@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/lib/lanes/watcher.js

@@ -825,7 +825,7 @@ async function settleManagerStatusGate(hqRoot, lane, manifestTurnId, at, deps, l
         written = false;
     }
     if (written) {
-        return retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+        return updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
             if (current.status_gate?.turn_id !== gate.turn_id || current.status_gate.consecutive_misses === 0)
                 return current;
             return { ...current, status_gate: { ...current.status_gate, consecutive_misses: 0 } };
@@ -837,7 +837,7 @@ async function settleManagerStatusGate(hqRoot, lane, manifestTurnId, at, deps, l
         path: gate.status_path,
         at,
         identified_by: target.identified_by ?? "juniors",
-    }, resumeText);
+    }, resumeText, (current) => followupRunMoved(hqRoot, lane.lane_id, deps, current));
     const miss = updated.status_gate_history?.find((entry) => entry.event === "status_missed" && entry.turn_id === gate.turn_id);
     if (miss) {
         logDecision({
@@ -876,7 +876,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
     if (resolution.stale.length === 0) {
         if (lane.blocker_freshness_state === undefined)
             return lane;
-        return retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => current.blocker_freshness_state === undefined
+        return updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => current.blocker_freshness_state === undefined
             ? current
             : { ...current, blocker_freshness_state: undefined });
     }
@@ -895,7 +895,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             ? findBlockerFreshnessSessionInbox(hqRoot, lane.senior.id)
             : { reason: "The session senior has no session id" }
         : undefined;
-    let updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+    let updated = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
         deliverEscalation = false;
         deliverFallback = false;
         retryUndeliverable = false;
@@ -1014,7 +1014,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
                 kind: "blocker_stale_escalation_undeliverable",
                 text: `${escalationText} The session senior inbox is unavailable (${reason}); this escalation is recorded in the lane inbox for its next turn.`,
             });
-            updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+            updated = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
                 const state = current.blocker_freshness_state;
                 if (state === undefined)
                     return current;
@@ -1037,7 +1037,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             const message = error instanceof Error ? error.message : String(error);
             process.stderr.write(`hq lanes watcher: blocker freshness fallback delivery failed for ${lane.lane_id}: ${message}\n`);
             logDecision({ event: "blocker_stale_escalation_fallback_failed", at, turn_id: turnId, fingerprint, error: message });
-            updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+            updated = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
                 const state = current.blocker_freshness_state;
                 const failureReason = `${undeliverableReason ?? `Session ${lane.senior.id ?? "unknown"} has no monitor-session inbox`}; lane inbox fallback failed: ${message}`;
                 return {
@@ -1080,7 +1080,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             }
             logDecision({ event: "blocker_stale_escalation_delivered", at, turn_id: turnId, senior_kind: lane.senior.kind });
             if (retryUndeliverable) {
-                updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+                updated = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
                     const state = current.blocker_freshness_state;
                     const failedFallbackStillOpen = (current.status_gate_history ?? []).some((entry) => entry.event === "blocker_stale_escalation_undeliverable" &&
                         entry.fingerprint === fingerprint && entry.delivery_failed === true &&
@@ -1104,7 +1104,7 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             const message = error instanceof Error ? error.message : String(error);
             process.stderr.write(`hq lanes watcher: blocker freshness escalation delivery failed for ${lane.lane_id}: ${message}\n`);
             logDecision({ event: "blocker_stale_escalation_delivery_failed", at, turn_id: turnId, error: message });
-            updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+            updated = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
                 const state = current.blocker_freshness_state;
                 if (state?.escalated_fingerprint !== fingerprint)
                     return current;
@@ -1151,7 +1151,7 @@ async function settleKrFreshness(hqRoot, lane, manifestTurnId, at, deps, logDeci
     if (stalled.length === 0) {
         if (lane.kr_freshness_state === undefined)
             return lane;
-        return retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => current.kr_freshness_state === undefined
+        return updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => current.kr_freshness_state === undefined
             ? current
             : { ...current, kr_freshness_state: undefined });
     }
@@ -1159,7 +1159,7 @@ async function settleKrFreshness(hqRoot, lane, manifestTurnId, at, deps, logDeci
     const names = stalled.map((kpi) => kpi.name);
     const turnId = manifestTurnId ?? lane.status_gate?.turn_id ?? `unknown-${at}`;
     const resumeText = `These KPIs in ${resolution.statusPath} were not re-measured in the last ${resolution.windowHours}h: ${names.join(", ")}. Measure each one now, update value and measured_at, then end the turn.`;
-    return retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+    return updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
         const history = current.status_gate_history ?? [];
         if (history.some((entry) => entry.event === "kr_stalled" && entry.turn_id === turnId))
             return current;
@@ -1297,6 +1297,38 @@ function defaultSleep(ms) {
     });
 }
 const WATCHER_LOOP_OWNER_FILE = "watcher-loop.pid";
+/** Run identity (spawn manifest envelope path) of the current claimant. */
+const WATCHER_LOOP_RUN_FILE = "watcher-loop.run";
+/** How long a new phase watcher waits for an older phase's watcher to let go. */
+export const WATCHER_CLAIM_WAIT_MS = 60_000;
+const WATCHER_CLAIM_RETRY_MS = 250;
+/** Identifies one worker run of a lane; changes on every resume. */
+function watcherRunId(runDir) {
+    try {
+        return readSpawnManifest(runDir).envelope_path ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+/** True when the lane has moved on to a run this watcher does not own. */
+function followupRunMoved(hqRoot, laneId, deps, current) {
+    if (deps.followupRun === undefined)
+        return false;
+    return current.state === "running" || watcherRunId(laneRunDir(hqRoot, laneId)) !== deps.followupRun;
+}
+/** Watcher lane write that is a no-op once the lane belongs to a newer run. */
+function updateLaneFollowup(hqRoot, laneId, deps, updater) {
+    return retryUpdateLane(hqRoot, laneId, "watcher", (current) => followupRunMoved(hqRoot, laneId, deps, current) ? current : updater(current));
+}
+function readClaimRunId(runDir) {
+    try {
+        return fs.readFileSync(path.join(runDir, WATCHER_LOOP_RUN_FILE), "utf8").trim();
+    }
+    catch {
+        return null;
+    }
+}
 function claimWatcherLoop(hqRoot, laneId, deps) {
     const runDir = laneRunDir(hqRoot, laneId);
     const ownerPath = path.join(runDir, WATCHER_LOOP_OWNER_FILE);
@@ -1310,6 +1342,7 @@ function claimWatcherLoop(hqRoot, laneId, deps) {
         }
         if (existing !== null)
             fs.unlinkSync(ownerPath);
+        fs.writeFileSync(path.join(runDir, WATCHER_LOOP_RUN_FILE), `${watcherRunId(runDir)}\n`, "utf8");
         writePidRecord(ownerPath, {
             pid: process.pid,
             starttime: readStarttime(process.pid) ?? readProcStarttime(process.pid) ?? undefined,
@@ -1319,7 +1352,11 @@ function claimWatcherLoop(hqRoot, laneId, deps) {
     });
     if (owner === null)
         return null;
+    let released = false;
     return () => {
+        if (released)
+            return;
+        released = true;
         withLaneHireLocks(hqRoot, [laneId], () => {
             try {
                 const current = fs.statSync(ownerPath);
@@ -1391,7 +1428,7 @@ async function maybeContinueAfterMissingEnvelopeRepair(hqRoot, lane, envelope, e
     }
     if (!enabled)
         return lane;
-    const queued = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
+    const queued = updateLaneFollowup(hqRoot, lane.lane_id, deps, (current) => {
         if (current.version !== lane.version ||
             (current.state !== "done" && current.state !== "blocked") ||
             current.last_envelope?.ref !== envelopeRef ||
@@ -1421,17 +1458,59 @@ async function maybeContinueAfterMissingEnvelopeRepair(hqRoot, lane, envelope, e
 }
 /** Detached and synchronous classifiers share one process-identity claim. */
 export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
-    const release = claimWatcherLoop(hqRoot, laneId, deps);
-    if (release === null)
-        return;
+    let release = claimWatcherLoop(hqRoot, laneId, deps);
+    if (release === null) {
+        // A live claimant from an older run (e.g. the previous phase's watcher
+        // still finishing its post-terminal mesh call) lets go soon. Wait for it
+        // instead of leaving this run unwatched. A claimant on the same run is a
+        // true duplicate and this watcher exits at once.
+        const sleep = deps.sleep ?? defaultSleep;
+        const now = deps.now ?? (() => Date.now());
+        const runDir = laneRunDir(hqRoot, laneId);
+        const myRun = watcherRunId(runDir);
+        const waitMs = deps.claimWaitMs ?? WATCHER_CLAIM_WAIT_MS;
+        const started = now();
+        let claimantRun = readClaimRunId(runDir);
+        while (release === null && claimantRun !== myRun && now() - started < waitMs) {
+            await sleep(WATCHER_CLAIM_RETRY_MS);
+            release = claimWatcherLoop(hqRoot, laneId, deps);
+            if (release === null)
+                claimantRun = readClaimRunId(runDir);
+        }
+        if (release === null) {
+            let claimantPid = null;
+            try {
+                claimantPid = readPidRecord(path.join(runDir, WATCHER_LOOP_OWNER_FILE))?.pid ?? null;
+            }
+            catch {
+                claimantPid = null;
+            }
+            const record = {
+                event: "watcher_claim_lost",
+                at: new Date(now()).toISOString(),
+                claimant_pid: claimantPid,
+                claimant_run: claimantRun,
+                run: myRun,
+                waited_ms: now() - started,
+            };
+            try {
+                writeWatcherDecision(deps.watcherOutPath ?? watcherOutLogPath(hqRoot, laneId), record, deps.watcherOutMaxBytes ?? WATCHER_OUT_MAX_BYTES);
+            }
+            catch {
+                // Logging is best effort; stderr below still records the loss.
+            }
+            process.stderr.write(`hq lanes watcher: claim lost for ${laneId} to pid ${claimantPid ?? "unknown"}\n`);
+            return;
+        }
+    }
     try {
-        await runWatcherLoopOwned(hqRoot, laneId, deps);
+        await runWatcherLoopOwned(hqRoot, laneId, deps, release);
     }
     finally {
         release();
     }
 }
-async function runWatcherLoopOwned(hqRoot, laneId, deps) {
+async function runWatcherLoopOwned(hqRoot, laneId, deps, releaseClaim = () => { }) {
     const sleep = deps.sleep ?? defaultSleep;
     const now = deps.now ?? (() => Date.now());
     const isAlive = deps.isAlive ?? isPidAlive;
@@ -1459,6 +1538,7 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
     const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
     const storyStatusSuppressions = new Set();
     const meshRequestTimeoutMs = deps.meshRequestTimeoutMs ?? 10_000;
+    const ownRun = watcherRunId(runDir);
     const initialLane = readLaneSoft(hqRoot, laneId);
     if (mesh && initialLane) {
         // Every armed watcher refreshes the server descriptor. This migrates old
@@ -1889,6 +1969,12 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                     state: updated.state,
                     version: updated.version,
                 });
+                // The lane is classified and this watcher stops polling after this
+                // tick. Let go of the single-owner claim before the slow mesh and
+                // follow-up awaits, so a watcher armed for the next phase can claim.
+                if (tick.done)
+                    releaseClaim();
+                const followupDeps = tick.done ? { ...deps, followupRun: ownRun } : deps;
                 // Spec §8 terminal rows: done → lane_done + story review; blocked →
                 // lane_blocked; ask → lane_ask with the queue ids. After the state
                 // write, so a mesh failure can never leave the lane unclassified.
@@ -1914,9 +2000,9 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                     }
                 }
                 if (terminalWrite.changed) {
-                    updated = await settleManagerStatusGate(hqRoot, updated, manifest.turn_id, tick.emit.at, deps, logDecision);
-                    updated = await settleBlockerFreshness(hqRoot, updated, manifest.turn_id, tick.emit.at, deps, mesh, logDecision);
-                    updated = await settleKrFreshness(hqRoot, updated, manifest.turn_id, tick.emit.at, deps, logDecision);
+                    updated = await settleManagerStatusGate(hqRoot, updated, manifest.turn_id, tick.emit.at, followupDeps, logDecision);
+                    updated = await settleBlockerFreshness(hqRoot, updated, manifest.turn_id, tick.emit.at, followupDeps, mesh, logDecision);
+                    updated = await settleKrFreshness(hqRoot, updated, manifest.turn_id, tick.emit.at, followupDeps, logDecision);
                 }
                 const managerStatusFollowupQueued = manifest.turn_id !== undefined &&
                     updated.status_gate_history?.some((entry) => "turn_id" in entry && entry.turn_id === manifest.turn_id &&
@@ -1924,11 +2010,14 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                             (entry.event === "blocker_stale" && entry.resume_queued === true) ||
                             (entry.event === "kr_stalled" && entry.resume_queued === true))) === true;
                 if (terminalWrite.changed && !managerStatusFollowupQueued) {
-                    updated = await maybeContinueAfterMissingEnvelopeRepair(hqRoot, updated, effectiveEnvelope ?? null, latest?.ref, tick.emit.at, deps, logDecision);
+                    updated = await maybeContinueAfterMissingEnvelopeRepair(hqRoot, updated, effectiveEnvelope ?? null, latest?.ref, tick.emit.at, followupDeps, logDecision);
                 }
                 if (terminalWrite.changed && deps.recoverQueuedMessages && !managerStatusFollowupQueued && updated.state !== "queued") {
                     try {
-                        if (dropboxInboxHasMessages(hqRoot, laneId)) {
+                        if (followupRunMoved(hqRoot, laneId, followupDeps, readLane(hqRoot, laneId))) {
+                            logDecision({ event: "message_recovery_skipped", at: tick.emit.at, reason: "newer_run" });
+                        }
+                        else if (dropboxInboxHasMessages(hqRoot, laneId)) {
                             await deps.recoverQueuedMessages(updated);
                             logDecision({
                                 event: "message_recovery",

package/dist/lib/mesh/api.d.ts

@@ -176,6 +176,38 @@ export declare function putProjectView(token: string, companyUid: string, projec
 }): Promise<MeshProjectView>;
 /** Register the project genesis thread and deterministic project channel. */
 export declare function registerMeshProject(token: string, companyUid: string, projectId: string, channelId?: string): Promise<MeshProjectRegistration>;
+export declare const PROJECT_LIFECYCLE_STATUSES: readonly ["active", "completed", "archived"];
+export type MeshProjectLifecycleStatus = (typeof PROJECT_LIFECYCLE_STATUSES)[number];
+/** One row of the server's PROJECT_LIFECYCLE record for a project. */
+export interface MeshProjectLifecycle {
+    projectId: string;
+    status: MeshProjectLifecycleStatus;
+    /** OCC version of the lifecycle row (not the Board version). */
+    version: number;
+    updatedAt: string;
+    updatedBy: string;
+}
+/**
+ * List every lifecycle row for a company (follows the 25-row server pages).
+ * A project with no row has never left `active` and is not listed.
+ */
+export declare function listProjectLifecycles(token: string, companyUid: string): Promise<MeshProjectLifecycle[]>;
+/** The lifecycle row for one project, or null when it has never been changed. */
+export declare function getProjectLifecycle(token: string, companyUid: string, projectId: string): Promise<MeshProjectLifecycle | null>;
+/**
+ * PATCH /v1/work-mesh/projects/{id}/lifecycle. `expectedVersion` is the
+ * current lifecycle row version (0 when the project has no row yet). The
+ * server answers 409 BOARD_NONEMPTY when archiving a Board that still has
+ * stories unless `confirmNonempty` is set, and a plain 409 on a version
+ * mismatch. Nothing is deleted: stories, folder, channel, members and
+ * history stay; the project only leaves the active list and the organize
+ * candidates.
+ */
+export declare function setProjectLifecycle(token: string, companyUid: string, projectId: string, change: {
+    status: MeshProjectLifecycleStatus;
+    expectedVersion: number;
+    confirmNonempty?: boolean;
+}): Promise<MeshProjectLifecycle>;
 export declare function pairDmUidsFromInbox(inbox: unknown): string[];
 export interface WarmCacheResult {
     directory: boolean;

package/dist/lib/mesh/api.js

@@ -515,6 +515,81 @@ export async function registerMeshProject(token, companyUid, projectId, channelI
         channelCreated: result?.channelCreated === true,
     };
 }
+// ---------------------------------------------------------------------------
+// Project lifecycle (active | completed | archived)
+// ---------------------------------------------------------------------------
+export const PROJECT_LIFECYCLE_STATUSES = ["active", "completed", "archived"];
+function lifecycleFromRow(row) {
+    const rec = asRecord(row);
+    const projectId = String(rec?.projectId || "").trim();
+    const status = String(rec?.status || "").trim();
+    const version = Number(rec?.version);
+    if (!projectId || !Number.isSafeInteger(version) || version < 0)
+        return null;
+    if (!PROJECT_LIFECYCLE_STATUSES.includes(status))
+        return null;
+    return {
+        projectId,
+        status: status,
+        version,
+        updatedAt: String(rec?.updatedAt || ""),
+        updatedBy: String(rec?.updatedBy || ""),
+    };
+}
+/**
+ * List every lifecycle row for a company (follows the 25-row server pages).
+ * A project with no row has never left `active` and is not listed.
+ */
+export async function listProjectLifecycles(token, companyUid) {
+    const rows = [];
+    let cursor;
+    // Bounded so a server that keeps returning the same cursor cannot loop forever.
+    for (let page = 0; page < 200; page += 1) {
+        const data = asRecord(await meshJson(token, "/v1/work-mesh/project-lifecycle", {
+            query: { companyUid, ...(cursor ? { cursor } : {}) },
+        }));
+        const projects = Array.isArray(data?.projects) ? data.projects : [];
+        for (const row of projects) {
+            const parsed = lifecycleFromRow(row);
+            if (parsed)
+                rows.push(parsed);
+        }
+        const next = typeof data?.nextCursor === "string" ? data.nextCursor.trim() : "";
+        if (!next || next === cursor)
+            break;
+        cursor = next;
+    }
+    return rows;
+}
+/** The lifecycle row for one project, or null when it has never been changed. */
+export async function getProjectLifecycle(token, companyUid, projectId) {
+    const rows = await listProjectLifecycles(token, companyUid);
+    return rows.find((row) => row.projectId === projectId) ?? null;
+}
+/**
+ * PATCH /v1/work-mesh/projects/{id}/lifecycle. `expectedVersion` is the
+ * current lifecycle row version (0 when the project has no row yet). The
+ * server answers 409 BOARD_NONEMPTY when archiving a Board that still has
+ * stories unless `confirmNonempty` is set, and a plain 409 on a version
+ * mismatch. Nothing is deleted: stories, folder, channel, members and
+ * history stay; the project only leaves the active list and the organize
+ * candidates.
+ */
+export async function setProjectLifecycle(token, companyUid, projectId, change) {
+    const data = await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}/lifecycle`, {
+        method: "PATCH",
+        query: { companyUid },
+        body: {
+            status: change.status,
+            expectedVersion: change.expectedVersion,
+            ...(change.confirmNonempty ? { confirmNonempty: true } : {}),
+        },
+    });
+    const parsed = lifecycleFromRow(data);
+    if (!parsed)
+        throw new Error("Work mesh returned an invalid project lifecycle row");
+    return parsed;
+}
 export function pairDmUidsFromInbox(inbox) {
     const rec = asRecord(inbox);
     const ids = new Set();

package/dist/lib/secret-scan/detect.js

@@ -36,6 +36,8 @@ function allowed(al, c) {
         const lower = c.secret.toLowerCase();
         checks.push(al.stopwords.some((s) => lower.includes(s)));
     }
+    if (al.commits.length)
+        checks.push(c.commit !== undefined && al.commits.includes(c.commit.toLowerCase()));
     if (!checks.length)
         return false;
     return al.condition === "AND" ? checks.every(Boolean) : checks.some(Boolean);
@@ -50,6 +52,10 @@ function lineBounds(text, start, end) {
             offset++;
     return { line: text.slice(from, to), offset };
 }
+/** A repo allowlist applies to this rule (no targetRules means every rule). */
+function repoAllowed(rules, ruleId, c) {
+    return (rules.repo ?? []).some((al) => (!al.targetRules.length || al.targetRules.includes(ruleId)) && allowed(al, c));
+}
 /** True when the global allowlist excludes this path from scanning. */
 export function pathIgnored(file, rules = compiledRules()) {
     return rules.global.paths.some((p) => p.test(file));
@@ -60,6 +66,7 @@ export function scanPath(file, rules = compiledRules()) {
         return [];
     return rules.rules
         .filter((r) => !r.regex && r.path?.test(file))
+        .filter((r) => !repoAllowed(rules, r.id, { file, secret: "", match: "", line: "" }))
         .map((r) => ({ ruleId: r.id, description: r.description, file, line: 1 }));
 }
 export function scanFragment(frag, rules = compiledRules()) {
@@ -103,6 +110,8 @@ export function scanFragment(frag, rules = compiledRules()) {
                 continue;
             if (rule.allowlists.some((al) => allowed(al, cand)))
                 continue;
+            if (repoAllowed(rules, rule.id, cand))
+                continue;
             const lineNo = startLine + offset;
             const key = `${rule.id}:${lineNo}`;
             if (seen.has(key))

package/dist/lib/secret-scan/repo-config.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Repo-level allowlists: `[[allowlists]]` (and the legacy `[allowlist]`) from
+ * the scanned repo's own `.gitleaks.toml`, with gitleaks semantics for
+ * `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules` and
+ * `condition`. They apply on top of the built-in rules and allowlists, to that
+ * repo only. Repo `[[rules]]`, `[extend]` and the rest of the file are ignored:
+ * a repo can allow known false positives, not change what is detected.
+ *
+ * The file is read from git, never the working tree:
+ *   - The staged (index) copy applies only when it is identical to the copy
+ *     already committed at HEAD (or at MERGE_HEAD during a merge). A commit
+ *     that changes the allowlist is scanned with the HEAD allowlist, so
+ *     widening the allowlist and adding the secret cannot happen in one commit.
+ *   - A changed staged copy is still validated, so a broken file fails now.
+ *   - A symlinked .gitleaks.toml is rejected.
+ *
+ * Narrow by construction: every allowlist needs `paths`, each anchored with a
+ * literal prefix (`^golden/...`); `regexes` and `stopwords` need
+ * `condition = "AND"`, so they never reach files outside those paths.
+ *
+ * Fails closed: anything not acceptable is a ScanConfigError, and the scan
+ * exits 2 rather than running with a guess.
+ */
+import { type CompiledAllowlist } from "./rules.js";
+export declare class ScanConfigError extends Error {
+}
+export declare const REPO_CONFIG_FILE = ".gitleaks.toml";
+/**
+ * Length of the literal text right after a leading `^`: letters, digits,
+ * `/ _ - @ ~` and backslash-escaped punctuation. A quantifier on the last
+ * literal makes it optional, so it does not count.
+ */
+export declare function literalPathPrefix(src: string): number;
+/** Validated allowlists from the text of a .gitleaks.toml. */
+export declare function parseRepoAllowlists(text: string, file?: string): CompiledAllowlist[];
+/**
+ * Compiled allowlists for a staged scan of the repo at `repoRoot`, read from
+ * git as described at the top of this file. [] when the repo has none.
+ */
+export declare function loadRepoAllowlists(repoRoot: string): CompiledAllowlist[];
+//# sourceMappingURL=repo-config.d.ts.map