@sema-agent/core 7.50.1 → 7.51.0

package/dist/core/permission-rule-model.js

@@ -933,17 +933,21 @@ function firstEligibleAdmittingRule(rules, commandText, call) {
     return undefined;
 }
 export function findAdmittingRule(rules, call) {
+    const coverage = commandCoverageOf(rules, call);
+    return "covering" in coverage ? coverage.covering : undefined;
+}
+export function commandCoverageOf(rules, call) {
     const shape = ruleLaneShapeOf(call.command, MATCH_READING);
     if ("reject" in shape)
-        return undefined;
+        return { uncovered: undefined };
     const whole = firstEligibleAdmittingRule(rules, call.command, call);
     if (whole !== undefined)
-        return [whole];
+        return { covering: [whole] };
     const cdDirs = resolveCdSegmentDirectories(shape.segments, call.execCwd ?? call.cwd);
     if (shape.segments.length < 2) {
         const dir = cdDirs[0];
         const lone = dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined;
-        return lone !== undefined ? [lone] : undefined;
+        return lone !== undefined ? { covering: [lone] } : { uncovered: shape.segments[0] ?? call.command };
     }
     const covering = [];
     const lineObjection = readOnlyLineObjection(call.command, call.execCwd ?? call.cwd);
@@ -951,14 +955,14 @@ export function findAdmittingRule(rules, call) {
         const dir = cdDirs[i];
         const first = firstEligibleAdmittingRule(rules, segment, call) ?? (dir !== undefined ? firstEligibleDirectoryRule(rules, dir, call) : undefined);
         if (first === undefined) {
-            if (readsOnlyAsSegment(segment, lineObjection, call.command))
+            if (call.posture !== "narrowing" && readsOnlyAsSegment(segment, lineObjection, call.command))
                 continue;
-            return undefined;
+            return { uncovered: segment };
         }
         if (!covering.includes(first))
             covering.push(first);
     }
-    return covering.length > 0 ? covering : undefined;
+    return covering.length > 0 ? { covering } : { uncovered: undefined };
 }
 function readsOnlyAsSegment(segment, lineObjection, whole) {
     return lineObjection === undefined && !movesShellCursor(segment) && readOnlyShellVerdict(segment, undefined, undefined, () => lineDescriptorsOfText(whole)).readOnly;
@@ -1088,8 +1092,9 @@ export const UNCOVERED_SEGMENT_REASON_BASELINE = {
 };
 export const RULE_OFFERS_ABSENCE_BASELINE = {
     mandated: "This approval is required by the deployment's policy each time; a rule cannot waive it.",
+    allow_outranked: "An allow rule already matches this call, and this question outranks it — another allow rule would be outranked the same way; it is approved per use.",
+    ask_rule_matched: "An ask-each-time rule matches this call and keeps asking — a new allow rule changes nothing while it stands; to stop being asked, review the existing ask rules.",
     lane_cannot_speak: "This card has no rule to offer for this exact command; it can be approved per use. A coverable form of what you trust can still get a rule — through a card drawn for that form, or settings.",
-    shadowed: "A rule you already have matches this call and still asks — that standing rule keeps deciding, so a new rule minted here would change nothing; review your existing rules instead.",
 };
 export function suggestRulesForCommand(command, ctx) {
     const shape = ruleLaneShapeOf(command, OFFER_READING);

package/dist/core/persisted-rule-arms.d.ts

@@ -48,7 +48,7 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    reads the deny (the gate's exit, the approved-edit re-check, a resumed leg's belt) mints the same card from the same fact.
  *  · ASK — on an allow, a fresh ask is minted carrying `matchedAskRule` (the marker an explicit `ask`
  *    permission rule stamps, so the ask's origin derives as `ask_rule`: the classifier never answers
- *    it, the persisted ALLOW arm never clears it, and the rule-offer face reports `shadowed`); on an
+ *    it, the persisted ALLOW arm never clears it, and the rule-offer face reports `ask_rule_matched`); on an
  *    ask, the marker is stamped if absent and the message names the rule — the standing question
  *    outranks a remembered yes across lanes, exactly as the DSL's own order says within one; a deny
  *    stays a deny.
@@ -62,8 +62,8 @@ export declare function disclosedRuleSet(rules: readonly PersistedRuleHitRule[])
  *    or ask row inside it may forbid this call and nobody can tell, so it fails CLOSED the same way, to the question
  *    only a person answers — an allow becomes an ask carrying `requiresRealApproval`, an ask acquires the bit, a deny stays
  *    a deny. Every call the lane judges is in this state until a read succeeds again (the lane announces the skipped store,
- *    once per run, and reads again on the next call). The two forms differ in WHICH fact the gate records (the call form
- *    is the class `rule_unreadable`; the store form `governance_unavailable` — both bypass-immune) and in the
+ *    once per run, and reads again on the next call). The two forms differ in WHICH fact the gate records (one class for
+ *    both, `rule_unreadable`, bypass-immune) and in the
  *    resumed-call belt, which vetoes only the call form: a person already answered that call's question.
  * An allow hit (or no hit) returns the decision untouched: the allow arm is the station's.
  */

package/dist/core/prompt-section-seat.d.ts

@@ -0,0 +1,54 @@
+/** The named sections whose entries the host may dispose of — a closed set. */
+export declare const DISPOSABLE_PROMPT_SECTIONS: readonly ["core/discovery.mcp-instructions"];
+export type DisposablePromptSection = (typeof DISPOSABLE_PROMPT_SECTIONS)[number];
+/** One entry of a named section, as the engine computed it, before it reaches the model. A frozen copy:
+ *  writing to it changes nothing. */
+export interface PromptSectionEntry {
+    readonly section: DisposablePromptSection;
+    /** The entry's key within the section: the MCP server's declared name. */
+    readonly server: string;
+    /** The text the engine would place: the server's `instructions`, already neutralized. */
+    readonly text: string;
+    /** The tools this leg mounted from that server, by their namespaced names. */
+    readonly mountedTools: readonly string[];
+}
+/** The host's answer. `undefined` = include the entry as computed. */
+export type PromptSectionDisposition = {
+    readonly op: "drop";
+} | {
+    readonly op: "replace";
+    readonly text: string;
+};
+/** Who wrote the text an entry carries into the model's view. */
+export type PromptSectionAuthor = "server" | "host";
+export interface PromptSectionSeat {
+    /**
+     * Answer the disposition of one entry of a named section ({@link DISPOSABLE_PROMPT_SECTIONS}): return
+     * nothing to include it, `{ op: "drop" }` to leave it out of the model's view on every lane, or
+     * `{ op: "replace", text }` to place the host's own non-blank text instead — host text, rendered
+     * without the untrusted-data fence the server's text rides in, under the same per-entry bound and the same
+     * disclosed cut. Called once each time the entry's text
+     * enters the run (a re-dial asks again). Synchronous. A throw, a Promise, or any other value includes
+     * the entry and raises a coded operator warning (`prompt.section_answer_invalid`).
+     */
+    section?(entry: PromptSectionEntry): PromptSectionDisposition | undefined;
+}
+/** One server's entry of the MCP instructions section as the run carries it, after the host's disposition. */
+export interface McpInstructionsEntry {
+    readonly server: string;
+    readonly text: string;
+    readonly author: PromptSectionAuthor;
+}
+/** What one fold leaves in the run: the entry's text and author, absent when dropped, plus the defect
+ *  sentence when the answer could not be read. */
+export interface DisposedSectionEntry {
+    readonly kept?: {
+        readonly text: string;
+        readonly author: PromptSectionAuthor;
+    };
+    readonly defect?: string;
+}
+/** Read the seat's answer for one entry. Each member of the answer is read once. */
+export declare function disposeSectionEntry(seat: PromptSectionSeat | undefined, entry: PromptSectionEntry): DisposedSectionEntry;
+/** The operator warning for an answer the fold could not read. */
+export declare function sectionAnswerWarning(defect: string): Error;

package/dist/core/prompt-section-seat.js

@@ -0,0 +1,49 @@
+import { thrownText } from "./thrown-value.js";
+import { inlineUntrusted } from "./untrusted-text.js";
+import { egressText } from "./untrusted-egress.js";
+export const DISPOSABLE_PROMPT_SECTIONS = Object.freeze(["core/discovery.mcp-instructions"]);
+const ANSWER_KEYS = { drop: ["op"], replace: ["op", "text"] };
+const FOREIGN_VALUE_MAX = 200;
+const STRAY_KEYS_NAMED = 5;
+const DEFECT_MAX = 600;
+const foreign = (s, max) => inlineUntrusted(egressText("same-principal", s), max);
+export function disposeSectionEntry(seat, entry) {
+    const computed = { text: entry.text, author: "server" };
+    if (seat?.section === undefined)
+        return { kept: computed };
+    const offered = Object.freeze({ ...entry, mountedTools: Object.freeze([...entry.mountedTools]) });
+    const where = `prompt section "${entry.section}" entry "${inlineUntrusted(entry.server, 160)}"`;
+    const unread = (why) => ({ kept: computed, defect: inlineUntrusted(`${where}: ${why} — the entry is included as the engine computed it`, DEFECT_MAX) });
+    try {
+        const answer = seat.section(offered);
+        if (answer === undefined)
+            return { kept: computed };
+        if (answer === null || typeof answer !== "object")
+            return unread(`the answer is ${answer === null ? "null" : typeof answer}, not undefined, { op: "drop" } or { op: "replace", text }`);
+        const record = answer;
+        if (typeof record["then"] === "function") {
+            void Promise.resolve(answer).catch(() => undefined);
+            return unread("the section seat returned a Promise; it is synchronous");
+        }
+        const op = record["op"];
+        const text = record["text"];
+        if (op !== "drop" && op !== "replace")
+            return unread(`the answer's op is ${typeof op === "string" ? `"${foreign(op, 40)}"` : typeof op}, not "drop" or "replace"`);
+        const stray = Object.keys(record).filter((k) => !ANSWER_KEYS[op].includes(k));
+        if (stray.length > 0) {
+            const named = stray.slice(0, STRAY_KEYS_NAMED).map((k) => foreign(k, 40)).join(", ");
+            return unread(`a "${op}" answer carries ${named}${stray.length > STRAY_KEYS_NAMED ? ` and ${stray.length - STRAY_KEYS_NAMED} more` : ""}`);
+        }
+        if (op === "drop")
+            return {};
+        if (typeof text !== "string" || text.trim() === "")
+            return unread(`a "replace" answer needs non-blank text`);
+        return { kept: { text, author: "host" } };
+    }
+    catch (err) {
+        return unread(`the section seat (or reading its answer) threw (${foreign(thrownText(err), FOREIGN_VALUE_MAX)})`);
+    }
+}
+export function sectionAnswerWarning(defect) {
+    return Object.assign(new Error(defect), { code: "prompt.section_answer_invalid" });
+}

package/dist/core/protocol-http-auth.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The HTTP credentials a protocol declaration carries — its static `headers` and the per-task principal
+ * header (`principalHeader`) — and the one rule they obey, for MCP and A2A alike: they travel only to the
+ * endpoints the declaration names, and every header name has exactly one owner, compared the way HTTP
+ * compares names (case-insensitively). The principal header's owner is the engine: it sends the task's
+ * principal under that name, or nothing under it when the task has none.
+ *
+ * A declaration that breaks the rule is that peer's defect: the resolver throws inside the peer's own dial,
+ * so the peer is skipped with a coded warning and its siblings still mount. The MCP transport binds its
+ * endpoint by dialing only the declared URL with redirects not followed (`declaredEndpointFetch`); the A2A
+ * peer, whose card may name another endpoint, is bound by {@link assertEndpointBound} and by
+ * {@link redirectPolicy}.
+ */
+import type { ProtocolId } from "./protocol-table.js";
+/** The per-peer HTTP auth declaration every protocol spec carries in the same two fields. */
+export interface ProtocolHttpAuth {
+    headers?: Record<string, string>;
+    principalHeader?: string;
+}
+/** The first header name (any case) the declaration gives two owners, with both spellings. */
+export declare function headerOwnershipCollision(t: ProtocolHttpAuth): {
+    readonly first: string;
+    readonly second: string;
+} | undefined;
+/**
+ * Resolve the HTTP request headers for one remote peer of `protocol`: the static headers, plus the
+ * principal under `principalHeader` when both are present. Throws `config.protocol_header_collision` when
+ * one header name has two owners (two static spellings, or a static entry under the principal header's
+ * name — which would otherwise be sent merged beside the principal, or alone when the task has none), and
+ * on a principal carrying CR/LF. Callers invoke it INSIDE their per-peer boundary.
+ */
+export declare function resolveProtocolHttpHeaders(protocol: ProtocolId, t: ProtocolHttpAuth, principal?: string): Readonly<Record<string, string>> | undefined;
+/** The engine's default request headers under the declared ones: a declared name, in any case, owns that header
+ *  (the default of the same name is not sent beside it). */
+export declare function underDeclaredHeaders(defaults: Readonly<Record<string, string>>, declared: Record<string, string> | undefined): Record<string, string>;
+/** Whether a resolved header set carries anything the declaration bound to its endpoints. */
+export declare function carriesDeclaredHeaders(headers: Record<string, string> | undefined): boolean;
+/** A request carrying declared headers does not follow a redirect (the next hop is not a declared endpoint). */
+export declare function redirectPolicy(headers: Record<string, string> | undefined): "manual" | "follow";
+/**
+ * Refuse an endpoint a peer advertised (an A2A card's interface URL) when it lies outside every origin the
+ * declaration names and the peer's requests carry declared headers: `config.protocol_endpoint_unbound`.
+ */
+export declare function assertEndpointBound(protocol: ProtocolId, peer: string, endpoint: string, declared: readonly string[], headers: Record<string, string> | undefined): void;

package/dist/core/protocol-http-auth.js

@@ -0,0 +1,45 @@
+import { inlineUntrusted } from "./untrusted-text.js";
+export function headerOwnershipCollision(t) {
+    const owners = new Map();
+    for (const name of [...Object.keys(t.headers ?? {}), ...(t.principalHeader ? [t.principalHeader] : [])]) {
+        const prior = owners.get(name.toLowerCase());
+        if (prior !== undefined)
+            return { first: prior, second: name };
+        owners.set(name.toLowerCase(), name);
+    }
+    return undefined;
+}
+export function resolveProtocolHttpHeaders(protocol, t, principal) {
+    const principalHeader = t.principalHeader;
+    const declared = t.headers;
+    const own = { ...(declared !== undefined ? { headers: { ...declared } } : {}), ...(principalHeader !== undefined ? { principalHeader } : {}) };
+    const collision = headerOwnershipCollision(own);
+    if (collision !== undefined) {
+        throw Object.assign(new Error(`${protocol}: the declaration names the header "${inlineUntrusted(collision.first, 80)}" twice ("${inlineUntrusted(collision.second, 80)}" — header names are case-insensitive); ${principalHeader !== undefined && collision.second === principalHeader ? "the principal header is the engine's to send, so remove the static entry" : "keep one spelling"} — this peer is not dialed`), { code: "config.protocol_header_collision" });
+    }
+    if (principalHeader && principal !== undefined) {
+        if (/[\r\n]/.test(principal))
+            throw new Error(`${protocol}: principal must not contain CR/LF (header injection guard)`);
+        return Object.freeze({ ...own.headers, [principalHeader]: principal });
+    }
+    return own.headers === undefined ? undefined : Object.freeze(own.headers);
+}
+export function underDeclaredHeaders(defaults, declared) {
+    const owned = new Set(Object.keys(declared ?? {}).map((k) => k.toLowerCase()));
+    return { ...Object.fromEntries(Object.entries(defaults).filter(([k]) => !owned.has(k.toLowerCase()))), ...declared };
+}
+export function carriesDeclaredHeaders(headers) {
+    return headers !== undefined && Object.keys(headers).length > 0;
+}
+export function redirectPolicy(headers) {
+    return carriesDeclaredHeaders(headers) ? "manual" : "follow";
+}
+export function assertEndpointBound(protocol, peer, endpoint, declared, headers) {
+    if (!carriesDeclaredHeaders(headers))
+        return;
+    const origins = declared.map((u) => new URL(u).origin);
+    const at = new URL(endpoint).origin;
+    if (origins.includes(at))
+        return;
+    throw Object.assign(new Error(`${protocol}: peer "${inlineUntrusted(peer, 80)}" advertises the endpoint origin ${inlineUntrusted(at, 120)}, outside the origins its declaration names (${origins.map((o) => inlineUntrusted(o, 120)).join(", ")}); the declared headers travel only to those — declare that origin as the peer's url (and the card's location as cardUrl) or drop the headers`), { code: "config.protocol_endpoint_unbound" });
+}

package/dist/core/read-face-seats.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The value gates of the read-face list seats, shared by the two places that admit a value into them: the
+ * prepare door (every leg reads the seats it was handed) and the hot-swap door (`Runner.swapDeps`). One gate,
+ * so a value the swap admits is a value every later prepare admits.
+ */
+import { type ReadDenyEntry } from "../tools/fs/index.js";
+/** Array-shape door for the read-face list seats (the tool-face door's twin).
+ * These seats are typed `readonly string[]` but arrive from wire JSON / plain-JS deployments with no
+ * runtime narrowing, and every consumer ITERATES them — `for (const dir of dirs)` and spread.
+ * A bare string satisfies both iteration protocols CHARACTER BY CHARACTER, so `"/tmp/x"` admits the
+ * single-character root `"/"` into a write-capable allowlist and a string deny "pattern" dissolves
+ * into meaningless one-character entries with zero refusal. Garbage must refuse loudly at the door,
+ * never be consumed letter by letter. */
+export declare function assertStringArraySeat(value: unknown, seat: string, entryLaw: "strings" | "compiler-owned"): void;
+/** The three DEPLOYMENT read-deny seats. */
+export declare const READ_DENY_DEPLOYMENT_SEATS: readonly ["readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"];
+export type ReadDenyDeploymentSeat = (typeof READ_DENY_DEPLOYMENT_SEATS)[number];
+/**
+ * The copy a read-deny seat keeps of its declared value — the one copy law of both doors that admit one (`new Runner`
+ * and the hot swap): a list becomes a frozen list of frozen entry copies (each entry's members read once), so a later
+ * write to the caller's list or entry objects cannot move the policy in force; anything else is kept as given, for the
+ * seat's value gate to refuse.
+ */
+export declare function copyReadDenySeat(value: unknown): unknown;
+/**
+ * Screen one deployment read-deny seat's value with the laws a prepare applies to it (the array door and the
+ * one compiler's entry law for the additions; the built-in table's tier / row-name law for the other two) and
+ * return a copy; `undefined` stays `undefined` (no declaration).
+ */
+export declare function screenReadDenySeat(seat: ReadDenyDeploymentSeat, value: unknown): readonly ReadDenyEntry[] | readonly string[] | undefined;

package/dist/core/read-face-seats.js

@@ -0,0 +1,38 @@
+import { compileReadDeny, readDenyBuiltinConfigOf } from "../tools/fs/index.js";
+export function assertStringArraySeat(value, seat, entryLaw) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value)) {
+        const e = new Error(`${seat} must be an array or absent (got ${value === null ? "null" : typeof value}) — a non-array here would be iterated character by character, so it refuses loudly instead.`);
+        e.code = "config.read_face_seat";
+        throw e;
+    }
+    if (entryLaw !== "strings")
+        return;
+    const entries = value;
+    for (const entry of entries) {
+        if (typeof entry !== "string") {
+            const e = new Error(`${seat} entries must be strings (got ${entry === null ? "null" : typeof entry}).`);
+            e.code = "config.read_face_seat";
+            throw e;
+        }
+    }
+}
+export const READ_DENY_DEPLOYMENT_SEATS = Object.freeze(["readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude"]);
+export function copyReadDenySeat(value) {
+    if (!Array.isArray(value))
+        return value;
+    return Object.freeze(value.map((e) => (e !== null && typeof e === "object" ? Object.freeze({ ...e }) : e)));
+}
+export function screenReadDenySeat(seat, value) {
+    if (value === undefined)
+        return undefined;
+    if (seat === "readDenyPatterns") {
+        assertStringArraySeat(value, `RunnerDeps.${seat}`, "compiler-owned");
+        const entries = copyReadDenySeat(value);
+        compileReadDeny(entries, seat, { tiers: [] });
+        return entries;
+    }
+    const config = readDenyBuiltinConfigOf(seat === "readDenyBuiltinTiers" ? { tiers: value } : { exclude: value });
+    return Object.freeze([...((seat === "readDenyBuiltinTiers" ? config.tiers : config.exclude) ?? [])]);
+}

package/dist/core/redaction-passes.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The redaction pass engine every egress tier runs on, and the core bracket RENDERER of the vocabulary's answer.
+ * Which text is a credential is the vocabulary's answer (credential-vocabulary.ts); which passes a text meets is
+ * its tier's (untrusted-egress.ts).
+ */
+import type { RedactionConfidence, RedactionSource, ValueFamilyRow } from "./credential-vocabulary.js";
+export type { RedactionConfidence, RedactionSource } from "./credential-vocabulary.js";
+/** One redaction hit: what was detected, where (ORIGINAL-input coordinates), how confidently, the marker
+ *  literal written in its place, which rule table minted it, and — present when a vocabulary row minted it — the
+ *  value family (the row's stable id; a host-leak hit such as a URL or a path names none). */
+export interface RedactionFinding {
+    kind: string;
+    span: readonly [number, number];
+    confidence: RedactionConfidence;
+    marker: string;
+    source: RedactionSource;
+    family?: string;
+}
+/** The minimum a finding must declare to be summarizable. Both text findings ({@link RedactionFinding})
+ *  and the env arm's entry findings satisfy it, so {@link summarizeRedactions} is ONE helper rather than
+ *  one per material kind. */
+export interface SummarizableFinding {
+    kind: string;
+    confidence: RedactionConfidence;
+}
+/** ANG-3 (envelope declaration) — render findings as ONE human-readable line, e.g.
+ *  `"3 redactions: prefixed-token (high) x1, url (medium) x1, fs-path (low) x1"`, so an upper layer can
+ *  declare to its consumer how much was removed and how confidently.
+ *
+ *  PURE, and deliberately only that: it reads the array, returns a string, and injects nothing anywhere.
+ *  Attaching this line to an output is the caller's decision — a redaction pipeline that silently
+ *  appended prose to the very text it was asked to bound would break both the size contract
+ *  (`boundedString`) and the byte-invariance the whole channel is built on.
+ *
+ *  Grouping is by kind AND confidence together: collapsing on kind alone would report whichever
+ *  confidence happened to arrive first for the rest of that group, which is exactly the silent
+ *  mis-statement ANG-4 exists to prevent. */
+export declare function summarizeRedactions(findings: readonly SummarizableFinding[]): string;
+/** The optional collector every redaction entry point accepts. `preexistingMarkers` (ANG-11) counts
+ *  marker-shaped literals ALREADY present in the input before any pass ran — a nonzero value means the
+ *  text arrived pre-redacted or carries caller-declared markers, either way "marker present" is not proof this
+ *  pipeline ran. Caller-owned: pass `{ findings: [] }` and read it back after the call. */
+export interface RedactionReport {
+    findings: RedactionFinding[];
+    preexistingMarkers?: number;
+}
+/** A declared redaction pass — the unit {@link runRedactionPasses} executes and reports on. */
+export interface RedactionPass {
+    kind: string;
+    confidence: RedactionConfidence;
+    marker: string;
+    /** The rule table that owns this pass's rule — copied verbatim onto every finding it mints (ANG-11), whoever
+     *  runs the pass. */
+    source: RedactionSource;
+    re: RegExp;
+    /** A literal replacement (only `$1` substitution is used by these passes) or a replacer fn. */
+    replace: string | ((match: string, ...groups: string[]) => string);
+    /** The value family a hit belongs to: one id, or — for a pass joining several rows — the id of the row that
+     *  matches at the hit's offset in the pass input. Absent = the pass is no vocabulary row. */
+    family?: string | ((input: string, at: number) => string);
+}
+/**
+ * Run the declared passes in order, collecting findings (original-input spans) when a report is given.
+ *
+ * FORMAT CHARACTERS (#532): the passes scan a VIEW of the input with every `\p{Cf}` removed, so a
+ * credential split by a zero-width character is one token to the scanner, not two fragments of which
+ * only the first (or neither) matches. The OUTPUT keeps every format character that sits OUTSIDE a
+ * replaced span — a joiner in an emoji sequence, a non-joiner in Persian text, a soft hyphen in a word
+ * — and drops only those INSIDE the span the marker replaces (they were part of the secret). A
+ * format-free input takes the exact historical path (byte-identical output). The view's replacements and
+ * every boundary scan's are taken as disjoint spans of their input (a later pass that matched across an
+ * earlier pass's inserted text is rendered from the removals instead), so the spans always map back
+ * exactly and no scan is skipped.
+ */
+export declare function runRedactionPasses(input: string, passes: readonly RedactionPass[], report?: RedactionReport): string;
+/**
+ * The egress view rendered as passes, in the vocabulary's order: one pass per group (a group of several rows is ONE
+ * leftmost alternation, its hits attributed to the row that matches at the hit's offset). A row whose wide form
+ * captures a label keeps it ahead of the marker; `replacers` renders a kind whose marker placement is a policy (the
+ * URL userinfo).
+ */
+export declare function egressPasses(groups: ReadonlyArray<readonly ValueFamilyRow[]>, replacers?: Readonly<Record<string, (match: string, ...groups: string[]) => string>>): RedactionPass[];