@oortmem/core 0.2.0 → 0.3.0

package/dist/export-format.js

@@ -0,0 +1,168 @@
+/**
+ * The Oort export format (docs/export-format.md): JSON Lines, a manifest line,
+ * then one memory per line. Version 2 (written by default) adds `address`,
+ * `author` and `provenance` to every line and keeps `scope` on Planet
+ * memories; version 1 has `scope` only and can hold Planet memories only.
+ * Readers accept both, version 1 forever.
+ */
+import { addressOf, authorOf, canonicalMemory, planetOf, resolveAddressing, scopeOf, } from './address.js';
+/** The version `oort export` writes. */
+export const EXPORT_FORMAT_VERSION = 2;
+/** Raised for a memory a format version cannot hold, or a file that is not a readable export. */
+export class ExportFormatError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ExportFormatError';
+    }
+}
+const base64 = (v) => Buffer.from(v.buffer, v.byteOffset, v.byteLength).toString('base64');
+/** True when version 1 can hold `m`: a Planet memory whose author is its scope's agent. */
+export function fitsVersion1(m) {
+    const author = authorOf(m);
+    return (addressOf(m).level === 'user' &&
+        author.accountRef === undefined &&
+        author.agentId === m.scope.agentId &&
+        (m.provenance === undefined || m.provenance === null));
+}
+/**
+ * One memory as an export line of `version`: the embedding as base64 of its
+ * int8 bytes. Version 2 always writes `address`, `author` and `provenance`
+ * (null when none), and `scope` for Planet memories only.
+ */
+export function exportLine(m, version) {
+    const { embedding, address: _a, author: _w, provenance, scope, id, ...rest } = m;
+    const tail = embedding === undefined ? {} : { embedding: base64(embedding) };
+    if (version === 1) {
+        if (!fitsVersion1(m)) {
+            throw new ExportFormatError(`memory ${id} is not a Planet memory; version 1 cannot hold it`);
+        }
+        return { id, scope, ...rest, ...tail };
+    }
+    const address = addressOf(m);
+    return {
+        id,
+        ...(address.level === 'user' && { scope }),
+        address,
+        author: authorOf(m),
+        provenance: provenance ?? null,
+        ...rest,
+        ...tail,
+    };
+}
+const keyOf = (x) => JSON.stringify(Object.entries(x).sort());
+/** The manifest for `memories` written as `version`. */
+export function exportManifest(memories, version, exportedAt = new Date()) {
+    const scopes = new Map();
+    const addresses = new Map();
+    for (const m of memories) {
+        const a = addressOf(m);
+        if (a.level === 'user')
+            scopes.set(keyOf(m.scope), m.scope);
+        addresses.set(keyOf(a), a);
+    }
+    const base = {
+        oort: 'export',
+        exportedAt: exportedAt.toISOString(),
+        memories: memories.length,
+        scopes: [...scopes.values()],
+    };
+    return version === 1
+        ? { ...base, version: 1 }
+        : { ...base, version: 2, addresses: [...addresses.values()] };
+}
+/** A whole export: the manifest line, then one line per memory, each ending in `\n`. */
+export function formatExport(memories, version = EXPORT_FORMAT_VERSION, exportedAt = new Date()) {
+    return [
+        exportManifest(memories, version, exportedAt),
+        ...memories.map((m) => exportLine(m, version)),
+    ]
+        .map((x) => `${JSON.stringify(x)}\n`)
+        .join('');
+}
+/**
+ * Reads an export of version 1 or 2. A version 1 line's `scope` names the
+ * memory's Planet and its agent the author. Throws `ExportFormatError` for an
+ * unknown version, a count that does not match, or a line that is not a
+ * memory (with its line number, never its content).
+ */
+export function parseExport(text, opts = {}) {
+    const lines = text.split('\n').filter((l) => l.trim() !== '');
+    const head = parseJson(lines[0], 1);
+    if (head?.oort !== 'export')
+        throw new ExportFormatError('line 1 is not an Oort export manifest');
+    if (head.version !== 1 && head.version !== 2) {
+        throw new ExportFormatError(`export version ${String(head.version)} is not supported`);
+    }
+    const version = head.version;
+    if (head.memories !== lines.length - 1) {
+        throw new ExportFormatError(`the manifest counts ${String(head.memories)} memories, the file has ${lines.length - 1}`);
+    }
+    const memories = lines.slice(1).map((l, i) => {
+        const n = i + 2;
+        const raw = parseJson(l, n);
+        if (typeof raw !== 'object' || raw === null || typeof raw['id'] !== 'string') {
+            throw new ExportFormatError(`line ${n} is not a memory`);
+        }
+        try {
+            return readLine(raw, version, opts);
+        }
+        catch (e) {
+            if (e instanceof RangeError || e instanceof TypeError) {
+                throw new ExportFormatError(`line ${n}: ${e.message}`);
+            }
+            throw e;
+        }
+    });
+    return { version, manifest: head, memories };
+}
+function parseJson(line, n) {
+    try {
+        return JSON.parse(line ?? '');
+    }
+    catch {
+        throw new ExportFormatError(`line ${n} is not JSON`);
+    }
+}
+function readLine(raw, version, opts) {
+    const { embedding, address: rawAddress, author: rawAuthor, provenance, scope: rawScope, supersedesHidden: _sh, supersededByHidden: _bh, ...rest } = raw;
+    let address;
+    let author;
+    if (version === 1) {
+        const scope = rawScope;
+        if (typeof scope !== 'object' || scope === null)
+            throw new RangeError('a version 1 line needs scope');
+        address = planetOf(scope);
+        author = { agentId: scope.agentId };
+    }
+    else {
+        ({ address, author } = checked(rawAddress, rawAuthor, rawScope));
+    }
+    if (opts.planet !== undefined && address.level === 'user') {
+        address = { ...address, orgId: opts.planet.orgId, customerId: opts.planet.customerId };
+    }
+    const m = {
+        ...rest,
+        scope: scopeOf(address, author),
+        address,
+        author,
+        ...(provenance !== undefined && provenance !== null && { provenance }),
+        ...(typeof embedding === 'string' && {
+            embedding: Int8Array.from(Buffer.from(embedding, 'base64')),
+        }),
+    };
+    return canonicalMemory(m);
+}
+/** A version 2 line's address and author, checked, with its scope (when present) matching them. */
+function checked(rawAddress, rawAuthor, rawScope) {
+    if (rawAddress === undefined || rawAuthor === undefined) {
+        throw new RangeError('a version 2 line needs address and author');
+    }
+    const probe = { address: rawAddress, author: rawAuthor };
+    const want = scopeOf(probe.address, probe.author);
+    const { address, author } = resolveAddressing({
+        ...probe,
+        scope: rawScope === undefined ? want : rawScope,
+    });
+    return { address, author };
+}
+//# sourceMappingURL=export-format.js.map

package/dist/grant.d.ts

@@ -1,6 +1,10 @@
+import { type Address, type Author, type NodeRef } from './address.js';
 import type { ScopeFilter } from './adapters.js';
-import type { Scope } from './model.js';
-/** Who a grant acts for: one (org, customer, agent). Grants never span principals. */
+import type { Memory, Scope } from './model.js';
+/**
+ * Who a grant acts for: an account (`orgId`, `customerId`) and the agent
+ * acting for it. Cursors belong to the principal.
+ */
 export interface Principal {
     orgId: string;
     customerId: string;
@@ -11,30 +15,54 @@ export interface Principal {
  * no project) or `'all'`, every project of the principal plus global.
  */
 export type GrantProjects = readonly (string | null)[] | 'all';
-/** One side (read or write) of a grant, as stores apply it. */
+/**
+ * One side (read or write) of a pre-level grant: the principal's Planet,
+ * written by the principal's agent, in `projectIds`.
+ * @deprecated Stores read `Grant.readNodes` and `Grant.writeNodes`.
+ */
 export interface GrantFilter extends Readonly<Principal> {
     readonly projectIds: GrantProjects;
 }
+/**
+ * One node a grant covers (CON-61): the node, the project bindings inside it,
+ * and optionally one author. Matching is structural and exact on every field
+ * (never a prefix). `authorAgentId` restricts the pattern to memories that
+ * agent wrote; the pre-level constructors (`localGrant`, `principalGrant`)
+ * set it to the principal's agent, so they see exactly what they saw before
+ * levels existed.
+ */
+export interface NodePattern {
+    readonly node: NodeRef;
+    readonly projectIds: GrantProjects;
+    readonly authorAgentId?: string;
+}
 /**
  * The permission every `MemoryStore` method takes. Opaque: built only by
- * `localGrant` or `principalGrant`, frozen, and nominal, so a raw
+ * `localGrant`, `principalGrant` or `nodeGrant`, frozen, and nominal, so a raw
  * `ScopeFilter` (or any look-alike object) is rejected by the type checker
  * and, for JavaScript callers, by `assertGrant` inside every store.
  *
- * `read` bounds what can be seen (`get`, `lexical`, `dense`, `list`,
- * `coldGet`, `recordAccess`); `write` bounds what can change (`upsert`,
- * `forget`, `setTier`, `expireMany`, `coldPut`). Cursors belong to the
- * principal. Anything outside a grant behaves exactly like something that
+ * `readNodes` bounds what can be seen (`get`, `lexical`, `dense`, `list`,
+ * `coldGet`, `recordAccess`); `writeNodes` bounds what can change (`upsert`,
+ * `forget`, `setTier`, `expireMany`, `coldPut`). A memory is covered when
+ * any pattern of the side covers its address and author. Cursors belong to
+ * the principal. Anything outside a grant behaves exactly like something that
  * does not exist.
  */
 export declare class Grant {
     #private;
     readonly principal: Readonly<Principal>;
+    /** @deprecated The pre-level view of `readNodes`; see `GrantFilter`. */
     readonly read: GrantFilter;
+    /** @deprecated The pre-level view of `writeNodes`; see `GrantFilter`. */
     readonly write: GrantFilter;
+    readonly readNodes: readonly NodePattern[];
+    readonly writeNodes: readonly NodePattern[];
     private constructor();
     /** @internal Use `localGrant` or `principalGrant`. */
     static issue(principal: Principal, read: GrantProjects, write: GrantProjects): Grant;
+    /** @internal Use `nodeGrant`. */
+    static issueNodes(principal: Principal, read: readonly NodePattern[], write: readonly NodePattern[]): Grant;
     /** True for a real grant (not a copy, not a look-alike). */
     static is(x: unknown): x is Grant;
 }
@@ -48,12 +76,44 @@ export declare function localGrant(read: ScopeFilter, opts?: {
 }): Grant;
 /** Every project of `p` (and its global memories), for read and write: maintenance such as export. */
 export declare function principalGrant(p: Principal): Grant;
+/**
+ * A grant over explicit node patterns, possibly across owners and levels:
+ * `read` bounds what is seen, `write` (default: `read`) what may change.
+ * Trusted: whoever builds one has already decided the principal may use
+ * every node it names (local configuration, or membership checked by a
+ * control plane). Nothing in the engine builds one for its own callers yet:
+ * the CLI, hooks and MCP server keep the pre-level grants.
+ */
+export declare function nodeGrant(opts: {
+    principal: Principal;
+    read: readonly NodePattern[];
+    write?: readonly NodePattern[];
+}): Grant;
 /** Rejects anything that is not a real `Grant`; every store calls it first. */
 export declare function assertGrant(g: unknown): asserts g is Grant;
-/** True iff a memory with `scope` lies inside `f`. Extra scope fields do not widen or narrow it. */
+/**
+ * True iff a memory with `scope` lies inside `f`. Extra scope fields do not widen or narrow it.
+ * @deprecated Use `grantReads` / `grantWrites`.
+ */
 export declare function filterCovers(f: GrantFilter, scope: Scope): boolean;
+/** True iff `p` covers a memory at `address` written by `author`. */
+export declare function patternCovers(p: NodePattern, address: Address, author: Author): boolean;
+/** True iff `g` may read `m` (by its address and author). */
+export declare const grantReads: (g: Grant, m: Pick<Memory, 'scope' | 'address' | 'author'>) => boolean;
+/** True iff `g` may change `m` (by its address and author). */
+export declare const grantWrites: (g: Grant, m: Pick<Memory, 'scope' | 'address' | 'author'>) => boolean;
+/** True iff `g` may read a Planet memory with `scope` (`scope.agentId` as its author). */
 export declare const canRead: (g: Grant, scope: Scope) => boolean;
+/** True iff `g` may change a Planet memory with `scope` (`scope.agentId` as its author). */
 export declare const canWrite: (g: Grant, scope: Scope) => boolean;
+/**
+ * Two records occupy the same place: the same address, the same author and
+ * the same scope (extra scope fields included). A write that would change any
+ * of them for an existing id is refused.
+ */
+export declare function sameRecordAddress(a: Pick<Memory, 'scope' | 'address' | 'author'>, b: Pick<Memory, 'scope' | 'address' | 'author'>): boolean;
+/** The Planet node of a principal: what pre-level grants cover. */
+export declare function planetNode(p: Pick<Principal, 'orgId' | 'customerId'>): NodeRef;
 /**
  * The key a store keeps a cursor under. The local principal (the CLI's own,
  * `local`/`self`/`claude-code`) keeps the bare key, so cursors written before

package/dist/grant.js

@@ -1,33 +1,48 @@
+import { addressOf, assertNode, authorOf, nodeKey, nodeOf, planetOf, sameAddress, sameAuthor, } from './address.js';
 /**
  * The permission every `MemoryStore` method takes. Opaque: built only by
- * `localGrant` or `principalGrant`, frozen, and nominal, so a raw
+ * `localGrant`, `principalGrant` or `nodeGrant`, frozen, and nominal, so a raw
  * `ScopeFilter` (or any look-alike object) is rejected by the type checker
  * and, for JavaScript callers, by `assertGrant` inside every store.
  *
- * `read` bounds what can be seen (`get`, `lexical`, `dense`, `list`,
- * `coldGet`, `recordAccess`); `write` bounds what can change (`upsert`,
- * `forget`, `setTier`, `expireMany`, `coldPut`). Cursors belong to the
- * principal. Anything outside a grant behaves exactly like something that
+ * `readNodes` bounds what can be seen (`get`, `lexical`, `dense`, `list`,
+ * `coldGet`, `recordAccess`); `writeNodes` bounds what can change (`upsert`,
+ * `forget`, `setTier`, `expireMany`, `coldPut`). A memory is covered when
+ * any pattern of the side covers its address and author. Cursors belong to
+ * the principal. Anything outside a grant behaves exactly like something that
  * does not exist.
  */
 export class Grant {
     #issued = true;
     principal;
+    /** @deprecated The pre-level view of `readNodes`; see `GrantFilter`. */
     read;
+    /** @deprecated The pre-level view of `writeNodes`; see `GrantFilter`. */
     write;
-    constructor(principal, read, write) {
+    readNodes;
+    writeNodes;
+    constructor(principal, readNodes, writeNodes) {
         this.principal = Object.freeze({ ...principal });
-        this.read = Object.freeze({ ...principal, projectIds: freezeProjects(read) });
-        this.write = Object.freeze({ ...principal, projectIds: freezeProjects(write) });
+        this.readNodes = Object.freeze(readNodes.map(freezePattern));
+        this.writeNodes = Object.freeze(writeNodes.map(freezePattern));
+        this.read = Object.freeze({
+            ...principal,
+            projectIds: legacyProjects(principal, this.readNodes),
+        });
+        this.write = Object.freeze({
+            ...principal,
+            projectIds: legacyProjects(principal, this.writeNodes),
+        });
         Object.freeze(this);
     }
     /** @internal Use `localGrant` or `principalGrant`. */
     static issue(principal, read, write) {
-        for (const k of ['orgId', 'customerId', 'agentId']) {
-            if (typeof principal[k] !== 'string' || principal[k] === '') {
-                throw new RangeError(`grant: ${k} must be a non-empty string`);
-            }
-        }
+        checkPrincipal(principal);
+        return new Grant(principal, [ownPlanet(principal, read)], [ownPlanet(principal, write)]);
+    }
+    /** @internal Use `nodeGrant`. */
+    static issueNodes(principal, read, write) {
+        checkPrincipal(principal);
         return new Grant(principal, read, write);
     }
     /** True for a real grant (not a copy, not a look-alike). */
@@ -35,6 +50,51 @@ export class Grant {
         return typeof x === 'object' && x !== null && #issued in x;
     }
 }
+function checkPrincipal(principal) {
+    for (const k of ['orgId', 'customerId', 'agentId']) {
+        if (typeof principal[k] !== 'string' || principal[k] === '') {
+            throw new RangeError(`grant: ${k} must be a non-empty string`);
+        }
+    }
+}
+/** The pre-level grant side: the principal's own Planet, written by its own agent. */
+function ownPlanet(p, projectIds) {
+    return {
+        node: { level: 'user', orgId: p.orgId, customerId: p.customerId },
+        projectIds,
+        authorAgentId: p.agentId,
+    };
+}
+function freezePattern(p) {
+    if (typeof p !== 'object' || p === null)
+        throw new TypeError('grant: a node pattern must be an object');
+    assertNode(p.node);
+    const { level: _l, ...rest } = p.node;
+    const node = Object.freeze({ level: p.node.level, ...rest });
+    if (p.authorAgentId !== undefined &&
+        (typeof p.authorAgentId !== 'string' || p.authorAgentId === '')) {
+        throw new RangeError('grant: authorAgentId must be a non-empty string');
+    }
+    return Object.freeze({
+        node,
+        projectIds: freezeProjects(p.projectIds),
+        ...(p.authorAgentId !== undefined && { authorAgentId: p.authorAgentId }),
+    });
+}
+/**
+ * The projects of `patterns` that a pre-level reader may assume: those of
+ * patterns naming exactly the principal's Planet, restricted to its agent.
+ * Never wider than the patterns themselves.
+ */
+function legacyProjects(p, patterns) {
+    const own = nodeKey({ level: 'user', orgId: p.orgId, customerId: p.customerId });
+    const mine = patterns.filter((x) => x.authorAgentId === p.agentId && nodeKey(x.node) === own);
+    if (mine.some((x) => x.projectIds === 'all'))
+        return 'all';
+    return Object.freeze([
+        ...new Set(mine.flatMap((x) => x.projectIds)),
+    ]);
+}
 function freezeProjects(p) {
     if (p === 'all')
         return 'all';
@@ -70,21 +130,70 @@ export function localGrant(read, opts = {}) {
 export function principalGrant(p) {
     return Grant.issue(p, 'all', 'all');
 }
+/**
+ * A grant over explicit node patterns, possibly across owners and levels:
+ * `read` bounds what is seen, `write` (default: `read`) what may change.
+ * Trusted: whoever builds one has already decided the principal may use
+ * every node it names (local configuration, or membership checked by a
+ * control plane). Nothing in the engine builds one for its own callers yet:
+ * the CLI, hooks and MCP server keep the pre-level grants.
+ */
+export function nodeGrant(opts) {
+    if (!Array.isArray(opts.read) || (opts.write !== undefined && !Array.isArray(opts.write))) {
+        throw new TypeError('nodeGrant: read and write must be arrays of node patterns');
+    }
+    return Grant.issueNodes(opts.principal, opts.read, opts.write ?? opts.read);
+}
 /** Rejects anything that is not a real `Grant`; every store calls it first. */
 export function assertGrant(g) {
     if (!Grant.is(g)) {
-        throw new TypeError('MemoryStore methods take a Grant (localGrant or principalGrant)');
+        throw new TypeError('MemoryStore methods take a Grant (localGrant, principalGrant or nodeGrant)');
     }
 }
-/** True iff a memory with `scope` lies inside `f`. Extra scope fields do not widen or narrow it. */
+/**
+ * True iff a memory with `scope` lies inside `f`. Extra scope fields do not widen or narrow it.
+ * @deprecated Use `grantReads` / `grantWrites`.
+ */
 export function filterCovers(f, scope) {
     return (scope.orgId === f.orgId &&
         scope.customerId === f.customerId &&
         scope.agentId === f.agentId &&
         (f.projectIds === 'all' || f.projectIds.includes(scope.projectId ?? null)));
 }
-export const canRead = (g, scope) => filterCovers(g.read, scope);
-export const canWrite = (g, scope) => filterCovers(g.write, scope);
+/** True iff `p` covers a memory at `address` written by `author`. */
+export function patternCovers(p, address, author) {
+    return (nodeKey(nodeOf(address)) === nodeKey(p.node) &&
+        (p.projectIds === 'all' || p.projectIds.includes(address.projectId ?? null)) &&
+        (p.authorAgentId === undefined || p.authorAgentId === author.agentId));
+}
+function covers(patterns, m) {
+    const address = addressOf(m);
+    const author = authorOf(m);
+    return patterns.some((p) => patternCovers(p, address, author));
+}
+/** True iff `g` may read `m` (by its address and author). */
+export const grantReads = (g, m) => covers(g.readNodes, m);
+/** True iff `g` may change `m` (by its address and author). */
+export const grantWrites = (g, m) => covers(g.writeNodes, m);
+/** True iff `g` may read a Planet memory with `scope` (`scope.agentId` as its author). */
+export const canRead = (g, scope) => grantReads(g, { scope });
+/** True iff `g` may change a Planet memory with `scope` (`scope.agentId` as its author). */
+export const canWrite = (g, scope) => grantWrites(g, { scope });
+/**
+ * Two records occupy the same place: the same address, the same author and
+ * the same scope (extra scope fields included). A write that would change any
+ * of them for an existing id is refused.
+ */
+export function sameRecordAddress(a, b) {
+    return (sameAddress(addressOf(a), addressOf(b)) &&
+        sameAuthor(authorOf(a), authorOf(b)) &&
+        sameScope(a.scope, b.scope));
+}
+/** The Planet node of a principal: what pre-level grants cover. */
+export function planetNode(p) {
+    const { projectId: _p, ...node } = planetOf({ ...p, agentId: '-' });
+    return node;
+}
 /**
  * The key a store keeps a cursor under. The local principal (the CLI's own,
  * `local`/`self`/`claude-code`) keeps the bare key, so cursors written before

package/dist/index.d.ts

@@ -1,5 +1,7 @@
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.3.0";
 export * from './model.js';
+export * from './address.js';
+export * from './export-format.js';
 export * from './scope.js';
 export * from './config.js';
 export * from './activation.js';
@@ -14,6 +16,7 @@ export * from './recall.js';
 export * from './relevance.js';
 export * from './observe.js';
 export * from './temporal.js';
+export { chronoLoaded, mayHaveDateCue, preloadChrono } from './date-cue.js';
 export * from './volatile.js';
 export * from './scrub.js';
 export * from './cap.js';

package/dist/index.js

@@ -1,5 +1,7 @@
-export const VERSION = '0.2.0';
+export const VERSION = '0.3.0';
 export * from './model.js';
+export * from './address.js';
+export * from './export-format.js';
 export * from './scope.js';
 export * from './config.js';
 export * from './activation.js';
@@ -14,6 +16,7 @@ export * from './recall.js';
 export * from './relevance.js';
 export * from './observe.js';
 export * from './temporal.js';
+export { chronoLoaded, mayHaveDateCue, preloadChrono } from './date-cue.js';
 export * from './volatile.js';
 export * from './scrub.js';
 export * from './cap.js';

package/dist/isolation.d.ts

@@ -4,6 +4,7 @@
  * can require an empty list and a test can prove a broken store is caught.
  * No vitest here; `store-conformance.ts` wires these into `it` blocks.
  */
+import { type Address, type Author } from './address.js';
 import type { MemoryStore } from './adapters.js';
 import { type Grant } from './grant.js';
 import type { Memory, Scope } from './model.js';
@@ -11,6 +12,12 @@ import type { Memory, Scope } from './model.js';
 export declare function isoMemory(id: string, scope: Scope, marker: string, embedding?: Int8Array): Memory;
 /** The narrowest grant for one scope (its principal and its one project or global). */
 export declare function soleGrant(s: Scope): Grant;
+/** The narrowest grant for one memory at any level: its node, its one project, its author. */
+export declare function soleGrantFor(m: Pick<Memory, 'scope' | 'address' | 'author'>): Grant;
+/** `m` moved to `scope`: its address and author dropped, so the scope's Planet is the address. */
+export declare function movedTo(m: Memory, scope: Scope): Memory;
+/** A memory at `address`, written by `author`, for the isolation checks. */
+export declare function isoAt(id: string, address: Address, author: Author, marker: string, embedding?: Int8Array): Memory;
 /** The scopes the checks use: the caller, and victims that differ from it in one coordinate each. */
 export declare const ISO_SCOPES: {
     mine: {
@@ -49,6 +56,16 @@ export declare const ISO_SCOPES: {
         projectId: string;
     };
 };
+/**
+ * Victims at the other levels, each next to the caller's own Planet: a Planet
+ * memory another of the caller's agents wrote, the caller's agent's own Star,
+ * an Orbit, a Flyby, a Constellation and a Galaxy root of an organisation, and
+ * one of the caller's own owner. A pre-level grant sees none of them.
+ */
+export declare const ISO_LEVELS: Record<string, {
+    address: Address;
+    author: Author;
+}>;
 /**
  * Every `MemoryStore` method, called with a grant for `ISO_SCOPES.mine`
  * against memories (warm and cold) in each other scope: nothing is seen,
@@ -73,5 +90,11 @@ export declare function seededRng(seed: number): {
  * order: SQLite FTS5's bm25 uses table-wide term statistics, so another
  * tenant's text shifts scores (a known side channel; see the PR notes).
  * Every other result is compared exactly, dense scores included.
+ *
+ * `multiNode`: A's grant spans its Planet, its agent's Star and a
+ * Constellation of another owner; B's spans its own Planet and a sibling
+ * Constellation. Same property.
  */
-export declare function nonInterference(make: () => Promise<MemoryStore>, seed: number, steps: number): Promise<string | null>;
+export declare function nonInterference(make: () => Promise<MemoryStore>, seed: number, steps: number, opts?: {
+    multiNode?: boolean;
+}): Promise<string | null>;