@claude-flow/cli 3.54.0 → 3.55.0

package/dist/src/memory/shared-sqlite.js

@@ -0,0 +1,45 @@
+/**
+ * #3693 — one better-sqlite3 identity per process.
+ *
+ * AgentDB (via @claude-flow/memory) owns a live native handle on memory.db. If
+ * the CLI opens its own handle through a DIFFERENT installed copy of
+ * better-sqlite3 (a nested `agentdb/node_modules/better-sqlite3` next to a
+ * hoisted one is the common layout), the two copies each statically link their
+ * own SQLite and keep separate per-process file bookkeeping. Closing the CLI's
+ * handle (graph-edge idle release: wal_checkpoint(TRUNCATE) + close) then looks
+ * like "last connection" to that copy and deletes the -wal/-shm sidecars out
+ * from under AgentDB's still-open handle.
+ *
+ * Resolve the constructor from the same place AgentDB resolves it, so both
+ * share one SQLite instance (and its connection bookkeeping). Falls back to the
+ * CLI's own copy when agentdb cannot be resolved.
+ */
+import { createRequire } from 'node:module';
+let cached;
+/** Test seam: pass `from` to resolve relative to another entry file. */
+export function resolveAgentdbBetterSqlite3(from) {
+    if (!from && cached !== undefined)
+        return cached;
+    let found = null;
+    try {
+        const own = createRequire(import.meta.url);
+        const agentdbEntry = from ?? own.resolve('agentdb');
+        const mod = createRequire(agentdbEntry)('better-sqlite3');
+        found = (mod?.default ?? mod);
+    }
+    catch {
+        found = null;
+    }
+    if (!from)
+        cached = found;
+    return found;
+}
+/** Constructor shared with AgentDB when possible, else the CLI's own copy. */
+export async function loadBetterSqlite3() {
+    const shared = resolveAgentdbBetterSqlite3();
+    if (shared)
+        return shared;
+    const mod = 'better-sqlite3';
+    return (await import(mod)).default;
+}
+//# sourceMappingURL=shared-sqlite.js.map

package/dist/src/mods/probe.d.ts

@@ -29,5 +29,12 @@ export interface ProbeInputs {
     /** Reads for the plugin-resolution findings; the real filesystem when absent. */
     fs?: ReadFs;
 }
+declare const LEGACY_EVENTS: {
+    readonly route: "UserPromptSubmit";
+    readonly 'post-edit': "PostToolUse";
+};
+/** Which of route/post-edit the settings run through the CLI's own `hooks` command, in any of the files. */
+export declare function legacyCliHooks(files: readonly string[]): Array<keyof typeof LEGACY_EVENTS>;
 export declare function probeMods(inputs: ProbeInputs): Finding[];
+export {};
 //# sourceMappingURL=probe.d.ts.map

package/dist/src/mods/probe.js

@@ -33,6 +33,26 @@ export function managedSettingsPath(os = platform()) {
         return 'C:\\ProgramData\\ClaudeCode\\managed-settings.json';
     return '/etc/claude-code/managed-settings.json';
 }
+const LEGACY_EVENTS = { route: 'UserPromptSubmit', 'post-edit': 'PostToolUse' };
+/** Which of route/post-edit the settings run through the CLI's own `hooks` command, in any of the files. */
+export function legacyCliHooks(files) {
+    const commands = (event) => files.flatMap((f) => {
+        let groups;
+        try {
+            groups = get(readSettingsFile(f), 'hooks', event);
+        }
+        catch {
+            return [];
+        }
+        return Array.isArray(groups)
+            ? groups.flatMap((g) => (Array.isArray(g?.hooks) ? g.hooks.map((h) => h?.command).filter((c) => typeof c === 'string') : []))
+            : [];
+    });
+    return Object.keys(LEGACY_EVENTS).filter((sub) => {
+        const word = new RegExp(`(?:^|[\\s/"'])(?:@claude-flow/cli|claude-flow|ruflo)(?:@[\\w.-]+)?["']?\\s+hooks\\s+${sub}(?![\\w-])`);
+        return commands(LEGACY_EVENTS[sub]).some((c) => word.test(c));
+    });
+}
 export function probeMods(inputs) {
     const root = resolve(inputs.projectRoot);
     const home = inputs.home ?? homedir();
@@ -104,6 +124,14 @@ export function probeMods(inputs) {
     findings.push(managedOnly !== undefined && managedOnly !== false
         ? { name: 'managed policy', status: 'warn', message: 'allowManagedModsOnly is set: Claude Code refuses user mods; classic hooks stay in charge' }
         : { name: 'managed policy', status: 'pass', message: managed === undefined ? 'no managed settings' : 'user mods allowed (allowManagedModsOnly not set)' });
+    // 4a. Settings that still run the CLI's own `hooks route|post-edit` (what init
+    // wrote before hook-handler.cjs). That command never reads the handshake, so
+    // the mod stands down for those events (plugins/ruflo-mods/hooks/ownership.ts,
+    // legacyCliConfigured: keep the two patterns in step).
+    const legacy = legacyCliHooks(files);
+    if (legacy.length) {
+        findings.push({ name: 'legacy CLI hooks', status: 'warn', message: `settings run the CLI's own \`hooks ${legacy.join('` and `hooks ')}\`: the mod stands down for ${legacy.join(' and ')}, which that command keeps`, fix: 'ruflo init upgrade --settings (regenerate the settings hooks)' });
+    }
     // 4. Every classic helper a hook could run honours the handshake (the mod's
     // own rule, plugins/ruflo-mods/hooks/session.ts); else the mod stands down.
     const helpers = [...new Set([join(root, '.claude', 'helpers', 'hook-handler.cjs'), join(home, '.claude', 'helpers', 'hook-handler.cjs')])].filter(existsSync);
@@ -116,7 +144,7 @@ export function probeMods(inputs) {
         }
     });
     findings.push(helpers.length === 0
-        ? { name: 'classic handshake', status: 'pass', message: 'no hook-handler.cjs: the mod owns route and post-edit outright' }
+        ? { name: 'classic handshake', status: 'pass', message: legacy.length ? 'no hook-handler.cjs (see legacy CLI hooks)' : 'no hook-handler.cjs: the mod owns route and post-edit outright' }
         : stale.length === 0
             ? { name: 'classic handshake', status: 'pass', message: `${helpers.join(', ')} hand route and post-edit to the mod while it runs` }
             : { name: 'classic handshake', status: 'warn', message: `${stale.join(', ')} predate${stale.length === 1 ? 's' : ''} the handshake: the mod stands down and classic hooks keep route/post-edit`, fix: 'ruflo init --upgrade (refresh helpers in the project and in ~/.claude)' });

package/dist/src/parser.d.ts

@@ -94,6 +94,9 @@ export declare class CommandParser {
      * commit message.)
      */
     private getScopedBooleanFlags;
+    /** Resolve declared types from broad to narrow without borrowing string
+     * declarations from unrelated registered commands. */
+    private getFlagScope;
     private getBooleanFlags;
     private applyDefaults;
     validateFlags(flags: ParsedFlags, command?: Command): string[];

package/dist/src/parser.js

@@ -135,14 +135,27 @@ export class CommandParser {
         // with `daemon` left as a positional.
         let resolvedCmd;
         let resolvedSub;
+        const resolvedCommands = [];
         let sawFirstPositional = false;
-        for (const arg of args) {
-            if (arg.startsWith('-'))
+        for (let index = 0; index < args.length; index++) {
+            const arg = args[index];
+            if (arg === '--')
+                break;
+            if (arg.startsWith('-')) {
+                // Pass 2 recognizes only contiguous subcommands after the root.
+                if (sawFirstPositional)
+                    break;
+                // Skip consumed values as well as flags: a global option value is not
+                // the command slot, even when it happens to name another command.
+                const scope = this.getFlagScope(resolvedCommands);
+                index = this.parseFlag(args, index, scope.aliases, scope.booleanFlags, scope.stringFlags).nextIndex - 1;
                 continue;
+            }
             if (!sawFirstPositional) {
                 sawFirstPositional = true;
                 if (this.commands.has(arg)) {
                     resolvedCmd = this.commands.get(arg);
+                    resolvedCommands.push(resolvedCmd);
                     continue;
                 }
                 // Lazy command: we know its name but not its subcommands. Stop the
@@ -153,14 +166,21 @@ export class CommandParser {
                 // Unknown first positional — not a command. Stop walking.
                 break;
             }
-            if (resolvedCmd && !resolvedSub && resolvedCmd.subcommands) {
-                resolvedSub = resolvedCmd.subcommands.find(sc => sc.name === arg || sc.aliases?.includes(arg));
+            // Match the same supported command depth as Pass 2, with each option
+            // declaration taking precedence over its parent scope.
+            const parent = resolvedCommands[resolvedCommands.length - 1];
+            if (resolvedCommands.length < 4 && parent?.subcommands) {
+                const child = parent.subcommands.find(sc => sc.name === arg || sc.aliases?.includes(arg));
+                if (child) {
+                    resolvedCommands.push(child);
+                    resolvedSub ??= child;
+                    continue;
+                }
             }
+            // A positional that is not the next subcommand ends the command path.
+            break;
         }
-        // Pass 2: Build aliases scoped to the resolved subcommand
-        // Subcommand-specific aliases take priority over global ones
-        const aliases = this.buildScopedAliases(resolvedSub || resolvedCmd);
-        const booleanFlags = this.getScopedBooleanFlags(resolvedSub || resolvedCmd);
+        const { aliases, booleanFlags, stringFlags } = this.getFlagScope(resolvedCommands);
         let i = 0;
         let parsingFlags = true;
         while (i < args.length) {
@@ -173,7 +193,7 @@ export class CommandParser {
             }
             // Handle flags
             if (parsingFlags && arg.startsWith('-')) {
-                const parseResult = this.parseFlag(args, i, aliases, booleanFlags);
+                const parseResult = this.parseFlag(args, i, aliases, booleanFlags, stringFlags);
                 // Apply to result flags
                 Object.assign(result.flags, parseResult.flags);
                 i = parseResult.nextIndex;
@@ -231,7 +251,7 @@ export class CommandParser {
         this.applyDefaults(result.flags, resolvedCmd, resolvedSub);
         return result;
     }
-    parseFlag(args, index, aliases, booleanFlags) {
+    parseFlag(args, index, aliases, booleanFlags, stringFlags) {
         const flags = { _: [] };
         const arg = args[index];
         let nextIndex = index + 1;
@@ -242,7 +262,8 @@ export class CommandParser {
                 // --flag=value
                 const key = arg.slice(2, equalIndex);
                 const value = arg.slice(equalIndex + 1);
-                flags[this.normalizeKey(key)] = this.parseValue(value);
+                const normalizedKey = this.normalizeKey(key);
+                flags[normalizedKey] = stringFlags.has(normalizedKey) ? value : this.parseValue(value);
             }
             else if (arg.startsWith('--no-')) {
                 // --no-flag (boolean negation)
@@ -266,7 +287,7 @@ export class CommandParser {
                     }
                 }
                 else if (nextIndex < args.length && this.isFlagValue(args[nextIndex])) {
-                    flags[normalizedKey] = this.parseValue(args[nextIndex]);
+                    flags[normalizedKey] = stringFlags.has(normalizedKey) ? args[nextIndex] : this.parseValue(args[nextIndex]);
                     nextIndex++;
                 }
                 else {
@@ -293,7 +314,7 @@ export class CommandParser {
                     }
                 }
                 else if (nextIndex < args.length && this.isFlagValue(args[nextIndex])) {
-                    flags[normalizedKey] = this.parseValue(args[nextIndex]);
+                    flags[normalizedKey] = stringFlags.has(normalizedKey) ? args[nextIndex] : this.parseValue(args[nextIndex]);
                     nextIndex++;
                 }
                 else {
@@ -439,6 +460,36 @@ export class CommandParser {
         }
         return flags;
     }
+    /** Resolve declared types from broad to narrow without borrowing string
+     * declarations from unrelated registered commands. */
+    getFlagScope(commands) {
+        const aliases = this.buildScopedAliases(commands[commands.length - 1]);
+        const booleanFlags = this.getScopedBooleanFlags(commands[commands.length - 1]);
+        const stringFlags = new Set((this.options.stringFlags ?? []).map(flag => this.normalizeKey(flag)));
+        for (const command of commands) {
+            for (const option of command.options ?? []) {
+                if (option.short)
+                    aliases[option.short] = option.name;
+            }
+        }
+        const layers = [this.globalOptions, ...commands.map(command => command.options ?? [])];
+        for (const options of layers) {
+            for (const option of options) {
+                const key = this.normalizeKey(option.name);
+                if (option.type === 'string')
+                    stringFlags.add(key);
+                else if (option.type)
+                    stringFlags.delete(key);
+                if (option.type === 'boolean')
+                    booleanFlags.add(key);
+                else if (option.type)
+                    booleanFlags.delete(key);
+            }
+        }
+        for (const flag of stringFlags)
+            booleanFlags.delete(flag);
+        return { aliases, booleanFlags, stringFlags };
+    }
     getBooleanFlags() {
         const flags = new Set();
         for (const opt of this.globalOptions) {

package/dist/src/production/monitoring.d.ts

@@ -147,6 +147,8 @@ export declare class MonitoringHooks {
      */
     reset(): void;
     private checkAlerts;
+    /** Drop metrics older than retentionMs (also applied on reads, #3855). */
+    private expireMetrics;
     private cleanupMetrics;
 }
 /**

package/dist/src/production/monitoring.js

@@ -243,6 +243,7 @@ export class MonitoringHooks {
      * Get metrics for a specific name
      */
     getMetrics(name, since) {
+        this.expireMetrics();
         let filtered = this.metrics.filter(m => m.name === name);
         if (since) {
             filtered = filtered.filter(m => m.timestamp >= since);
@@ -253,6 +254,7 @@ export class MonitoringHooks {
      * Get all metrics summary
      */
     getMetricsSummary() {
+        this.expireMetrics();
         const summary = {};
         for (const metric of this.metrics) {
             if (!summary[metric.name]) {
@@ -320,11 +322,14 @@ export class MonitoringHooks {
             }
         }
     }
+    /** Drop metrics older than retentionMs (also applied on reads, #3855). */
+    expireMetrics() {
+        const cutoff = Date.now() - this.config.retentionMs;
+        this.metrics = this.metrics.filter(m => m.timestamp > cutoff);
+    }
     cleanupMetrics() {
-        const now = Date.now();
-        const cutoff = now - this.config.retentionMs;
         // Remove old metrics
-        this.metrics = this.metrics.filter(m => m.timestamp > cutoff);
+        this.expireMetrics();
         // Limit total metrics
         if (this.metrics.length > this.config.maxMetrics) {
             this.metrics = this.metrics.slice(-this.config.maxMetrics);

package/dist/src/production/rate-limiter.js

@@ -41,12 +41,15 @@ export class RateLimiter {
         const limits = this.getLimits(operation);
         const now = Date.now();
         // Get or create bucket
-        const bucketKey = userId && this.config.perUserLimits
+        const trackedUser = userId && this.config.perUserLimits ? userId : undefined;
+        const bucketKey = trackedUser
             ? `${operation}:${userId}`
             : `global:${operation}`;
         let bucket = this.buckets.get(bucketKey);
         if (!bucket) {
             bucket = this.createBucket();
+            bucket.operation = operation;
+            bucket.userId = trackedUser;
             this.buckets.set(bucketKey, bucket);
             this.cleanupBuckets();
         }
@@ -133,10 +136,10 @@ export class RateLimiter {
     getStats() {
         const operationCounts = new Map();
         const users = new Set();
-        for (const [key, bucket] of this.buckets) {
-            const [operation, userId] = key.split(':');
-            if (userId)
-                users.add(userId);
+        for (const bucket of this.buckets.values()) {
+            const operation = bucket.operation;
+            if (bucket.userId)
+                users.add(bucket.userId);
             const current = operationCounts.get(operation) || 0;
             operationCounts.set(operation, current + bucket.requests.length);
         }

package/dist/src/production/retry.js

@@ -54,6 +54,8 @@ function calculateDelay(attempt, config, strategy = 'exponential') {
         const jitterRange = delay * config.jitter;
         delay += (Math.random() - 0.5) * 2 * jitterRange;
     }
+    // Enforce the configured maximum on the final (jittered) delay
+    delay = Math.min(delay, config.maxDelayMs);
     return Math.round(Math.max(0, delay));
 }
 /**
@@ -114,7 +116,7 @@ export async function withRetry(fn, config = {}, strategy = 'exponential') {
             };
         }
         catch (error) {
-            lastError = error;
+            lastError = error instanceof Error ? error : new Error(String(error));
             // Check if we should retry
             if (!shouldRetryError(lastError, attempt, finalConfig)) {
                 return {

package/dist/src/services/bounded-worker-pool.js

@@ -20,6 +20,9 @@ export async function runBoundedPool(tasks, options) {
     const controller = new AbortController();
     const onAbort = () => controller.abort(options.signal?.reason ?? new Error('cancelled'));
     options.signal?.addEventListener('abort', onAbort, { once: true });
+    // Abort events are not replayed for signals cancelled before registration.
+    if (options.signal?.aborted)
+        onAbort();
     const timer = options.timeoutMs && options.timeoutMs > 0
         ? setTimeout(() => controller.abort(new Error('worker-pool-timeout')), options.timeoutMs)
         : undefined;

package/dist/src/services/config-file-manager.d.ts

@@ -3,6 +3,7 @@
  * Shared JSON config file persistence with atomic writes and Zod validation
  */
 export declare class ConfigFileManager {
+    private configCwd;
     private configPath;
     private config;
     /** Find config file in search paths starting from cwd */
@@ -27,6 +28,8 @@ export declare class ConfigFileManager {
     getConfigPath(): string | null;
     /** Get default config */
     getDefaults(): Record<string, unknown>;
+    /** Cached values and file paths belong to one resolved project directory. */
+    private selectProject;
     /** Atomic write: write to .tmp then rename */
     private writeAtomic;
 }

package/dist/src/services/config-file-manager.js

@@ -54,6 +54,7 @@ const DEFAULT_CONFIG = {
     },
 };
 export class ConfigFileManager {
+    configCwd = null;
     configPath = null;
     config = null;
     /** Find config file in search paths starting from cwd */
@@ -73,6 +74,7 @@ export class ConfigFileManager {
     }
     /** Load config from file, returns null if not found */
     load(cwd) {
+        this.selectProject(cwd);
         this.configPath = this.findConfig(cwd);
         if (!this.configPath) {
             this.config = null;
@@ -101,10 +103,11 @@ export class ConfigFileManager {
     }
     /** Get the current config, loading if needed */
     getConfig(cwd) {
+        this.selectProject(cwd);
         if (this.config === null) {
             this.load(cwd);
         }
-        return this.config ?? { ...DEFAULT_CONFIG };
+        return this.config ?? structuredClone(DEFAULT_CONFIG);
     }
     /** Get a nested config value by dot-separated key */
     get(cwd, key) {
@@ -117,6 +120,7 @@ export class ConfigFileManager {
         if (key.split('.').some(part => part === '__proto__' || part === 'constructor' || part === 'prototype')) {
             throw new Error(`Unsafe configuration key: ${key}`);
         }
+        this.selectProject(cwd);
         // A targeted update must not persist unrelated defaults (notably the
         // default memory path, which would relocate an existing memory store).
         const config = this.config ?? this.load(cwd) ?? {};
@@ -137,17 +141,20 @@ export class ConfigFileManager {
         if (fs.existsSync(targetPath) && !force) {
             throw new Error(`Config file already exists: ${targetPath}. Use --force to overwrite.`);
         }
-        const config = { ...DEFAULT_CONFIG, ...overrides };
+        const config = { ...structuredClone(DEFAULT_CONFIG), ...overrides };
         this.writeAtomic(targetPath, config);
+        this.selectProject(cwd);
         this.config = config;
         this.configPath = targetPath;
         return targetPath;
     }
     /** Reset config to defaults */
     reset(cwd) {
-        const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
-        this.writeAtomic(targetPath, DEFAULT_CONFIG);
-        this.config = { ...DEFAULT_CONFIG };
+        this.selectProject(cwd);
+        const targetPath = this.findConfig(cwd) ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
+        const config = structuredClone(DEFAULT_CONFIG);
+        this.writeAtomic(targetPath, config);
+        this.config = config;
         this.configPath = targetPath;
         return targetPath;
     }
@@ -174,7 +181,8 @@ export class ConfigFileManager {
         if (typeof imported !== 'object' || imported === null || Array.isArray(imported)) {
             throw new Error('Import file must contain a JSON object');
         }
-        const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
+        this.selectProject(cwd);
+        const targetPath = this.findConfig(cwd) ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
         this.writeAtomic(targetPath, imported);
         this.config = imported;
         this.configPath = targetPath;
@@ -185,7 +193,16 @@ export class ConfigFileManager {
     }
     /** Get default config */
     getDefaults() {
-        return { ...DEFAULT_CONFIG };
+        return structuredClone(DEFAULT_CONFIG);
+    }
+    /** Cached values and file paths belong to one resolved project directory. */
+    selectProject(cwd) {
+        const resolved = path.resolve(cwd);
+        if (this.configCwd !== resolved) {
+            this.configCwd = resolved;
+            this.config = null;
+            this.configPath = null;
+        }
     }
     /** Atomic write: write to .tmp then rename */
     writeAtomic(filePath, data) {

package/dist/src/services/git-workspace-identity.js

@@ -24,7 +24,7 @@
 import { createHash } from 'crypto';
 import { resolve } from 'path';
 import * as fs from 'fs';
-import { safeGitTextSync } from '@claude-flow/security/safe-git';
+import { safeGitBufferSync, safeGitTextSync } from '@claude-flow/security/safe-git';
 const GIT_TIMEOUT_MS = 3000;
 function git(cwd, ...args) {
     try {
@@ -37,6 +37,23 @@ function git(cwd, ...args) {
         return null;
     }
 }
+/**
+ * Path-valued git output: git terminates the record with a single LF, so strip
+ * only that. A full trim() would corrupt valid paths ending in whitespace.
+ */
+function gitPath(cwd, ...args) {
+    try {
+        const out = safeGitBufferSync(cwd, args, {
+            timeoutMs: GIT_TIMEOUT_MS,
+            stderr: 'ignore',
+        }).toString('utf8');
+        const rec = out.endsWith('\n') ? out.slice(0, -1) : out;
+        return rec.length > 0 ? rec : null;
+    }
+    catch {
+        return null;
+    }
+}
 function sha256(input) {
     return createHash('sha256').update(input).digest('hex');
 }
@@ -50,7 +67,7 @@ export function resolveGitWorkspaceIdentity(dir) {
     const resolved = resolve(dir);
     let stable = identityCache.get(resolved);
     if (!stable) {
-        const worktreeRoot = git(resolved, 'rev-parse', '--show-toplevel');
+        const worktreeRoot = gitPath(resolved, 'rev-parse', '--show-toplevel');
         if (!worktreeRoot) {
             stable = {
                 worktreeRoot: resolved,
@@ -63,7 +80,7 @@ export function resolveGitWorkspaceIdentity(dir) {
         else {
             // --git-common-dir may be relative to the worktree root (git < 2.31
             // and some invocation contexts) — resolve against it.
-            const rawCommon = git(worktreeRoot, 'rev-parse', '--git-common-dir') ?? '.git';
+            const rawCommon = gitPath(worktreeRoot, 'rev-parse', '--git-common-dir') ?? '.git';
             const commonGitDir = resolve(worktreeRoot, rawCommon);
             stable = {
                 worktreeRoot,

package/dist/src/services/policy-ledger-anchor.d.ts

@@ -0,0 +1,42 @@
+import type { PolicyState } from '@claude-flow/security';
+export type AnchorEvent = 'append' | 'migrated-from-state' | 'establish-anchor';
+export interface AnchorEntry {
+    seq: number;
+    length: number;
+    headHash: string | null;
+    prevAnchorHash: string | null;
+    ts: number;
+    event: AnchorEvent;
+    by?: string;
+    hash: string;
+}
+export type AnchorAssessment = {
+    kind: 'absent';
+} | {
+    kind: 'ok';
+    last: AnchorEntry;
+    behind: boolean;
+} | {
+    kind: 'fail';
+    error: string;
+};
+export type AnchorWriter = (file: string, value: unknown) => Promise<void>;
+export declare const anchorLogPath: (projectRoot: string) => string;
+/**
+ * How the stored anchors relate to `state`; read-only. `rebuild` is the
+ * explicit-establish path: an unreadable log or mirror is treated as absent, but
+ * whatever readable anchor remains must still agree with the chain, so it can
+ * never bless a truncation the anchors still remember.
+ */
+export declare function assessAnchors(projectRoot: string, state: PolicyState, rebuild?: boolean): AnchorAssessment;
+/**
+ * Append an entry for the current state if the newest entry does not already
+ * describe it. Must run under the policy lock. Throws if the log is corrupt:
+ * only an explicit establish may replace a corrupt log.
+ */
+export declare function recordAnchor(projectRoot: string, state: PolicyState, write: AnchorWriter, event?: AnchorEvent, by?: string): Promise<void>;
+export declare function anchorPosture(projectRoot: string): {
+    log: boolean;
+    mirror: boolean;
+};
+//# sourceMappingURL=policy-ledger-anchor.d.ts.map