  */
-export const SCORE_CWD_MATCH = 0.5;
-export const SCORE_WORKSPACE_ROOT_MATCH = 0.1;
-export const SCORE_ORIGIN_MATCH = 0.3;
-export const SCORE_BRANCH_MATCH = 0.15;
-export const SCORE_HEAD_SHA_MATCH = 0.05;
-export const ATTRIBUTION_MIN_SCORE = 0.4;
-export const ATTRIBUTION_MIN_MARGIN = 0.15;
-export const ATTRIBUTED_FALLBACK_MAX_SCORE = 0.39;
-export const SESSION_FILE_UUID_PATTERN = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i;
-export function scoreSignalsAgainstWorktrees(signals, worktrees, options = {}) {
-    const originLabel = options.originLabel ?? "origin_url_match";
-    const collectionRoots = collectionRootComparisonAliases(options.collectionRoots ?? []);
-    const recordedPaths = [...signals.cwds, ...signals.workspaceRoots];
-    const approvedRecordedPaths = recordedPathsWithinCollectionRoots(recordedPaths, collectionRoots);
-    const scopedWorktrees = worktreesWithinCollectionScope(worktrees, collectionRoots);
-    const cwdComparisonPaths = pathComparisonAliases(signals.cwds);
-    const workspaceRootComparisonPaths = pathComparisonAliases(signals.workspaceRoots);
-    const hasAnySignal = signals.cwds.length > 0 ||
-        signals.workspaceRoots.length > 0 ||
-        signals.originUrls.length > 0 ||
-        signals.branches.length > 0 ||
-        signals.headShas.length > 0;
-    if (!hasAnySignal) {
-        return unattributed("no_repo_signals");
-    }
-    // D6 deepest-root tie-break: a path signal can sit inside several candidate
-    // roots when one root is nested inside another (e.g. Claude's
-    // `<repo>/.claude/worktrees/<name>` linked worktrees, or any monorepo with a
-    // nested package that is itself a worktree). Crediting every containing root
-    // leaves the session ambiguous forever. Instead, only the DEEPEST containing
-    // root earns the path score, which is also the most specific (correct) match.
-    const cwdWinners = deepestContainers(cwdComparisonPaths, scopedWorktrees);
-    const workspaceRootWinners = deepestContainers(workspaceRootComparisonPaths, scopedWorktrees);
-    const scored = scopedWorktrees.map((worktree) => {
-        const matched = [];
-        let score = 0;
-        let pathScore = 0;
-        if (cwdWinners.has(worktree.worktree_fingerprint)) {
-            score += SCORE_CWD_MATCH;
-            pathScore += SCORE_CWD_MATCH;
-            matched.push("cwd_match");
-        }
-        if (workspaceRootWinners.has(worktree.worktree_fingerprint)) {
-            score += SCORE_WORKSPACE_ROOT_MATCH;
-            pathScore += SCORE_WORKSPACE_ROOT_MATCH;
-            matched.push("workspace_root_match");
-        }
-        if (worktree.repo_origin_url &&
-            signals.originUrls.includes(worktree.repo_origin_url)) {
-            score += SCORE_ORIGIN_MATCH;
-            matched.push(originLabel);
-        }
-        if (signals.branches.includes(worktree.branch)) {
-            score += SCORE_BRANCH_MATCH;
-            matched.push("branch_match");
-        }
-        if (worktree.head_sha && signals.headShas.includes(worktree.head_sha)) {
-            score += SCORE_HEAD_SHA_MATCH;
-            matched.push("head_sha_match");
-        }
-        return { worktree, score, pathScore, matched };
-    });
-    scored.sort((a, b) => b.score - a.score);
-    const best = scored[0];
-    const secondBestScore = scored[1]?.score ?? 0;
-    if (!best || best.score === 0) {
-        if (approvedRecordedPaths.length > 0) {
-            const folderFallback = fallbackToFolderWorkspaceForContainerCwd({
-                signals,
-                worktrees: scopedWorktrees,
-                approvedRecordedPaths,
-            });
-            if (folderFallback)
-                return folderFallback;
-            const transcriptFallback = fallbackToTranscriptOriginForDeletedRepo({
-                originLabel,
-                signals,
-                collectionRoots,
-                pathExists: options.pathExists,
-            });
-            if (transcriptFallback) {
-                return attachApprovedRootWorkspace({
-                    outcome: transcriptFallback,
-                    signals,
-                    collectionRoots,
-                    approvedRecordedPaths,
-                });
-            }
-            return attachApprovedRootWorkspace({
-                outcome: skipped(terminalReasonForRecordedPaths(approvedRecordedPaths, options.pathExists)),
-                signals,
-                collectionRoots,
-                approvedRecordedPaths,
-            });
-        }
-        const reason = signals.cwds.length > 0 || signals.workspaceRoots.length > 0
-            ? "cwd_outside_scanned_worktrees"
-            : "no_matching_worktree_signals";
-        return unattributed(reason);
-    }
-    const score = clampScore(best.score);
-    const pathScore = clampScore(best.pathScore);
-    if (best.pathScore > 0 &&
-        best.score >= ATTRIBUTION_MIN_SCORE &&
-        best.score - secondBestScore >= ATTRIBUTION_MIN_MARGIN) {
-        return {
-            state: "attributed",
-            reason: "deterministic_signal_match",
-            signals: best.matched,
-            attribution_score: score,
-            path_score: pathScore,
-            worktree: best.worktree,
-        };
-    }
-    if (best.pathScore === 0) {
-        if (collectionRoots.length > 0 && approvedRecordedPaths.length === 0) {
-            return unattributed(recordedPaths.length > 0
-                ? "cwd_outside_scanned_worktrees"
-                : "no_matching_worktree_signals");
-        }
-        const fallback = fallbackToKnownRepoPrimaryWorkContext({
-            originLabel,
-            scored,
-            signals,
-            worktrees: scopedWorktrees,
-        });
-        if (fallback) {
-            return attachApprovedRootWorkspace({
-                outcome: fallback,
-                signals,
-                collectionRoots,
-                approvedRecordedPaths,
-            });
-        }
-    }
-    return attachApprovedRootWorkspace({
-        outcome: {
-            state: "ambiguous",
-            reason: best.score - secondBestScore < ATTRIBUTION_MIN_MARGIN
-                ? "multiple_worktrees_close_scores"
-                : "signal_score_below_threshold",
-            signals: best.matched,
-            attribution_score: score,
-            path_score: pathScore,
-            worktree: null,
-        },
-        signals,
-        collectionRoots,
-        approvedRecordedPaths,
-    });
-}
-/**
- * Gives an inside-boundary terminal attribution a durable upload context
- * without pretending the session belongs to any discovered repository. The
- * original state, reason, signals, and scores are deliberately untouched: the
- * synthetic folder is transport identity, not stronger attribution.
- */
-function attachApprovedRootWorkspace(options) {
-    if (options.outcome.worktree || options.approvedRecordedPaths.length === 0) {
-        return options.outcome;
-    }
-    const approvedRoot = deepestApprovedRootForRecordedPaths(options.approvedRecordedPaths, options.collectionRoots);
-    if (!approvedRoot)
-        return options.outcome;
-    const repoLabel = basenameForAttributionPath(approvedRoot);
-    return {
-        ...options.outcome,
-        worktree: {
-            requested_path: approvedRoot,
-            repo_root: approvedRoot,
-            repo_label: repoLabel,
-            repo_fingerprint: repoFingerprintFromLocalRoot(approvedRoot),
-            repo_origin_url: null,
-            branch: options.signals.branches[0] ?? "unknown",
-            head_sha: options.signals.headShas[0] ?? null,
-            worktree_label: repoLabel,
-            worktree_fingerprint: stableWorktreeFingerprint(approvedRoot),
-            worktree_is_primary: true,
-        },
-    };
-}
-function deepestApprovedRootForRecordedPaths(recordedPaths, collectionRoots) {
-    const candidates = collectionRoots.filter((root) => recordedPaths.some((recordedPath) => isPathWithin(recordedPath, root)));
-    candidates.sort((a, b) => pathDepth(b) - pathDepth(a) ||
-        normalizedAttributionPathKey(a).localeCompare(normalizedAttributionPathKey(b)));
-    return candidates[0] ? resolveAttributionPath(candidates[0]) : null;
-}
-function unattributed(reason) {
-    return {
-        state: "unattributed",
-        reason,
-        signals: [],
-        attribution_score: 0,
-        path_score: 0,
-        worktree: null,
-    };
-}
-function skipped(reason) {
-    return {
-        state: "skipped",
-        reason,
-        signals: [],
-        attribution_score: 0,
-        path_score: 0,
-        worktree: null,
-    };
-}
-/**
- * Handles sessions launched from wrapper folders that intentionally contain
- * several repos. The wrapper path is the user's working context even though it
- * is not itself a git repo, and the consent boundary is unchanged because this
- * only runs after the recorded path was proven under an approved collection
- * root.
- */
-function fallbackToFolderWorkspaceForContainerCwd(options) {
-    let bestFolder = null;
-    for (const recordedPath of pathComparisonAliases(options.approvedRecordedPaths)) {
-        const resolvedPath = resolveAttributionPath(recordedPath);
-        const containedWorktrees = options.worktrees.filter((worktree) => isPathStrictlyWithin(worktree.repo_root, resolvedPath));
-        if (containedWorktrees.length === 0)
-            continue;
-        const depth = pathDepth(resolvedPath);
-        if (!bestFolder || depth > bestFolder.depth) {
-            bestFolder = { resolvedPath, depth, containedWorktrees };
-        }
-    }
-    if (!bestFolder)
-        return null;
-    const repoFingerprints = new Set(bestFolder.containedWorktrees.map((worktree) => worktree.repo_fingerprint));
-    if (repoFingerprints.size === 1) {
-        const primary = sortWorktreesForFolderFallback(bestFolder.containedWorktrees)[0];
-        if (!primary)
-            return null;
-        return {
-            state: "attributed_fallback",
-            reason: "single_repo_folder_fallback",
-            signals: ["single_repo_folder_fallback"],
-            attribution_score: clampScore(Math.min(SCORE_CWD_MATCH, ATTRIBUTED_FALLBACK_MAX_SCORE)),
-            path_score: 0,
-            worktree: primary,
-        };
-    }
-    const repoLabel = basenameForAttributionPath(bestFolder.resolvedPath);
-    return {
-        state: "attributed_fallback",
-        reason: "multi_repo_folder_workspace",
-        signals: ["multi_repo_folder_workspace"],
-        attribution_score: clampScore(ATTRIBUTED_FALLBACK_MAX_SCORE),
-        path_score: 0,
-        worktree: {
-            requested_path: bestFolder.resolvedPath,
-            repo_root: bestFolder.resolvedPath,
-            repo_label: repoLabel,
-            repo_fingerprint: repoFingerprintFromLocalRoot(bestFolder.resolvedPath),
-            repo_origin_url: null,
-            branch: options.signals.branches[0] ?? "unknown",
-            head_sha: options.signals.headShas[0] ?? null,
-            worktree_label: repoLabel,
-            worktree_fingerprint: stableWorktreeFingerprint(bestFolder.resolvedPath),
-            worktree_is_primary: true,
-        },
-    };
-}
-function fallbackToKnownRepoPrimaryWorkContext(options) {
-    const originCandidates = options.worktrees.filter((worktree) => worktree.repo_origin_url &&
-        options.signals.originUrls.includes(worktree.repo_origin_url));
-    if (originCandidates.length === 0)
-        return null;
-    const primaryByClone = originCandidates.filter((worktree) => worktree.worktree_is_primary);
-    const cloneCandidates = primaryByClone.length > 0 ? primaryByClone : originCandidates;
-    const cloneRoots = new Set(cloneCandidates.map((worktree) => normalizedAttributionPathKey(worktree.repo_root)));
-    if (cloneRoots.size > 1) {
-        return {
-            state: "ambiguous",
-            reason: "multiple_repos_share_origin",
-            signals: [options.originLabel],
-            attribution_score: ATTRIBUTED_FALLBACK_MAX_SCORE,
-            path_score: 0,
-            worktree: null,
-        };
-    }
-    const primary = primaryByClone[0] ??
-        originCandidates.find((worktree) => worktree.worktree_is_primary) ??
-        originCandidates[0] ??
-        null;
-    if (!primary)
-        return null;
-    const primaryScore = options.scored.find((entry) => entry.worktree.worktree_fingerprint === primary.worktree_fingerprint);
-    const signals = new Set([
-        ...(primaryScore?.matched ?? [options.originLabel]),
-        "repo_primary_fallback",
-    ]);
-    return {
-        state: "attributed_fallback",
-        reason: "known_repo_primary_fallback",
-        signals: [...signals],
-        attribution_score: clampScore(Math.min(primaryScore?.score ?? SCORE_ORIGIN_MATCH, ATTRIBUTED_FALLBACK_MAX_SCORE)),
-        path_score: 0,
-        worktree: primary,
-    };
-}
-/**
- * Reconstructs a repo/worktree identity from transcript origin metadata only
- * after the caller has already proven a recorded cwd/workspace root sits under
- * an operator-approved collection root. The origin is never allowed to widen
- * consent by itself: it only rescues sessions for repos that were once inside
- * the approved scan boundary but have since been deleted from disk, where the
- * transcript is still durable enough to carry the normalized remote identity.
- */
-function fallbackToTranscriptOriginForDeletedRepo(options) {
-    const origins = [
-        ...new Set(options.signals.originUrls
-            .map((origin) => normalizeGitOrigin(origin))
-            .filter(Boolean)),
-    ];
-    if (origins.length === 0)
-        return null;
-    if (origins.length > 1)
-        return skipped("multiple_transcript_origins");
-    if (!options.pathExists)
-        return null;
-    // Prefer an explicitly recorded workspace root, but only after proving that
-    // exact selected path remains inside the operator-approved boundary. A
-    // different cwd being approved must never authorize an outside workspace
-    // root (or vice versa).
-    const recordedPath = [...options.signals.workspaceRoots, ...options.signals.cwds].find((value) => {
-        if (!options.collectionRoots.some((root) => isPathWithin(value, root))) {
-            return false;
-        }
-        try {
-            return !options.pathExists?.(value);
-        }
-        catch {
-            // Deliberately silent (BLI-3238). This is an existence PROBE and
-            // failure is the answer: a path we cannot test is a path we cannot
-            // claim is missing, so the candidate is passed over. The scorer is
-            // pure and synchronous by design and has no channel to report on.
-            return false;
-        }
-    }) ?? null;
-    if (!recordedPath)
-        return null;
-    const resolvedPath = resolveAttributionPath(recordedPath);
-    const origin = origins[0] ?? "";
-    return {
-        state: "attributed_fallback",
-        reason: "transcript_origin_fallback",
-        signals: ["transcript_origin_fallback", options.originLabel],
-        attribution_score: clampScore(SCORE_ORIGIN_MATCH),
-        path_score: 0,
-        worktree: {
-            requested_path: resolvedPath,
-            repo_root: resolvedPath,
-            repo_label: repoLabelFromOrigin(origin),
-            repo_fingerprint: repoFingerprintFromOrigin(origin),
-            repo_origin_url: origin,
-            branch: options.signals.branches[0] ?? "unknown",
-            head_sha: options.signals.headShas[0] ?? null,
-            worktree_label: basenameForAttributionPath(resolvedPath),
-            worktree_fingerprint: stableWorktreeFingerprint(resolvedPath),
-            worktree_is_primary: false,
-        },
-    };
-}
-function terminalReasonForRecordedPaths(paths, pathExists) {
-    // A recorded path under a collection root can mean two different things:
-    // deleted/missing repo (retryable) or an existing non-repo folder. The latter
-    // is common with wrapper-folder workflows, so adapters inject existence only
-    // at the boundary and the pure scorer keeps the old label when no hook exists.
-    if (!pathExists)
-        return "repo_not_on_disk";
-    const anyRecordedPathExists = paths.some((value) => {
-        try {
-            return pathExists(value);
-        }
-        catch {
-            // Deliberately silent (BLI-3238), same probe as above: "cannot test"
-            // folds into "does not exist", which is the conservative direction —
-            // it keeps the older `repo_not_on_disk` label rather than inventing
-            // `cwd_not_a_repo`.
-            return false;
-        }
-    });
-    return anyRecordedPathExists ? "cwd_not_a_repo" : "repo_not_on_disk";
-}
-/**
- * For each path signal, the single worktree whose root most specifically
- * contains it (the longest containing root). Returns the set of worktree
- * fingerprints that win at least one path signal — these are the only roots
- * credited with the path score (D6).
- */
-function deepestContainers(signalValues, worktrees) {
-    const winners = new Set();
-    for (const value of signalValues) {
-        let best = null;
-        let bestRootLength = -1;
-        for (const worktree of worktrees) {
-            if (!isPathWithin(value, worktree.repo_root))
-                continue;
-            const rootLength = normalizedAttributionPathKey(worktree.repo_root).length;
-            if (rootLength > bestRootLength) {
-                best = worktree;
-                bestRootLength = rootLength;
-            }
-        }
-        if (best)
-            winners.add(best.worktree_fingerprint);
-    }
-    return winners;
-}
-export function isPathWithin(candidate, root) {
-    return pathContainment(candidate, root, false);
-}
-function isPathStrictlyWithin(candidate, root) {
-    return pathContainment(candidate, root, true);
-}
-function recordedPathsWithinCollectionRoots(paths, collectionRoots) {
-    if (paths.length === 0 || collectionRoots.length === 0)
-        return [];
-    return paths.filter((value) => collectionRoots.some((root) => isPathWithin(value, root)));
-}
-function worktreesWithinCollectionScope(worktrees, collectionRoots) {
-    if (collectionRoots.length === 0)
-        return worktrees;
-    const directlyApproved = new Set(worktrees
-        .filter((worktree) => collectionRoots.some((root) => isPathWithin(worktree.repo_root, root)))
-        .map((worktree) => worktree.worktree_fingerprint));
-    const approvedRepoFingerprints = new Set(worktrees
-        .filter((worktree) => directlyApproved.has(worktree.worktree_fingerprint))
-        .map((worktree) => worktree.repo_fingerprint));
-    return worktrees.filter((worktree) => directlyApproved.has(worktree.worktree_fingerprint) ||
-        (isCodexManagedWorktreePath(worktree.repo_root) &&
-            approvedRepoFingerprints.has(worktree.repo_fingerprint)));
-}
-function isCodexManagedWorktreePath(value) {
-    const pathApi = attributionPathApi(value);
-    const windowsPath = isWindowsAbsolutePath(value);
-    const parts = pathApi.resolve(value).split(pathApi.sep).filter(Boolean);
-    return parts.some((part, index) => {
-        const codex = windowsPath ? part.toLowerCase() : part;
-        const nextPart = parts[index + 1] ?? "";
-        const worktrees = windowsPath ? nextPart.toLowerCase() : nextPart;
-        return codex === ".codex" && worktrees === "worktrees";
-    });
-}
-function sortWorktreesForFolderFallback(worktrees) {
-    return [...worktrees].sort((a, b) => Number(b.worktree_is_primary) - Number(a.worktree_is_primary) ||
-        normalizedAttributionPathKey(a.repo_root).localeCompare(normalizedAttributionPathKey(b.repo_root)) ||
-        a.worktree_fingerprint.localeCompare(b.worktree_fingerprint));
-}
-function pathDepth(value) {
-    const pathApi = attributionPathApi(value);
-    return pathApi.resolve(value).split(pathApi.sep).filter(Boolean).length;
-}
-/**
- * Transcript paths describe the host that produced the session, which may not
- * be the host currently running tests or replaying evidence. Detect Windows
- * drive/UNC paths from the values themselves so attribution keeps win32
- * separator and case rules on macOS/Linux too.
- */
-function pathContainment(candidate, root, strict) {
-    const candidateIsWindows = isWindowsAbsolutePath(candidate);
-    const rootIsWindows = isWindowsAbsolutePath(root);
-    if (candidateIsWindows !== rootIsWindows)
-        return false;
-    const pathApi = candidateIsWindows ? path.win32 : path.posix;
-    const normalizedCandidate = pathApi.resolve(candidate);
-    const normalizedRoot = pathApi.resolve(root);
-    return normalizedPathContainment(normalizedCandidate, normalizedRoot, pathApi, strict);
-}
-function normalizedPathContainment(candidate, root, pathApi, strict) {
-    const relative = pathApi.relative(root, candidate);
-    if (relative === "")
-        return !strict;
-    return (relative !== ".." &&
-        !relative.startsWith(`..${pathApi.sep}`) &&
-        !pathApi.isAbsolute(relative));
-}
-function collectionRootComparisonAliases(roots) {
-    return pathComparisonAliases(roots);
-}
-function pathComparisonAliases(values) {
-    const aliases = [];
-    const seen = new Set();
-    for (const value of values) {
-        for (const candidate of [
-            resolveAttributionPath(value),
-            canonicalExistingAttributionPath(value),
-        ]) {
-            if (!candidate)
-                continue;
-            const key = normalizedAttributionPathKey(candidate);
-            if (seen.has(key))
-                continue;
-            seen.add(key);
-            aliases.push(candidate);
-        }
-    }
-    return aliases;
-}
-function canonicalExistingAttributionPath(value) {
-    const windowsPath = isWindowsAbsolutePath(value);
-    if (windowsPath !== (process.platform === "win32"))
-        return null;
-    try {
-        return attributionPathApi(value).resolve(realpathSync(value));
-    }
-    catch {
-        // Deliberately silent (BLI-3238). `realpathSync` is the test for "does
-        // this path resolve to something real?", and `null` — "no canonical form"
-        // — is the answer, not a degradation. Callers already treat a null here
-        // as one more alias that does not apply.
-        return null;
-    }
-}
-function attributionPathApi(value) {
-    return isWindowsAbsolutePath(value) ? path.win32 : path.posix;
-}
-function resolveAttributionPath(value) {
-    return attributionPathApi(value).resolve(value);
-}
-function basenameForAttributionPath(value) {
-    return attributionPathApi(value).basename(value);
-}
-function normalizedAttributionPathKey(value) {
-    const resolved = resolveAttributionPath(value);
-    return isWindowsAbsolutePath(value) ? resolved.toLowerCase() : resolved;
-}
-function isWindowsAbsolutePath(value) {
-    return (/^[A-Za-z]:[\\/]/.test(value) ||
-        /^[\\/]{2}[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/.test(value));
-}
-export function clampScore(value) {
-    return Math.min(1, Math.max(0, Number(value.toFixed(4))));
-}
-export function sessionIdFromFileName(fileName) {
-    const match = fileName.match(SESSION_FILE_UUID_PATTERN);
-    return match?.[1]?.toLowerCase() ?? null;
-}
-/**
- * Session ids come from file content and end up inside remote object keys, so
- * anything outside the safe charset falls back to a hash of the raw value
- * instead of poisoning every begin request in the batch.
- */
-export function sanitizeSessionId(value) {
-    if (!value)
-        return null;
-    if (/^[A-Za-z0-9._-]{4,80}$/.test(value))
-        return value;
-    return shortHash(value);
-}
-export function shortHash(value) {
-    return crypto
-        .createHash("sha256")
-        .update(value, "utf8")
-        .digest("hex")
-        .slice(0, 16);
-}
-export function sha256(value) {
-    return crypto.createHash("sha256").update(value).digest("hex");
-}
+export { SCORE_CWD_MATCH, SCORE_WORKSPACE_ROOT_MATCH, SCORE_ORIGIN_MATCH, SCORE_BRANCH_MATCH, SCORE_HEAD_SHA_MATCH, ATTRIBUTION_MIN_SCORE, ATTRIBUTION_MIN_MARGIN, ATTRIBUTED_FALLBACK_MAX_SCORE, SESSION_FILE_UUID_PATTERN, } from "./attribution-core-types.js";
+export { scoreSignalsAgainstWorktrees } from "./attribution-core-score.js";
+export { isPathWithin, clampScore, sessionIdFromFileName, sanitizeSessionId, shortHash, sha256, } from "./attribution-core-paths.js";