@sema-agent/core 7.19.0 → 7.20.1

package/dist/core/tool-policy.js

@@ -26,19 +26,18 @@ function attestEngineSettlement(d, record, call) {
     ENGINE_SETTLEMENTS.set(d, { settlement, origin: record.origin, toolCallId: call.toolCallId, toolName: call.toolName });
     return d;
 }
-function transferEngineSettlement(from, to) {
-    const v = ENGINE_SETTLEMENTS.get(from);
-    if (v !== undefined)
-        ENGINE_SETTLEMENTS.set(to, v);
-    const c = CLASSIFIER_DENY_CAUSES_SEAT.get(from);
-    if (c !== undefined)
-        CLASSIFIER_DENY_CAUSES_SEAT.set(to, c);
-    const u = ASK_UNRESOLVABLE_CAUSES_SEAT.get(from);
-    if (u !== undefined)
-        ASK_UNRESOLVABLE_CAUSES_SEAT.set(to, u);
+function transferEngineAttestations(from, to) {
+    for (const seat of ENGINE_ATTESTATION_SEATS) {
+        const v = seat.get(from);
+        if (v !== undefined)
+            seat.set(to, v);
+    }
+}
+function hasEngineAttestation(o) {
+    return ENGINE_ATTESTATION_SEATS.some((seat) => seat.has(o));
 }
 export function carryEngineAttestations(from, to) {
-    transferEngineSettlement(from, to);
+    transferEngineAttestations(from, to);
 }
 export function carryPrecedingSettlement(preceding, to) {
     if (ENGINE_SETTLEMENTS.get(to) !== undefined)
@@ -60,6 +59,19 @@ export function classifierDenyCauseOf(d, call) {
         return undefined;
     return v.cause;
 }
+const CLASSIFIER_ROUNDS_SEAT = new WeakMap();
+export function attestClassifierRound(d, round, call) {
+    CLASSIFIER_ROUNDS_SEAT.set(d, { round, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function classifierRoundOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = CLASSIFIER_ROUNDS_SEAT.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return v.round;
+}
 const ASK_UNRESOLVABLE_CAUSES_SEAT = new WeakMap();
 export function attestAskUnresolvableCause(d, cause, call) {
     ASK_UNRESOLVABLE_CAUSES_SEAT.set(d, { cause, toolCallId: call.toolCallId, toolName: call.toolName });
@@ -73,6 +85,7 @@ export function askUnresolvableCauseOf(d, call) {
         return undefined;
     return v.cause;
 }
+const ENGINE_ATTESTATION_SEATS = [ENGINE_SETTLEMENTS, CLASSIFIER_DENY_CAUSES_SEAT, ASK_UNRESOLVABLE_CAUSES_SEAT, CLASSIFIER_ROUNDS_SEAT];
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
         return undefined;
@@ -439,7 +452,8 @@ export function combinePolicies(...policies) {
             let asked;
             let current = req;
             let rewrite;
-            let settledAllow;
+            const records = {};
+            let anyRecord = false;
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
@@ -448,23 +462,23 @@ export function combinePolicies(...policies) {
                 if (d.action === "deny") {
                     const out = rewrite?.updatedInput !== undefined ? { ...d, updatedInput: rewrite.updatedInput } : d;
                     if (out !== d) {
-                        transferEngineSettlement(d, out);
-                    }
-                    if (settledAllow !== undefined && ENGINE_SETTLEMENTS.get(out) === undefined) {
-                        const owned = out === d ? { ...d } : out;
-                        if (owned !== d)
-                            transferEngineSettlement(d, owned);
-                        transferEngineSettlement(settledAllow, owned);
-                        return owned;
+                        transferEngineAttestations(d, out);
                     }
-                    return out;
+                    if (!anyRecord)
+                        return out;
+                    const owned = out === d ? { ...d } : out;
+                    transferEngineAttestations(records, owned);
+                    transferEngineAttestations(d, owned);
+                    return owned;
                 }
                 if (d.updatedInput !== undefined) {
                     current = { ...current, args: d.updatedInput };
                     rewrite = d;
                 }
-                if (d.action === "allow" && ENGINE_SETTLEMENTS.has(d))
-                    settledAllow = d;
+                if (d.action === "allow" && hasEngineAttestation(d)) {
+                    transferEngineAttestations(d, records);
+                    anyRecord = true;
+                }
                 if (d.action === "ask" && (asked === undefined || (d.requiresRealApproval === true && asked.requiresRealApproval !== true))) {
                     asked = d;
                 }
@@ -484,10 +498,10 @@ export function combinePolicies(...policies) {
                 return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
             }
             const allowed = rewrite ?? ALLOW;
-            if (settledAllow === undefined)
+            if (!anyRecord)
                 return allowed;
             const out = { ...allowed };
-            transferEngineSettlement(settledAllow, out);
+            transferEngineAttestations(records, out);
             return out;
         },
     };

package/dist/core/wiring-manifest.d.ts

@@ -24,6 +24,7 @@ import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
 import type { WiringManifestHookEntry } from "./hook-seats.js";
 import type { McpDelivered, McpFailureKind } from "./mcp-failure.js";
+import type { WriteProtectionTargetView } from "./write-protect.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -319,6 +320,33 @@ export interface WiringManifest {
         mounted: boolean;
         lane?: LspLane;
     };
+    /**
+     * EFFECTIVE half only, PRESENT IFF this leg compiled a write-protection judge — a deployment that
+     * replaced the table with `[]` opted the layer out entirely, and reports nothing here rather than a
+     * judge-shaped word about a judge that does not exist (absence = "no judge on this leg", which is a
+     * different fact from either value below, and strictly weaker than both).
+     *
+     * `targetView` is the JUDGE'S OWN word (`WriteProtectionMatcher.targetView`, relayed verbatim), and it
+     * is how an operator tells a hands-less deployment's write floor from a hands-ful one without inspecting
+     * the engine's seats — the same fact `config.write_protection_target_view_absent` announces once per run
+     * when a covered write tool is mounted beside a `"spelling-only"` judge.
+     *
+     * IN the fingerprint below (unlike `tools`/`lsp`/`hooks`): which view the judge got is an ASSEMBLY fact
+     * — it follows the table seat and whether the deployment wired hands at all — so legs of one assembly
+     * agree on it, which is exactly the equality the fingerprint advertises.
+     *
+     * @contract write_protection.target_view_disclosed — WHICH reading of a write's target the leg's
+     * write-protection judge holds is DISCLOSED, never inferred: the judge self-reports one of two words at
+     * its compile (`"target"` — it holds an execution environment and re-judges a table-missing spelling on
+     * its resolved real target; `"spelling-only"` — it holds none, so the spelling is the whole judgment and
+     * an alias onto a protected path is cleared), the leg's wiring manifest relays that word verbatim, and a
+     * `"spelling-only"` judge with a covered write tool mounted also announces
+     * `config.write_protection_target_view_absent` exactly once per run; the disclosure changes no verdict —
+     * the absence law it makes readable is the judge's own and stands unaltered.
+     */
+    writeProtection?: {
+        targetView: WriteProtectionTargetView;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -397,6 +425,9 @@ export interface WiringFacts {
         mounted: boolean;
         lane?: LspLane;
     };
+    /** Effective half only — the compiled write-protection judge's OWN target-view word
+     *  ({@link WiringManifest.writeProtection}); absent ⇒ this leg compiled no judge (an emptied table). */
+    writeProtectionTargetView?: WriteProtectionTargetView;
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -141,6 +141,7 @@ export function deriveWiringManifest(facts) {
         ...(facts.half === "effective" && facts.tools !== undefined ? { tools: facts.tools } : {}),
         ...(facts.half === "effective" && facts.hooks !== undefined && facts.hooks.length > 0 ? { hooks: facts.hooks.map((h) => ({ ...h })) } : {}),
         ...(facts.half === "effective" && facts.lsp !== undefined ? { lsp: { ...facts.lsp } } : {}),
+        ...(facts.half === "effective" && facts.writeProtectionTargetView !== undefined ? { writeProtection: { targetView: facts.writeProtectionTargetView } } : {}),
     };
     if (facts.half === "effective") {
         const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, ...assembly } = manifest;

package/dist/core/write-protect.d.ts

@@ -1,3 +1,5 @@
+import type { ExecutionEnv } from "../internal/harness-types.js";
+import type { PermissionResult } from "./tool-policy.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /**
  * How one table row matches the judged path:
@@ -45,12 +47,58 @@ export declare function foldWriteProtectCase(s: string): string;
  * candidate configuration with the engine's own rules.
  */
 export declare function resolveWriteProtectedTable(entries?: readonly WriteProtectedEntry[]): readonly WriteProtectedRow[];
-/** The compiled judge over one resolved table. Pure and synchronous — literal folded comparisons,
- *  no filesystem access (see the module header for the declared lexical scope). */
+/**
+ * The judge's answer for ONE covered write ({@link WriteProtectionMatcher.judge}):
+ *  · `clear` — no row on either view: the write is not this layer's business;
+ *  · `hit` — a row matched; `via` says which view named it: `"spelling"` (the anchored spelling, no
+ *    filesystem consulted) or `"target"` (the resolved real target, the spelling being innocent);
+ *  · `unresolvable` — the real target could not be resolved (an unfollowable symlink, an errored probe, a
+ *    namespace spelling the tree refuses); `cause` is the canonicalizer's own sentence and the consumer
+ *    REFUSES, an unjudged target never being vouched.
+ */
+export type WriteProtectionVerdict = {
+    readonly kind: "clear";
+} | {
+    readonly kind: "hit";
+    readonly hit: WriteProtectedHit;
+    readonly via: "spelling" | "target";
+} | {
+    readonly kind: "unresolvable";
+    readonly cause: string;
+    readonly unresolvedSymlink: boolean;
+};
+/** What one judgment knows about the call, all optional — every member has an absence reading. */
+export interface WriteProtectionJudgeContext {
+    /** The call's LIVE tracked working directory (see {@link WriteProtectionMatcher.matchPath}). */
+    readonly cwd?: string;
+    /** The base a RELATIVE spelling resolves against on the TARGET view — the tool's own declared base
+     *  ({@link pathTargetBaseOf}). Absent ⇒ `cwd`, then the compile-time `rootPath`, then the environment's
+     *  own working directory: the same fallback chain the write tool itself walks. */
+    readonly base?: string;
+    /** Bounds the filesystem probes of the target view. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * WHICH reading of a write's TARGET a compiled judge has — its own word, and the vocabulary the wiring
+ * manifest discloses it with. `"target"`: the judge holds an execution environment, so a spelling that
+ * misses the table is judged a SECOND time on its resolved real target (an alias, a symlink, a `..` walk
+ * that lands on a protected row is seen). `"spelling-only"`: no environment, so the spelling IS the whole
+ * judgment and a path reaching a row only through an alias is cleared — the module header's absence law,
+ * unchanged by this word, which only makes it READABLE. Never derived by a reader from the judge's seats.
+ */
+export declare const WRITE_PROTECTION_TARGET_VIEWS: readonly ["spelling-only", "target"];
+/** One of {@link WRITE_PROTECTION_TARGET_VIEWS}. */
+export type WriteProtectionTargetView = (typeof WRITE_PROTECTION_TARGET_VIEWS)[number];
+/** The compiled judge over one resolved table. `matchPath` is the SPELLING view alone (literal folded
+ *  comparisons, no filesystem access — the admin preview face); `judge` is the whole judgment (see the
+ *  module header for the two views). */
 export interface WriteProtectionMatcher {
+    /** WHICH reading of a target this judge HAS — minted at compile and read verbatim by everyone who needs
+     *  the fact; a reader re-deriving it from the seats is a second opinion, free to drift. */
+    readonly targetView: WriteProtectionTargetView;
     /** The resolved rows this judge was compiled from (canonical names — the disclosure face). */
     readonly rows: readonly WriteProtectedRow[];
-    /** Judge ONE path spelling. Returns the first matching row (basename rows first, then segment,
+    /** Judge ONE path SPELLING. Returns the first matching row (basename rows first, then segment,
      *  then segment-run — deterministic), or null.
      *
      *  `cwd` = the call's LIVE tracked working directory, read at judgment time off the ONE ref the fs
@@ -58,33 +106,91 @@ export interface WriteProtectionMatcher {
      *  Absent ⇒ judged exactly as given — the historical reading, and the honest answer for a host
      *  that tracks no cwd. */
     matchPath(path: string, cwd?: string): WriteProtectedHit | null;
+    /**
+     * Judge ONE covered write by the file the tool will write: the spelling view first (`matchPath`; a hit
+     * there is the answer and costs no I/O), then — on a miss, and only when the judge was compiled with an
+     * execution environment — the resolved real target through the shared `canonicalizeTarget`.
+     *
+     * @contract write_protection.judges_the_real_target — the always-on write-protection table and the
+     * opt-in sensitive-path deny set differ in VOCABULARY (literal rows / segment globs) and SEVERITY
+     * (ask / deny), never in REACH: both judge the file the tool will write — the spelling anchored at the
+     * live cwd AND its resolved real target, through one canonicalizer — and a target neither can resolve is
+     * refused, never vouched. An environment-less judge has no target view and answers by the spelling alone —
+     * the same absence law the cwd follows (absent ⇒ the spelling is judged exactly as given). REACH is what
+     * this sentence promises, not a LOCK: the identity is resolved at judgment time and re-resolved by the
+     * tool at execute time (the module header states that window and the seat that would close it).
+     */
+    judge(path: string, ctx?: WriteProtectionJudgeContext): Promise<WriteProtectionVerdict>;
+}
+/** Compile-time seats of {@link compileWriteProtection}. Every member is optional and has an absence reading. */
+export interface WriteProtectionCompileOptions {
+    /** The engine data root for the passthrough in the module header (same seat and same meaning as
+     *  `createSensitivePathPolicy`'s): omitted ⇒ the knob its consumers read (`$AGENT_DATA_DIR ?? ~/.ai-agent`). */
+    readonly dataRoot?: string;
+    /** The execution environment the hands write against — the TARGET view resolves in ITS filesystem
+     *  (a remote/sandboxed task resolves in its container). Omitted ⇒ no target view: the spelling is the
+     *  judgment (a host with no hands has no filesystem to resolve against). */
+    readonly env?: ExecutionEnv;
+    /** The task root — the base a `base: "root"` write tool's relative spelling resolves against, and the
+     *  path-family source when the call carries no cwd. Omitted ⇒ relative spellings resolve against the
+     *  cwd, then the environment's own working directory. */
+    readonly rootPath?: string;
 }
 /**
  * Compile the write-protection judge for a deployment configuration. Returns `undefined` when the
  * resolved table is EMPTY (`[]` replacement) — the caller then mounts no tighten at all, keeping an
  * opted-out deployment's decision path byte-identical to a build without this layer.
  *
- * `opts.dataRoot` names the engine data root for the passthrough in the module header (same seat and
- * same meaning as `createSensitivePathPolicy`'s): omitted ⇒ the knob its consumers read
- * (`$AGENT_DATA_DIR ?? ~/.ai-agent`), read ONCE here at compile so the judge stays pure and
- * synchronous. The passthrough is a property of the JUDGE, not of the default table — a deployment
+ * The data-root spellings are read ONCE here at compile (a judge that re-read `process.env` per call
+ * would answer two calls of one run differently); their CANONICAL keys are resolved per judgment, on the
+ * target view only, and only once a row has matched there (see {@link canonicalDataRootKeys} for why they
+ * are never cached). The passthrough is a property of the JUDGE, not of the default table — a deployment
  * that replaces the table wholesale gets the same law over its own rows.
  */
-export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[], opts?: {
-    dataRoot?: string;
-}): WriteProtectionMatcher | undefined;
+export declare function compileWriteProtection(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMatcher | undefined;
+/**
+ * The gate tighten's DECISION for one judgment — the words the fold writes on the pass, minted beside the
+ * verdict they read so the two cannot drift:
+ *  · `hit` ⇒ `ask` (`safety`; no `requiresRealApproval` — one explicit look, clearable by an approver, a
+ *    blanket `onAsk:"allow"`, the classifier or a matching persisted rule). The matched row NAME goes on the
+ *    message (table names are deployment-validated vocabulary); the model-authored target path deliberately
+ *    does not — `message` is the classifier's `askMessage`, and the approval card already shows the args. The
+ *    spelling form's sentence is the historical one byte for byte; the target form says the target RESOLVED.
+ *  · `unresolvable` ⇒ `deny` naming the cause: an unjudged target is never vouched, and an ask would be a
+ *    question about a file nobody can name — the rule the canonicalizing deny set follows for the same reason.
+ *  · `clear` ⇒ `undefined`: the surviving decision stands.
+ */
+export declare function writeProtectionTightenDecision(toolName: string, verdict: WriteProtectionVerdict): PermissionResult | undefined;
+/**
+ * The ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`). Returns `null` SYNCHRONOUSLY when the
+ * call is not this layer's business — not a covered write, or no resolvable target string — and otherwise
+ * the judgment of {@link WriteProtectionMatcher.judge}, a promise. The split is load-bearing for the gate:
+ * a call the judge does not cover must not cost the fold a suspension point.
+ */
+export type WriteProtectionCheck = (toolName: string, args: unknown, face?: ToolCallLike["face"], cwd?: string, signal?: AbortSignal) => Promise<WriteProtectionVerdict> | null;
+/**
+ * ONE leg's write-protection mount: the gate input and the judge's own {@link WriteProtectionTargetView},
+ * handed back together so the two readers of this compile — the gate station that mounts the check and the
+ * disclosure face that reports which reading it got — read ONE compile. `undefined` in place of the whole
+ * record is "no judge" (an emptied table), a different fact from a judge whose target view is absent.
+ */
+export interface WriteProtectionMount {
+    /** The gate input (`ToolGateInput.writeProtectionCheck`). */
+    readonly check: WriteProtectionCheck;
+    /** The compiled judge's own word for the reading it has of a write's target. */
+    readonly targetView: WriteProtectionTargetView;
+}
 /**
  * Build the ENGINE-FILLED gate input (`ToolGateInput.writeProtectionCheck`): covered tools are the
  * path-confinable write set (Write/Edit/NotebookEdit — the shared spelling), the judged target is
  * the SAME string the tool itself will resolve (`writeTargetPath`, the shared single source with
  * the sensitive-path guard and the fs-write gate), and the verdict is the table judge's. A covered
- * write with NO resolvable target returns null here — this layer is ADDITIVE friction on a named
- * set of targets, not a containment boundary (a target-less call cannot land on a named row, and
- * the tool's own schema validation refuses it before any write); the fail-closed treatment of the
- * unresolvable case belongs to the containment gates (fs-write-gate-policy documents that split).
+ * write with NO resolvable target string returns null here — this layer is ADDITIVE friction on a named
+ * set of targets, not a containment boundary (a target-less call cannot land on a named row, and the
+ * tool's own schema validation refuses it before any write); the fail-closed treatment of that case
+ * belongs to the containment gates (fs-write-gate-policy documents that split). A target string the
+ * environment cannot RESOLVE is the judge's own `unresolvable` verdict, not this null.
  * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
- * `opts.dataRoot` is the judge's own seat, passed straight through ({@link compileWriteProtection}).
+ * `opts` are the judge's own seats, passed straight through ({@link compileWriteProtection}).
  */
-export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: {
-    dataRoot?: string;
-}): ((toolName: string, args: unknown, face?: ToolCallLike["face"], cwd?: string) => WriteProtectedHit | null) | undefined;
+export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMount | undefined;

package/dist/core/write-protect.js

@@ -1,6 +1,7 @@
-import { isWinFormPath, writeTargetPath, isUncPath, isAbsoluteForFamily, joinForFamily, pathFamilyOf } from "../tools/fs/safety.js";
-import { isProtectedWrite } from "./tool-registry.js";
-import { dataRootSpellings } from "./sensitive-path-policy.js";
+import { canonicalizeTarget, isWinFormPath, writeTargetPath, isUncPath, isAbsoluteForFamily, joinForFamily, pathFamilyOf } from "../tools/fs/safety.js";
+import { protectivePathTargetOf } from "./tool-registry.js";
+import { pathTargetBaseOf } from "./effective-path-target.js";
+import { canonicalDataRootKeys, dataRootSpellings, relativeUnderRoot } from "./sensitive-path-policy.js";
 const freezeTable = (rows) => Object.freeze(rows.map((r) => Object.freeze(r)));
 export const WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
     { name: ".gitconfig", kind: "basename" },
@@ -155,11 +156,13 @@ function relativeUnderDataRoot(path, roots) {
     }
     return null;
 }
+export const WRITE_PROTECTION_TARGET_VIEWS = ["spelling-only", "target"];
 export function compileWriteProtection(entries, opts) {
     const rows = resolveWriteProtectedTable(entries);
     if (rows.length === 0)
         return undefined;
-    const rootViews = dataRootSpellings(opts?.dataRoot).map((r) => {
+    const dataRootPaths = dataRootSpellings(opts?.dataRoot);
+    const rootViews = dataRootPaths.map((r) => {
         const win = isWinFormPath(r);
         return { win, segments: pathViewSegments(r, false, win ? BOTH_SEPARATOR_FAMILIES : POSIX_SEPARATOR_FAMILY, uncAnchorSegments(r)) };
     });
@@ -180,49 +183,103 @@ export function compileWriteProtection(entries, opts) {
             runs.push({ name: row.name, parts: folded.split("/").filter((s) => s.length > 0) });
         }
     }
+    const judgeSegments = (raw) => {
+        if (raw.length === 0)
+            return null;
+        const segs = raw.map(foldWriteProtectCase);
+        const base = basenames.get(segs[segs.length - 1] ?? "");
+        if (base !== undefined)
+            return { name: base, kind: "basename" };
+        for (const s of segs) {
+            const hit = segments.get(s);
+            if (hit !== undefined)
+                return { name: hit, kind: "segment" };
+        }
+        for (const run of runs) {
+            const n = run.parts.length;
+            for (let i = 0; i + n <= segs.length; i++) {
+                if (run.parts.every((p, j) => segs[i + j] === p))
+                    return { name: run.name, kind: "segment-run" };
+            }
+        }
+        return null;
+    };
+    const judgeViews = (spelling) => judgeSegments(pathViewSegments(spelling, false, POSIX_SEPARATOR_FAMILY, uncAnchorSegments(spelling))) ??
+        judgeSegments(pathViewSegments(spelling, false)) ??
+        judgeSegments(pathViewSegments(spelling, true));
+    const judgeSpelling = (path, cwd) => {
+        const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
+        const family = pathFamilyOf({ cwd: base });
+        const spelled = base !== undefined && family !== undefined && !isAbsoluteForFamily(family, path) ? joinForFamily(family, base, path) : path;
+        return judgeViews(relativeUnderDataRoot(spelled, rootViews) ?? spelled);
+    };
+    const env = opts?.env;
+    const rootPath = opts?.rootPath;
     return {
         rows,
+        targetView: env === undefined ? "spelling-only" : "target",
         matchPath(path, cwd) {
-            const base = typeof cwd === "string" && cwd.length > 0 ? cwd : undefined;
-            const family = pathFamilyOf({ cwd: base });
-            const spelled = base !== undefined && family !== undefined && !isAbsoluteForFamily(family, path) ? joinForFamily(family, base, path) : path;
-            const judged = relativeUnderDataRoot(spelled, rootViews) ?? spelled;
-            const judge = (raw) => {
-                if (raw.length === 0)
-                    return null;
-                const segs = raw.map(foldWriteProtectCase);
-                const base = basenames.get(segs[segs.length - 1] ?? "");
-                if (base !== undefined)
-                    return { name: base, kind: "basename" };
-                for (const s of segs) {
-                    const hit = segments.get(s);
-                    if (hit !== undefined)
-                        return { name: hit, kind: "segment" };
-                }
-                for (const run of runs) {
-                    const n = run.parts.length;
-                    for (let i = 0; i + n <= segs.length; i++) {
-                        if (run.parts.every((p, j) => segs[i + j] === p))
-                            return { name: run.name, kind: "segment-run" };
-                    }
-                }
-                return null;
-            };
-            return judge(pathViewSegments(judged, false)) ?? judge(pathViewSegments(judged, true));
+            return judgeSpelling(path, cwd);
+        },
+        async judge(path, ctx = {}) {
+            const bySpelling = judgeSpelling(path, ctx.cwd);
+            if (bySpelling !== null)
+                return { kind: "hit", hit: bySpelling, via: "spelling" };
+            if (env === undefined)
+                return { kind: "clear" };
+            const canon = await canonicalizeTarget(env, path, ctx.signal, pathFamilyOf({ root: rootPath, cwd: ctx.cwd ?? env.cwd }), ctx.base ?? ctx.cwd ?? rootPath);
+            if (!canon.ok)
+                return { kind: "unresolvable", cause: canon.message, unresolvedSymlink: canon.unresolvedSymlink === true };
+            const byTarget = judgeViews(canon.key);
+            if (byTarget === null)
+                return { kind: "clear" };
+            for (const rootKey of await canonicalDataRootKeys(env, dataRootPaths, ctx.signal)) {
+                const relative = relativeUnderRoot(canon.key, rootKey);
+                if (relative === null)
+                    continue;
+                if (relative === "")
+                    return { kind: "clear" };
+                const remainder = judgeViews(relative);
+                return remainder === null ? { kind: "clear" } : { kind: "hit", hit: remainder, via: "target" };
+            }
+            return { kind: "hit", hit: byTarget, via: "target" };
         },
     };
 }
+export function writeProtectionTightenDecision(toolName, verdict) {
+    if (verdict.kind === "hit") {
+        return {
+            action: "ask",
+            message: verdict.via === "target"
+                ? `tool "${toolName}" writes to a write-protected path — its real target resolves onto table entry "${verdict.hit.name}" — explicit approval required`
+                : `tool "${toolName}" writes to a write-protected path (table entry "${verdict.hit.name}") — explicit approval required`,
+            decisionReason: "safety",
+        };
+    }
+    if (verdict.kind === "unresolvable") {
+        return {
+            action: "deny",
+            message: verdict.unresolvedSymlink
+                ? `tool "${toolName}" is blocked: its target is a symlink whose real target could not be resolved, so the write-protection judge cannot tell whether it lands on a protected path (${verdict.cause})`
+                : `tool "${toolName}" is blocked: its target could not be resolved on this tree, so the write-protection judge cannot tell whether it lands on a protected path (${verdict.cause})`,
+            decisionReason: "safety",
+        };
+    }
+    return undefined;
+}
 export function createWriteProtectionCheck(entries, opts) {
     const matcher = compileWriteProtection(entries, opts);
     if (matcher === undefined)
         return undefined;
-    return (toolName, args, face, cwd) => {
+    const check = (toolName, args, face, cwd, signal) => {
         const call = { toolName, args, ...(face !== undefined ? { face } : {}) };
-        if (!isProtectedWrite(call))
+        const protective = protectivePathTargetOf(call);
+        if (protective === undefined || protective.access === "read")
             return null;
-        const path = writeTargetPath(call);
+        const path = writeTargetPath(call, protective);
         if (typeof path !== "string" || path.length === 0)
             return null;
-        return matcher.matchPath(path, cwd);
+        return matcher.judge(path, { ...(cwd !== undefined ? { cwd } : {}), ...(signal !== undefined ? { signal } : {}), ...(() => { const b = pathTargetBaseOf(protective, { root: opts?.rootPath, cwd }); return b !== undefined ? { base: b } : {}; })() });
     };
+    return { check, targetView: matcher.targetView };
 }

package/dist/index.d.ts

@@ -89,7 +89,7 @@ export { MAX_EXEC_OUTPUT_BYTES, RollingTailBuffer, markTruncated } from "./core/
 export { physicalPathOf, physicalPathOfExisting } from "./core/physical-path.js";
 export type { ExecutionEnv, FileInfo, Result, FileErrorCode, ExecutionErrorCode, WriteExpectation, WriteReceipt } from "./internal/harness.js";
 export type { ExecResult } from "./internal/harness.js";
-export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
+export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable, isIsolated, canonicalPathIsAuthoritative, missingRestoreSurface, isRetryableRemoteErrorCode, RETRYABLE_REMOTE_ERROR_CODES, } from "./core/remote-env.js";
 export { withRetry } from "./core/with-retry.js";
 export type { RetryPolicy, RetryResult } from "./core/with-retry.js";
 export type { RemoteExecutionEnv, WorkspaceHandle, SnapshotId, SessionToken, SandboxTier, OutputChunk, ExecStreamOptions, RemoteConnectConfig, VmLifecycleOptions, SecretRef, RemoteExecutionErrorCode, ExecutionEnvFactory, ExecutionEnvFactoryContext, } from "./core/remote-env.js";
@@ -105,7 +105,7 @@ export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, ty
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
 export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace, type ContainmentFaceInputs, type ContainmentFaceKind, type ContainmentFaceLayer, } from "./tools/fs/index.js";
-export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
+export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
 export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, type ExecutionOutcomeRecordWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
@@ -128,8 +128,8 @@ export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemorySto
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
 export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
-export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS, RECOMMENDED_SENSITIVE_ASK_PATTERNS } from "./core/sensitive-path-policy.js";
-export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
+export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
+export { createFsWriteGatePolicy, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
@@ -179,6 +179,7 @@ export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, classifierParseFailureDenyMessage, AUTO_MODE_PARSE_FAILURES, isAutoModeParseFailure, type AutoModeParseFailure, type AutoModeUnavailableCause, AUTO_MODE_CLASSIFIER_FALLBACKS, isAutoModeClassifierFallback, AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, type AutoModeClassifierFallback, type AutoModeFallbackCause, type AutoModeClassifierRound, type AutoModeLadderRung, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
+export { classifierSeatModel, type ClassifierSeat } from "./core/runner/classifier-ladder.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, type AutoModeArmingRecipe, type AutoModeArmingFace, type AutoModeArmingFold, type AutoModeRebuildRefusal, } from "./core/auto-mode-arming.js";
@@ -216,7 +217,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, } from "./core/hooks.js";
 export { HOOK_FAMILIES, HOOKS_INVALID_CODE, type HookFamily, type WiringManifestHookEntry } from "./core/hook-seats.js";
-export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
+export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";