@davesheffer/hunch 1.31.1 → 1.32.1

package/dist/cli/integrations.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerIntegrationCommands(program: Command, refreshGrounding: () => string[]): void;

package/dist/cli/integrations.js

@@ -1,7 +1,7 @@
 import { findRoot } from "../core/paths.js";
 import { CAPABILITIES, HARNESSES, inspectIntegrations, integrationHealthFails, formatIntegrationHealth, repairIntegrationPins } from "../integrations/health.js";
 import { probeIntegration } from "../integrations/probe.js";
-export function registerIntegrationCommands(program) {
+export function registerIntegrationCommands(program, refreshGrounding) {
     const integrations = program.command("integrations").description("Check harness coverage and repair stale repository Hunch pins");
     integrations.command("check")
         .description("Fail on configuration drift; optionally require verified capabilities for CI")
@@ -26,11 +26,14 @@ export function registerIntegrationCommands(program) {
             process.exitCode = 1;
     });
     integrations.command("repair-pins")
-        .description("Align existing exact-version integration pins with package.json; preserves other settings and does not enable hooks")
+        .description("Align existing exact-version pins and refresh existing Hunch instructions; preserves other settings and does not enable hooks")
         .action(() => {
         const root = findRoot();
         const files = repairIntegrationPins(root);
         console.log(files.length ? `Updated ${files.length} integration file(s): ${files.join(", ")}. Reconnect active MCP sessions.` : "Integration pins already aligned.");
+        const grounding = refreshGrounding();
+        if (grounding.length)
+            console.log(`Updated Hunch instructions: ${grounding.join(", ")}. Reconnect the agent to load task reporting instructions.`);
         const report = inspectIntegrations(root);
         console.log(formatIntegrationHealth(report));
         if (integrationHealthFails(report))

package/dist/cli/invocation.d.ts

@@ -0,0 +1,35 @@
+import type { Invocation } from "../integrations/scaffold.js";
+import { type ProviderResolution } from "../synthesis/provider.js";
+export interface ResolvedInvocation {
+    /** Shell command prefix for the git hook (e.g. `node /abs/dist/cli/index.js`). */
+    shell: string;
+    /** Portable shell command prefix for tracked assistant hook configuration. */
+    agentHookShell: string;
+    /** Structured command/args for .mcp.json (subcommand appended by the writer). */
+    mcp: Invocation;
+}
+export declare function dim(s: string): string;
+/** Portable invocation written into committed MCP/provider configuration.
+ * Keep it independently testable so the distribution pin cannot silently
+ * regress to npm's moving latest tag. */
+export declare function publishedMcpInvocation(): Invocation;
+/** Render a structured invocation for the host shell. Safe tokens stay bare so
+ *  PowerShell can execute the first token; paths and other unsafe tokens use
+ *  JSON string quoting, which is accepted by PowerShell, cmd, and POSIX sh. */
+export declare function shellInvocation(inv: Invocation): string;
+/** The doctor command's synthesis-status line(s) for a resolved provider.
+ *  Exported for testing — the previous version (a bare provider-name switch,
+ *  before the resolveSynthesisProvider preference system existed) had zero
+ *  test coverage, which is how issue #8 (openai-compat misreported as "no
+ *  assistant CLI found") shipped unnoticed through three review passes. That
+ *  bug resurfaces here for the same reason: resolution.statuses carries a
+ *  `subscription` field for the CLI providers but openai-compat's is null (it
+ *  isn't a subscription), so it must be special-cased explicitly rather than
+ *  falling through to the "no assistant CLI" branch. */
+export declare function synthesisStatusLines(resolution: ProviderResolution, env: NodeJS.ProcessEnv): string[];
+/** Gate + fetch the Ollama context-window advisory (issue #11): only relevant
+ *  for the openai-compat provider, so every other provider is a no-op. Kept
+ *  separate from synthesisStatusLines (sync, already fully covered) because
+ *  this one makes a best-effort network call. */
+export declare function maybeWarnOllamaContext(providerName: string, env: NodeJS.ProcessEnv): Promise<string | null>;
+export declare function resolveInvocation(): ResolvedInvocation;

package/dist/cli/preflight.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/reviewMemory.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { Constraint } from "../core/types.js";
+import { type ReviewMemoryContext } from "./automaticReviewMemory.js";
+export declare function registerReviewMemoryCommands(program: Command, capture: (records: Constraint[], repository: string, privateOnly: boolean) => void, context: (repository: string, privateOnly?: boolean) => ReviewMemoryContext): void;

package/dist/cli/reviewMemoryProvider.d.ts

@@ -0,0 +1,14 @@
+import { type AgentCliWorker } from "../synthesis/cliAdapter.js";
+/** Origin is invocation metadata, never whichever executables happen to be installed. */
+export declare function reviewInitiator(explicit?: string, env?: NodeJS.ProcessEnv): string;
+/** One origin-bound provider. Never fail over into another agent's account. */
+export declare function boundReviewGenerator(worker: AgentCliWorker): {
+    name: string;
+    providersUsed: () => string[];
+    draftProse(prompt: string): Promise<string>;
+};
+export declare function chooseReviewGenerator(root: string, configFile?: string, initiator?: string): Promise<{
+    name: string;
+    providersUsed: () => string[];
+    draftProse(prompt: string): Promise<string>;
+}>;

package/dist/cli/serve.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerServeCommands(program: Command): void;

package/dist/cli/taskReport.d.ts

@@ -0,0 +1,6 @@
+import type { Command } from "commander";
+import type { HunchStore } from "../store/hunchStore.js";
+export declare function registerTaskReportCommands(program: Command, openStore: () => {
+    store: HunchStore;
+    root: string;
+}): void;

package/dist/cli/taskReport.js

@@ -0,0 +1,128 @@
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { findRoot } from "../core/paths.js";
+import { writeFileAtomic } from "../core/io.js";
+import { finishReportTask, forgetReportTask, listReportTasks, pruneReportHistory, readTaskReport, readLessonHistory, startReportTask } from "../core/taskReport.js";
+import { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
+import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.js";
+import { assertReportPath } from "../core/taskReportPaths.js";
+import { publicTaskReport } from "../core/taskReportPublic.js";
+export function registerTaskReportCommands(program, openStore) {
+    const task = program.command("task").description("Record an explicit task lifecycle for Hunch contribution reports");
+    task.command("start <title>").option("--id <id>", "retry an exact existing task identity")
+        .action((title, opts) => console.log(JSON.stringify(startReportTask(findRoot(), title, opts.id), null, 2)));
+    task.command("conform <id>").description("Evaluate each delivered lesson's declared rule against the changed files; Hunch computes the verdict, never the agent")
+        .action((id) => {
+        const { store, root } = openStore();
+        try {
+            console.log(JSON.stringify(runReportConformance(root, store, id), null, 2));
+        }
+        finally {
+            store.close();
+        }
+    });
+    task.command("finish <id>").option("--interrupted", "record interruption instead of completion")
+        .action((id, opts) => {
+        const root = findRoot();
+        // Rule evaluation is Hunch's own observation; its failure is disclosed by
+        // the report's unknowns and never blocks closing the task.
+        if (!opts.interrupted) {
+            try {
+                const opened = openStore();
+                try {
+                    runReportConformance(opened.root, opened.store, id);
+                }
+                finally {
+                    opened.store.close();
+                }
+            }
+            catch { /* disclosed as unverified */ }
+        }
+        finishReportTask(root, id, opts.interrupted ? "interrupted" : "completed");
+        console.log(renderTaskReport(readTaskReport(root, id, reportSourceSnapshot(root).hash)));
+    });
+    task.command("forget <id>").description("Delete this closed task's local observations and generated report; retains project memory")
+        .action((id) => { forgetReportTask(findRoot(), id); console.log("Task report history removed; project memory retained."); });
+    task.command("prune").description("Delete local report history for tasks closed more than the retention period ago")
+        .option("--days <days>", "retention period in days", "90")
+        .action((opts) => console.log(`Removed ${pruneReportHistory(findRoot(), Number(opts.days))} expired task report(s).`));
+    task.command("presentation <mode>").description("Enable or disable automatic contribution cards; observations and memory remain available")
+        .action((mode) => {
+        if (mode !== "on" && mode !== "off")
+            throw new Error("presentation must be on or off");
+        const root = findRoot(), directory = assertReportPath(root, ".hunch"), file = assertReportPath(root, ".hunch", "local.json");
+        const existing = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+        if (!existing || typeof existing !== "object" || Array.isArray(existing))
+            throw new Error("local.json must be an object; refusing to replace it");
+        mkdirSync(directory, { recursive: true });
+        writeFileAtomic(file, JSON.stringify({ ...existing, reportPresentation: mode === "on" }, null, 2) + "\n");
+        console.log(`Automatic contribution cards ${mode}; task evidence remains available with hunch report.`);
+    });
+    task.command("verify <id> <command...>").description("Explicitly run a verification command and retain its result/hash, never raw output; use -- before the command")
+        .option("--label <label>", "short name of the check", "Verification command")
+        .option("--timeout <seconds>", `seconds before the command tree is stopped and recorded as timed out (max ${MAX_CHECK_TIMEOUT_MS / 1000})`, String(DEFAULT_CHECK_TIMEOUT_MS / 1000))
+        .option("--json", "emit only the result JSON, suppressing live command output")
+        .action(async (id, command, opts) => {
+        const seconds = Number(opts.timeout);
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds * 1000 > MAX_CHECK_TIMEOUT_MS)
+            throw new Error(`--timeout must be a whole number of seconds between 1 and ${MAX_CHECK_TIMEOUT_MS / 1000}`);
+        const controller = new AbortController();
+        let signalExit = 0;
+        const interrupt = () => { signalExit = 130; controller.abort(); };
+        const terminate = () => { signalExit = 143; controller.abort(); };
+        process.on("SIGINT", interrupt);
+        process.on("SIGTERM", terminate);
+        try {
+            const result = await runReportCheck(findRoot(), id, command, opts.label, seconds * 1000, {
+                signal: controller.signal,
+                onStdout: opts.json ? undefined : chunk => { process.stdout.write(chunk); },
+                onStderr: opts.json ? undefined : chunk => { process.stderr.write(chunk); },
+            });
+            console.log(JSON.stringify(result, null, 2));
+            if (signalExit || result.exit_code !== 0 || result.timed_out || result.cancelled)
+                process.exitCode = signalExit || 1;
+        }
+        finally {
+            process.removeListener("SIGINT", interrupt);
+            process.removeListener("SIGTERM", terminate);
+        }
+    });
+    program.command("report [id]").description("Inspect task-scoped memory delivery and independently observed command results")
+        .option("--lesson <record-id>", "inspect retained appearances of this exact lesson across tasks")
+        .option("--kind <kind>", "record kind for --lesson, for example constraints or decisions")
+        .option("--revision <hash>", "restrict lesson history to one exact content hash")
+        .option("--before <cursor>", "continue a fully indexed lesson history page")
+        .option("--json", "machine-readable report")
+        .option("--html", "write a self-contained private/local evidence view under .hunch-cache/reports")
+        .option("--public-only", "export only exact revisions present in the public store, omitting task prose and execution details")
+        .action((id, opts) => {
+        const root = findRoot();
+        if (opts.lesson) {
+            if (id || opts.html || opts.publicOnly || !opts.kind)
+                throw new Error("lesson history requires --kind and cannot combine a task ID, --html or --public-only");
+            console.log(JSON.stringify(readLessonHistory(root, { record_id: opts.lesson, kind: opts.kind, content_hash: opts.revision }, { before: opts.before === undefined ? undefined : Number(opts.before) }), null, 2));
+            return;
+        }
+        if (opts.kind || opts.revision || opts.before)
+            throw new Error("--kind, --revision and --before require --lesson");
+        if (opts.json && opts.html)
+            throw new Error("choose --json or --html");
+        if (!id) {
+            if (opts.html || opts.publicOnly)
+                throw new Error("export requires an explicit task ID");
+            const tasks = listReportTasks(root);
+            console.log(opts.json ? JSON.stringify(tasks, null, 2) : tasks.length ? tasks.map(t => `${t.task_id} · ${t.state} · ${t.title.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ")}`).join("\n") : "No task reports yet. Reconnect the agent after updating Hunch; task lifecycle calls create reports.");
+            return;
+        }
+        if (opts.html) {
+            console.log(writeTaskReportHtml(root, id, opts.publicOnly));
+            return;
+        }
+        if (opts.publicOnly) {
+            console.log(JSON.stringify(publicTaskReport(root, id), null, 2));
+            return;
+        }
+        const report = readTaskReport(root, id, reportSourceSnapshot(root).hash);
+        console.log(opts.json ? JSON.stringify(report, null, 2) : renderTaskReport(report));
+    });
+}
+//# sourceMappingURL=taskReport.js.map

package/dist/cli/update.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from "commander";
+type Run = (args: string[], capture?: boolean) => string;
+export interface UpdateOptions {
+    global?: boolean;
+    dryRun?: boolean;
+}
+/** Arguments come only from fixed commands and a validated registry version.
+ * Windows needs the shell to resolve npm.cmd; cwd is never interpolated. */
+export declare function runNpm(root: string, args: string[], capture?: boolean): string;
+/** Fresh child execution is essential: the currently running CLI still has the
+ * old modules loaded after npm replaces its installation. */
+export declare function updateHunch(root: string, opts?: UpdateOptions, run?: Run, log?: (line: string) => void): void;
+export declare function registerUpdateCommand(program: Command): void;
+export {};

package/dist/client/state.d.ts

@@ -0,0 +1,248 @@
+/**
+ * Typed client for nuryel.state/1 over HTTP (`hunch serve`). No dependencies beyond fetch.
+ * Import from `@davesheffer/hunch/state`. The principal is the bearer token's; the request
+ * shapes are the contract's minus `schema` and `principal`.
+ */
+import type { ReadRequest, SubscribeRequest, WriteRequest, ChangeEvent, Scope } from "../core/stateContract.js";
+import type { DeliveryEnvelope } from "../core/delivery.js";
+import type { CaptureRequest, CaptureBatchRequest } from "../core/stateContract.js";
+export type ClientReadRequest = Omit<ReadRequest, "schema" | "principal">;
+export type ClientWriteRequest = Omit<WriteRequest, "schema" | "principal" | "expected_version"> & {
+    expected_version?: string | number | null;
+};
+export type ClientSubscribeRequest = Omit<SubscribeRequest, "schema" | "principal">;
+export interface ClientSubscribeResponse {
+    schema: string;
+    scope: Scope;
+    head_seq: number;
+    events: ChangeEvent[];
+    filtered: boolean;
+}
+export interface StateProblem {
+    type: string;
+    title: string;
+    status: number;
+    detail: string;
+    conflict?: {
+        incumbent_id: string;
+        reason: string;
+    };
+    issues?: string[];
+}
+/** A typed refusal from the server: the problem+json body, with `code` = its title. */
+export declare class StateClientError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly problem: StateProblem;
+    constructor(status: number, code: string, problem: StateProblem);
+}
+export interface StateClientOptions {
+    baseUrl: string;
+    token: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare function createStateClient(opts: StateClientOptions): {
+    capabilities: (scope?: Scope) => Promise<{
+        protocol: string;
+        capabilities: string[];
+        repository: Scope;
+        partitions: Scope["kind"][];
+        principal: {
+            id: string;
+            kind: string;
+            grants: Scope[];
+        };
+    }>;
+    read: (request: ClientReadRequest) => Promise<{
+        schema: "nuryel.state.read/1";
+        receipt_id: string;
+        scope: {
+            kind: "repository" | "organization" | "team" | "user";
+            id: string;
+        };
+        state_of_record: {
+            subject: string;
+            current: {
+                facet: "decisions" | "constraints" | "bugs" | "findings" | "receipts" | "commitments" | "derived" | "entities" | "relationships";
+                id: string;
+                record_hash: string;
+                scope: {
+                    kind: "repository" | "organization" | "team" | "user";
+                    id: string;
+                };
+            }[];
+            in_force: {
+                facet: "decisions" | "constraints" | "bugs" | "findings" | "receipts" | "commitments" | "derived" | "entities" | "relationships";
+                id: string;
+                record_hash: string;
+                scope: {
+                    kind: "repository" | "organization" | "team" | "user";
+                    id: string;
+                };
+            }[];
+            done: {
+                facet: "decisions" | "constraints" | "bugs" | "findings" | "receipts" | "commitments" | "derived" | "entities" | "relationships";
+                id: string;
+                record_hash: string;
+                scope: {
+                    kind: "repository" | "organization" | "team" | "user";
+                    id: string;
+                };
+            }[];
+            depends_on: ({
+                kind: "record";
+                id: string;
+                record_hash: string;
+                scope?: {
+                    kind: "repository" | "organization" | "team" | "user";
+                    id: string;
+                } | undefined;
+            } | {
+                kind: "external";
+                ref: {
+                    system: string;
+                    object_type: string;
+                    object_key: string;
+                    observed_at: string;
+                    version?: string | undefined;
+                    content_hash?: string | undefined;
+                    locator?: string | undefined;
+                };
+            } | {
+                kind: "schema";
+                name: string;
+                fingerprint: string;
+            })[];
+            invalidated_by: string[];
+            observed?: {
+                facet: "decisions" | "constraints" | "bugs" | "findings" | "receipts" | "commitments" | "derived" | "entities" | "relationships";
+                id: string;
+                record_hash: string;
+                scope: {
+                    kind: "repository" | "organization" | "team" | "user";
+                    id: string;
+                };
+            }[] | undefined;
+            observed_truncated?: boolean | undefined;
+            observed_page?: {
+                snapshot_hash: string;
+                total: number;
+                next_cursor: {
+                    snapshot_hash: string;
+                    offset: number;
+                } | null;
+            } | undefined;
+            relationships_truncated?: boolean | undefined;
+        } | null;
+        denied_scopes: {
+            kind: "repository" | "organization" | "team" | "user";
+            id: string;
+        }[];
+        records?: Record<string, Record<string, unknown>> | undefined;
+        scopes?: {
+            kind: "repository" | "organization" | "team" | "user";
+            id: string;
+        }[] | undefined;
+        receipts?: {
+            scope: {
+                kind: "repository" | "organization" | "team" | "user";
+                id: string;
+            };
+            receipt_id: string;
+        }[] | undefined;
+    } & {
+        envelope: DeliveryEnvelope;
+    }>;
+    write: (request: ClientWriteRequest) => Promise<{
+        schema: "nuryel.state.write/1";
+        record_id: string;
+        record_hash: string;
+        durability: "committed" | "pushed" | "local";
+        outcome: "updated" | "superseded" | "created" | "replayed";
+        conflict: {
+            incumbent_id: string;
+            reason: string;
+        } | null;
+        record?: Record<string, unknown> | undefined;
+    }>;
+    capture: (request: Omit<CaptureRequest, "schema" | "principal">) => Promise<{
+        schema: "nuryel.state.write/1";
+        record_id: string;
+        record_hash: string;
+        durability: "committed" | "pushed" | "local";
+        outcome: "updated" | "superseded" | "created" | "replayed";
+        conflict: {
+            incumbent_id: string;
+            reason: string;
+        } | null;
+        record?: Record<string, unknown> | undefined;
+    }>;
+    captureBatch: (request: Omit<CaptureBatchRequest, "schema" | "principal">) => Promise<{
+        schema: "nuryel.state.capture-batch/1";
+        results: ({
+            index: number;
+            status: "saved";
+            result: {
+                schema: "nuryel.state.write/1";
+                record_id: string;
+                record_hash: string;
+                durability: "committed" | "pushed" | "local";
+                outcome: "updated" | "superseded" | "created" | "replayed";
+                conflict: {
+                    incumbent_id: string;
+                    reason: string;
+                } | null;
+                record?: Record<string, unknown> | undefined;
+            };
+        } | {
+            index: number;
+            status: "refused";
+            code: string;
+            message: string;
+        })[];
+        reviews?: ({
+            index: number;
+            status: "saved";
+            result: {
+                schema: "nuryel.state.write/1";
+                record_id: string;
+                record_hash: string;
+                durability: "committed" | "pushed" | "local";
+                outcome: "updated" | "superseded" | "created" | "replayed";
+                conflict: {
+                    incumbent_id: string;
+                    reason: string;
+                } | null;
+                record?: Record<string, unknown> | undefined;
+            };
+        } | {
+            index: number;
+            status: "refused";
+            code: string;
+            message: string;
+        })[] | undefined;
+    }>;
+    subscribe: (request: ClientSubscribeRequest) => Promise<ClientSubscribeResponse>;
+    records: (request: {
+        scope: Scope;
+        ids: string[];
+    }) => Promise<{
+        schema: "nuryel.state.records/1";
+        scope: {
+            kind: "repository" | "organization" | "team" | "user";
+            id: string;
+        };
+        records: Record<string, Record<string, unknown>>;
+        facets: Record<string, "decisions" | "constraints" | "bugs" | "findings" | "receipts" | "commitments" | "derived" | "entities" | "relationships">;
+        missing: string[];
+        denied: string[];
+    }>;
+    health: () => Promise<{
+        ok: boolean;
+        version: string;
+        protocol: string;
+        partitions: string[];
+    }>;
+};
+export type StateClient = ReturnType<typeof createStateClient>;

package/dist/constitution/adapters.d.ts

@@ -0,0 +1,29 @@
+import type { Constraint } from "../core/types.js";
+import type { HunchStore } from "../store/hunchStore.js";
+import type { PolicyRepository } from "./repository.js";
+import { type DataClass, type EvidenceEvent } from "./schema.js";
+export interface LocalEvidenceOptions {
+    since?: string;
+    maxEvents?: number;
+    publicOnly?: boolean;
+    privateOnly?: boolean;
+    instructions?: boolean;
+    importFiles?: string[];
+    now?: string;
+}
+export interface LocalEvidenceReport {
+    scanned: number;
+    eligible: number;
+    normalized: number;
+    existing: number;
+    covered: number;
+    uncompilable: number;
+    excluded: number;
+    events: EvidenceEvent[];
+}
+/** Canonical evidence projection for one captured correction. Materializers may
+ * reuse this projection, but ingestion itself remains evidence-only. */
+export declare function correctionEvidenceEvent(root: string, constraint: Constraint, dataClass: DataClass): EvidenceEvent | null;
+/** Normalize existing local Hunch truth into Constitution EvidenceEvents. This
+ * adapter never synthesizes intent and never creates or activates a policy. */
+export declare function ingestLocalEvidence(store: HunchStore, root: string, repository: PolicyRepository, opts?: LocalEvidenceOptions): LocalEvidenceReport;

package/dist/constitution/behaviorAttestationBinding.d.ts

@@ -0,0 +1,3 @@
+import type { G2BehaviorAttestation } from "./g2BehaviorAttestation.js";
+import type { PolicySpec } from "./schema.js";
+export declare function executableBehaviorAttestationError(policy: PolicySpec, currentAttestations: G2BehaviorAttestation[]): string | null;

package/dist/constitution/behaviorEvaluator.d.ts

@@ -0,0 +1,8 @@
+import { type PolicyEvaluation, type PolicySpec } from "./schema.js";
+import { type BehaviorWorkspaceKind } from "./behaviorWorkspace.js";
+export interface BehaviorEvaluationOptions {
+    commit?: string;
+    selectedName?: string;
+    workspace?: BehaviorWorkspaceKind;
+}
+export declare function evaluateExecutableBehaviorPolicy(root: string, policy: PolicySpec, opts?: BehaviorEvaluationOptions): PolicyEvaluation;

package/dist/constitution/behaviorProof.d.ts

@@ -0,0 +1,9 @@
+import type { PolicyRepository } from "./repository.js";
+import { type PolicyProof, type PolicySpec, type ProofPlan } from "./schema.js";
+export declare function createExecutableBehaviorProofPlan(root: string, repository: PolicyRepository, policy: PolicySpec, opts?: {
+    now?: string;
+    privateOnly?: boolean;
+}): ProofPlan;
+export declare function proveExecutableBehaviorPolicy(root: string, policy: PolicySpec, plan: ProofPlan, opts?: {
+    now?: string;
+}): PolicyProof;

package/dist/constitution/behaviorWorkspace.d.ts

@@ -0,0 +1,25 @@
+export type BehaviorWorkspaceKind = "staged" | "working";
+export interface BehaviorWorkspaceMetadata {
+    kind: BehaviorWorkspaceKind;
+    base_commit: string;
+    snapshot_hash: string;
+    files: string[];
+}
+interface UntrackedFile {
+    file: string;
+    content_hash: string;
+    mode: number;
+    content: Buffer;
+}
+export interface BehaviorWorkspaceSnapshot {
+    metadata: BehaviorWorkspaceMetadata;
+    patch: Buffer;
+    untracked: UntrackedFile[];
+}
+export declare class BehaviorWorkspaceError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function captureBehaviorWorkspace(root: string, baseCommit: string, kind: BehaviorWorkspaceKind, env: NodeJS.ProcessEnv): BehaviorWorkspaceSnapshot;
+export declare function applyBehaviorWorkspace(root: string, checkout: string, snapshot: BehaviorWorkspaceSnapshot, env: NodeJS.ProcessEnv): void;
+export {};

package/dist/constitution/bootstrap.d.ts

@@ -0,0 +1,30 @@
+import type { HunchStore } from "../store/hunchStore.js";
+import type { PolicyRepository } from "./repository.js";
+import { type EvidenceEvent, type PolicySpec } from "./schema.js";
+export interface BootstrapCandidate {
+    evidence: EvidenceEvent;
+    policy: PolicySpec;
+}
+export interface BootstrapReport {
+    scanned: number;
+    eligible: number;
+    compiled: BootstrapCandidate[];
+    covered: number;
+    deferred: number;
+    uncompilable: number;
+    conflicted: number;
+}
+export interface BootstrapOptions {
+    since?: string;
+    maxCandidates?: number;
+    publicOnly?: boolean;
+    privateOnly?: boolean;
+    history?: boolean;
+    now?: string;
+}
+export declare function clampCandidateLimit(value: number | undefined): number;
+export declare function durationCutoff(since: string, now: string): number;
+/** Model-free Phase-2A bootstrap. It accepts only explicit structured evidence,
+ * creates an auditable event, compiles at most three new candidates, and never
+ * changes lifecycle authority. */
+export declare function bootstrapPolicies(store: HunchStore, root: string, repository: PolicyRepository, opts?: BootstrapOptions): BootstrapReport;

package/dist/constitution/canonical.d.ts

@@ -0,0 +1,15 @@
+import type { PolicyEvaluation, PolicySpec, ProofPlan } from "./schema.js";
+/** Stable, whitespace-free JSON for hashes and cross-client receipts. Arrays retain
+ * semantic order; object keys are recursively sorted. */
+export declare function canonicalJson(value: unknown): string;
+export declare function canonicalHash(value: unknown): string;
+/** Proofs bind evaluator semantics, not mutable lifecycle fields such as approval,
+ * severity, timestamps, or state. */
+export declare function policySemanticHash(policy: PolicySpec): string;
+export declare function proofPlanContentHash(plan: ProofPlan): string;
+/** A proof rerun is bound to policy semantics, not a mutable lifecycle revision.
+ * Live gate receipts keep policy_revision in their own deterministic hash; this
+ * projection is only for immutable proof/replay evidence. */
+export declare function proofEvaluationHash(evaluation: PolicyEvaluation): string;
+export declare function policyId(seed: unknown): string;
+export declare function proofId(seed: unknown): string;