agent-trellis 0.18.0 → 0.20.0

package/dist/host/checks.js

@@ -0,0 +1,126 @@
+/**
+ * `host` facade — structured machine-readable checks
+ * (host-extension-points spec).
+ *
+ * One composition of the three read-only checkers — doctor findings,
+ * `sync --check` plan items, secrets audit — into a flat, comparable
+ * result set. Every entry carries:
+ *
+ *   - a STABLE `id` whose identity is path-normalized (`<home>` /
+ *     `<workspace>` placeholders), so the same logical finding produced
+ *     against a real home and against a staging copy compares equal and
+ *     two runs can be differenced as sets;
+ *   - layer attribution (global vs a concrete workspace root), so a
+ *     workspace-layer candidate can be evaluated without the global
+ *     layer's own noise drowning it;
+ *   - the collector's original `message` text (comparison is by `id`
+ *     only — the message stays human-faithful).
+ *
+ * Checks stay read-only by construction: doctor runs with `probeMcp:
+ * false` (no handshakes, no PATH scan — that's `runDoctor` CLI surface),
+ * sync runs with `check: true` (zero writes, no backup session), and the
+ * secrets audit only ever reads.
+ */
+import { collectDoctorReport, resolveKnownHostInjected } from "../commands/doctor.js";
+import { collectSyncReport } from "../commands/sync.js";
+import { collectSecretsAuditReport } from "../commands/secretsAudit.js";
+/** Escape a path root and replace it with a label only at path
+ * boundaries (`/`, `:` as in `path:line:col`, or end of string), so a
+ * home like `/tmp/ho` can never corrupt `/tmp/home/...`. Longest roots
+ * must be replaced first by the caller (workspace before home). */
+function replaceRoot(text, root, label) {
+    const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return text.replace(new RegExp(`${escaped}(?=[/:]|$)`, "g"), label);
+}
+function makeNormalizer(homeDir, roots) {
+    const pairs = [];
+    for (const root of roots) {
+        if (root)
+            pairs.push({ root, label: "<workspace>" });
+    }
+    pairs.push({ root: homeDir, label: "<home>" });
+    // Longest first: a workspace nested under home must be replaced before
+    // the home prefix swallows it.
+    pairs.sort((a, b) => b.root.length - a.root.length);
+    return (text) => {
+        let out = text;
+        for (const { root, label } of pairs)
+            out = replaceRoot(out, root, label);
+        return out;
+    };
+}
+function layerOf(kind, rawText, ctx) {
+    const root = ctx.logicalWorkspaceRoot ?? ctx.physicalWorkspaceRoot;
+    if (!root)
+        return { kind: "global" };
+    // Explicit kinds first (workspace-toml-invalid is workspace-born by
+    // definition — it is parsed from a workspace-layer config file).
+    if (kind === "workspace-toml-invalid")
+        return { kind: "workspace", root };
+    if (ctx.normalizedText.includes("<workspace>"))
+        return { kind: "workspace", root };
+    if (ctx.physicalWorkspaceRoot && rawText.includes(ctx.physicalWorkspaceRoot))
+        return { kind: "workspace", root };
+    return { kind: "global" };
+}
+/**
+ * Run the three machine-readable checks against one surface and return
+ * their findings as one comparable set. Read-only: nothing on disk is
+ * created, modified, or deleted by this function or its collectors.
+ */
+export async function runChecks(options) {
+    const homeDir = options.homeDir;
+    const physicalWorkspaceRoot = options.workspaceRoot ?? null;
+    const logicalWorkspaceRoot = options.logicalWorkspaceRoot ?? physicalWorkspaceRoot;
+    const normalize = makeNormalizer(homeDir, [physicalWorkspaceRoot, logicalWorkspaceRoot]);
+    const entries = [];
+    const doctorReport = await collectDoctorReport(homeDir, resolveKnownHostInjected({ homeDir }), false, physicalWorkspaceRoot);
+    for (const finding of doctorReport.findings) {
+        const normalized = normalize(finding.message);
+        entries.push({
+            id: `doctor:${finding.kind}:${finding.agent ?? "-"}:${normalized}`,
+            source: "doctor",
+            kind: finding.kind,
+            layer: layerOf(finding.kind, finding.message, { physicalWorkspaceRoot, logicalWorkspaceRoot, normalizedText: normalized }),
+            message: finding.message,
+        });
+    }
+    // `check: true` — plan only, zero writes, no backup session. The
+    // managed set always comes from the surface's own canonical; and the
+    // workspace layer is passed explicitly (null means "no layer", never
+    // "guess from the caller's cwd").
+    const syncReport = await collectSyncReport({
+        homeDir,
+        workspaceDir: physicalWorkspaceRoot,
+        check: true,
+    });
+    for (const agentReport of syncReport.reports) {
+        for (const item of agentReport.items) {
+            const rawIdentity = `${item.action}:${item.kind}:${item.target}:${item.linkTarget ?? ""}:${item.mcpRemove?.name ?? item.mcpWrite?.name ?? ""}`;
+            const normalized = normalize(rawIdentity);
+            entries.push({
+                id: `sync:${item.kind}:${item.action}:${normalized}`,
+                source: "sync",
+                kind: item.kind,
+                layer: item.layer === "workspace"
+                    ? { kind: "workspace", root: logicalWorkspaceRoot ?? physicalWorkspaceRoot ?? "" }
+                    : layerOf(item.kind, rawIdentity, { physicalWorkspaceRoot, logicalWorkspaceRoot, normalizedText: normalized }),
+                message: item.description,
+            });
+        }
+    }
+    const secretsReport = await collectSecretsAuditReport({ homeDir });
+    for (const finding of secretsReport.findings) {
+        const rawIdentity = `${finding.agent}:${finding.file}:${finding.detail}`;
+        const normalized = normalize(rawIdentity);
+        entries.push({
+            id: `secrets:${finding.kind}:${normalized}`,
+            source: "secrets",
+            kind: finding.kind,
+            layer: layerOf(finding.kind, rawIdentity, { physicalWorkspaceRoot, logicalWorkspaceRoot, normalizedText: normalized }),
+            message: `${finding.agent} ${finding.file}: ${finding.detail}`,
+        });
+    }
+    entries.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return { entries };
+}

package/dist/host/delivery.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 采纳生效侧的窄门面(host-extension-points;trellis-evolve 12.5 的生产接线)。
+ *
+ * 两个问题的答案,都是托管知识、不是进化知识:
+ *   - `triggerRenderSync`:现在触发一次渲染同步(原生渲染 agent 采纳后
+ *     生效的唯一途径)。消费者边界(10.3)禁止 `src/evolve/` 引
+ *     `commands/*`,而 12.5 的"采纳后触发同步"需要真实现——与 checks/
+ *     同款:门面内部组合 commands 层,对外只出自己的形状。
+ *   - `isMemoryDeliveryEnabled`:canonical 记忆管道是否已启用(记忆 MCP
+ *     server 存在且配置了 `staticEnv.MEMORY_FILE_PATH`,与
+ *     `commands/memory.ts` 的 `resolveMemoryServerGraphPath` 同判据)。
+ *     12.6 的 lesson 由此决定"走记忆管道"还是"只留档案"。
+ *
+ * 只读(第二个)与显式触发写(第一个)分离;本模块不做任何静默写入。
+ */
+import { type AgentId } from "../core/types.js";
+import type { EvolveObservation } from "./levels.js";
+/**
+ * 触发一次渲染同步(skills + instructions),返回进程语义的退出码。
+ * `homeDir` 缺省走真实 `~`(与 `runSync` 同款测试/sandbox 注入缝)。
+ */
+export declare function triggerRenderSync(options?: {
+    homeDir?: string;
+}): Promise<{
+    exitCode: number;
+}>;
+/**
+ * 记忆管道是否已启用:memory MCP server 存在且带
+ * `staticEnv.MEMORY_FILE_PATH`(判据与 `commands/memory.ts` 一致——认
+ * 显式配置,不做启发式扫描)。canonical 缺失时按未启用处理。
+ */
+export declare function isMemoryDeliveryEnabled(homeDir: string): boolean;
+/**
+ * 托管 agent 的观测形态分类(11.4 的"capability delivery"判据,与
+ * `commands/doctor.ts` 同源):runtime 交付("mcp"/"both")的 agent 走
+ * gateway 事件观察("events");仅原生渲染("native"/未配置)只有
+ * doctor/sync 信号("doctor-only")。canonical 缺失返回空列表。
+ */
+export declare function classifyManagedObservation(homeDir: string): {
+    agent: AgentId;
+    observation: EvolveObservation;
+}[];

package/dist/host/delivery.js

@@ -0,0 +1,59 @@
+/**
+ * 采纳生效侧的窄门面(host-extension-points;trellis-evolve 12.5 的生产接线)。
+ *
+ * 两个问题的答案,都是托管知识、不是进化知识:
+ *   - `triggerRenderSync`:现在触发一次渲染同步(原生渲染 agent 采纳后
+ *     生效的唯一途径)。消费者边界(10.3)禁止 `src/evolve/` 引
+ *     `commands/*`,而 12.5 的"采纳后触发同步"需要真实现——与 checks/
+ *     同款:门面内部组合 commands 层,对外只出自己的形状。
+ *   - `isMemoryDeliveryEnabled`:canonical 记忆管道是否已启用(记忆 MCP
+ *     server 存在且配置了 `staticEnv.MEMORY_FILE_PATH`,与
+ *     `commands/memory.ts` 的 `resolveMemoryServerGraphPath` 同判据)。
+ *     12.6 的 lesson 由此决定"走记忆管道"还是"只留档案"。
+ *
+ * 只读(第二个)与显式触发写(第一个)分离;本模块不做任何静默写入。
+ */
+import { loadCanonicalSource } from "../core/canonical.js";
+import { capabilityDeliveryForAgent } from "../core/types.js";
+import { MEMORY_SERVER_NAME } from "../commands/memory.js";
+import { runSync } from "../commands/sync.js";
+/**
+ * 触发一次渲染同步(skills + instructions),返回进程语义的退出码。
+ * `homeDir` 缺省走真实 `~`(与 `runSync` 同款测试/sandbox 注入缝)。
+ */
+export async function triggerRenderSync(options = {}) {
+    return await runSync(options.homeDir !== undefined ? { homeDir: options.homeDir } : {});
+}
+/**
+ * 记忆管道是否已启用:memory MCP server 存在且带
+ * `staticEnv.MEMORY_FILE_PATH`(判据与 `commands/memory.ts` 一致——认
+ * 显式配置,不做启发式扫描)。canonical 缺失时按未启用处理。
+ */
+export function isMemoryDeliveryEnabled(homeDir) {
+    let server;
+    try {
+        server = loadCanonicalSource(homeDir).mcp.servers[MEMORY_SERVER_NAME];
+    }
+    catch {
+        return false;
+    }
+    return Boolean(server && server.enabled !== false && server.staticEnv?.MEMORY_FILE_PATH);
+}
+/**
+ * 托管 agent 的观测形态分类(11.4 的"capability delivery"判据,与
+ * `commands/doctor.ts` 同源):runtime 交付("mcp"/"both")的 agent 走
+ * gateway 事件观察("events");仅原生渲染("native"/未配置)只有
+ * doctor/sync 信号("doctor-only")。canonical 缺失返回空列表。
+ */
+export function classifyManagedObservation(homeDir) {
+    try {
+        const canonical = loadCanonicalSource(homeDir);
+        return canonical.managedAgents.map((agent) => ({
+            agent,
+            observation: capabilityDeliveryForAgent(agent, canonical.mcp) !== "native" ? "events" : "doctor-only",
+        }));
+    }
+    catch {
+        return [];
+    }
+}

package/dist/host/edits.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `host` facade — apply + rollback (host-extension-points spec).
+ *
+ * The write half of the narrow host boundary. Two guarantees the
+ * self-evolution consumer depends on:
+ *
+ *   - every edit runs inside ONE backup session, so a batch of edits is
+ *     undoable as a unit by the standard `trellis rollback` machinery
+ *     (and by `rollbackSession` below);
+ *   - `rollbackSession` restores the prior bytes exactly — the spec's
+ *     "多编辑备份会话内应用后回滚逐字节还原" scenario.
+ *
+ * Nothing here bypasses the backup layer: the facade maps `EditOp`s onto
+ * the same `BackupSession` operations every command already uses, and
+ * rollback goes through the same plan/apply functions `trellis rollback`
+ * runs. No new write paths.
+ */
+/** One edit to apply inside the backup session. Paths are absolute and
+ * already point at the intended surface (the caller decides real home vs
+ * staging scratch — this module never relocates anything itself). */
+export type EditOp = {
+    op: "write-file";
+    path: string;
+    content: string;
+} | {
+    op: "create-symlink";
+    path: string;
+    target: string;
+} | {
+    op: "repair-symlink";
+    path: string;
+    target: string;
+} | {
+    op: "remove-symlink";
+    path: string;
+};
+export interface ApplyEditsOptions {
+    homeDir: string;
+    edits: readonly EditOp[];
+    /** Recorded in the backup manifest as the originating command.
+     * Defaults to `host-edit` so a consumer-applied batch is identifiable
+     * in `trellis rollback --list` without a human command to match it. */
+    command?: string;
+}
+export interface ApplyEditsResult {
+    runId: string;
+    applied: number;
+}
+/** An apply batch that failed partway. `runId` names the finalized
+ * backup session for whatever DID get applied, so the caller can offer
+ * a one-step undo instead of leaving a silent partial state. */
+export declare class HostEditError extends Error {
+    readonly runId: string;
+    constructor(runId: string, cause: unknown);
+}
+/**
+ * Apply all edits inside one backup session. The session is finalized
+ * even on failure — a partial batch must still be recorded so rollback
+ * has something to undo — then a `HostEditError` carrying the runId is
+ * thrown.
+ */
+export declare function applyEdits(options: ApplyEditsOptions): Promise<ApplyEditsResult>;
+/** Host-owned view of one rollback plan item. Mirrors the command
+ * layer's plan item without re-exporting it (the facade contract). */
+export interface RollbackItem {
+    action: "restore" | "conflict" | "already-reverted";
+    path: string;
+    description: string;
+}
+export interface RollbackSessionOptions {
+    homeDir: string;
+    runId: string;
+    /** Plan only — report what WOULD be restored without touching disk. */
+    dryRun?: boolean;
+}
+export interface RollbackSessionResult {
+    runId: string;
+    items: RollbackItem[];
+}
+/**
+ * Roll back one backup session: plan it, then (unless dryRun) apply the
+ * plan. The plan runs through the same conflict checks `trellis
+ * rollback` uses — a path whose on-disk state no longer matches the
+ * session's recorded post-write state is reported as `conflict` and left
+ * untouched, never force-overwritten.
+ */
+export declare function rollbackSession(options: RollbackSessionOptions): Promise<RollbackSessionResult>;

package/dist/host/edits.js

@@ -0,0 +1,102 @@
+/**
+ * `host` facade — apply + rollback (host-extension-points spec).
+ *
+ * The write half of the narrow host boundary. Two guarantees the
+ * self-evolution consumer depends on:
+ *
+ *   - every edit runs inside ONE backup session, so a batch of edits is
+ *     undoable as a unit by the standard `trellis rollback` machinery
+ *     (and by `rollbackSession` below);
+ *   - `rollbackSession` restores the prior bytes exactly — the spec's
+ *     "多编辑备份会话内应用后回滚逐字节还原" scenario.
+ *
+ * Nothing here bypasses the backup layer: the facade maps `EditOp`s onto
+ * the same `BackupSession` operations every command already uses, and
+ * rollback goes through the same plan/apply functions `trellis rollback`
+ * runs. No new write paths.
+ */
+import { lstat } from "node:fs/promises";
+import { currentLinkTarget, openBackupSession } from "../lib/backup.js";
+import { applyRollbackPlan, collectRollbackPlan, loadManifest } from "../commands/rollback.js";
+/** An apply batch that failed partway. `runId` names the finalized
+ * backup session for whatever DID get applied, so the caller can offer
+ * a one-step undo instead of leaving a silent partial state. */
+export class HostEditError extends Error {
+    runId;
+    constructor(runId, cause) {
+        super(`host edit batch failed after partial application (run ${runId}): ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = "HostEditError";
+        this.runId = runId;
+        this.cause = cause;
+    }
+}
+/**
+ * Apply all edits inside one backup session. The session is finalized
+ * even on failure — a partial batch must still be recorded so rollback
+ * has something to undo — then a `HostEditError` carrying the runId is
+ * thrown.
+ */
+export async function applyEdits(options) {
+    const session = openBackupSession(options.homeDir, options.command ?? "host-edit");
+    let applied = 0;
+    try {
+        for (const edit of options.edits) {
+            switch (edit.op) {
+                case "write-file":
+                    session.writeFile(edit.path, edit.content);
+                    break;
+                case "create-symlink":
+                    await session.createSymlink(edit.path, edit.target);
+                    break;
+                case "repair-symlink": {
+                    // The session records the OLD target for rollback; read it from
+                    // disk rather than trusting the caller to have probed first.
+                    const previousTarget = await currentLinkTarget(edit.path);
+                    if (previousTarget === undefined) {
+                        throw new Error(`cannot repair ${edit.path}: not a symlink`);
+                    }
+                    await session.repairSymlink(edit.path, previousTarget, edit.target);
+                    break;
+                }
+                case "remove-symlink": {
+                    const previousTarget = await currentLinkTarget(edit.path);
+                    if (previousTarget === undefined) {
+                        // 幂等重放:目标已不存在视为成功(上次部分失败的批次重试时
+                        // 该链接可能已被删掉);存在但不是 symlink 仍是错误。
+                        const stat = await lstat(edit.path).catch(() => null);
+                        if (stat === null)
+                            break;
+                        throw new Error(`cannot remove ${edit.path}: not a symlink`);
+                    }
+                    await session.removeSymlink(edit.path, previousTarget);
+                    break;
+                }
+            }
+            applied += 1;
+        }
+    }
+    catch (err) {
+        session.finalize();
+        throw new HostEditError(session.runId, err);
+    }
+    session.finalize();
+    return { runId: session.runId, applied };
+}
+/**
+ * Roll back one backup session: plan it, then (unless dryRun) apply the
+ * plan. The plan runs through the same conflict checks `trellis
+ * rollback` uses — a path whose on-disk state no longer matches the
+ * session's recorded post-write state is reported as `conflict` and left
+ * untouched, never force-overwritten.
+ */
+export async function rollbackSession(options) {
+    const report = await collectRollbackPlan(options.homeDir, options.runId);
+    if (!options.dryRun) {
+        const manifest = loadManifest(options.homeDir, report.runId);
+        await applyRollbackPlan(options.homeDir, report.runId, manifest, report.items);
+    }
+    return {
+        runId: report.runId,
+        items: report.items.map((item) => ({ action: item.action, path: item.path, description: item.description })),
+    };
+}

package/dist/host/hostEvents.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Host-extension-point event types (host-extension-points spec).
+ *
+ * The field whitelist is enforced at the type layer: an event object carries
+ * only the metadata listed here — never tool inputs, tool results, or any
+ * content derived from them. Factories copy exactly the whitelist fields (so
+ * even untyped callers cannot smuggle a payload through) and freeze the
+ * result. "session_start" carries the workspace root observed by the process;
+ * consumers derive layer attribution from it (null = no workspace).
+ */
+/** How a tool call ended — the only result information an event may carry. */
+export type ToolResultCategory = "ok" | "error" | "timeout";
+export interface ToolCallEvent {
+    readonly kind: "tool_call";
+    /** Epoch milliseconds. */
+    readonly ts: number;
+    readonly agent: string;
+    readonly session: string;
+    readonly provider: string;
+    /** The externally exposed (aggregated) tool name. */
+    readonly tool: string;
+    readonly durationMs: number;
+    readonly result: ToolResultCategory;
+}
+export interface SessionStartEvent {
+    readonly kind: "session_start";
+    readonly ts: number;
+    readonly agent: string;
+    readonly session: string;
+    /** Workspace root observed by the process at startup; null when the session
+     * has no workspace attribution (signal-layer attribution derives from it). */
+    readonly workspaceRoot: string | null;
+}
+export interface SessionEndEvent {
+    readonly kind: "session_end";
+    readonly ts: number;
+    readonly agent: string;
+    readonly session: string;
+}
+export type HostEvent = ToolCallEvent | SessionStartEvent | SessionEndEvent;
+/** Metadata for one routed tool call — the only inputs an event choke point
+ * accepts (never call arguments, never result content). */
+export interface ToolCallInfo {
+    provider: string;
+    tool: string;
+    durationMs: number;
+    result: ToolResultCategory;
+}
+/** Build a tool-call event from metadata only — call inputs and results never
+ * reach this factory, and only the whitelist fields land on the event. */
+export declare function toolCallEvent(input: {
+    ts: number;
+    agent: string;
+    session: string;
+    provider: string;
+    tool: string;
+    durationMs: number;
+    result: ToolResultCategory;
+}): ToolCallEvent;
+/** Build a session-start event; `workspaceRoot` is the process-observed root
+ * or null when the session has no workspace attribution. */
+export declare function sessionStartEvent(input: {
+    ts: number;
+    agent: string;
+    session: string;
+    workspaceRoot: string | null;
+}): SessionStartEvent;
+/** Build a session-end event. Emitted before upstream release on orderly
+ * shutdown; not guaranteed on SIGKILL/crash (spec says so explicitly). */
+export declare function sessionEndEvent(input: {
+    ts: number;
+    agent: string;
+    session: string;
+}): SessionEndEvent;

package/dist/host/hostEvents.js

@@ -0,0 +1,45 @@
+/**
+ * Host-extension-point event types (host-extension-points spec).
+ *
+ * The field whitelist is enforced at the type layer: an event object carries
+ * only the metadata listed here — never tool inputs, tool results, or any
+ * content derived from them. Factories copy exactly the whitelist fields (so
+ * even untyped callers cannot smuggle a payload through) and freeze the
+ * result. "session_start" carries the workspace root observed by the process;
+ * consumers derive layer attribution from it (null = no workspace).
+ */
+/** Build a tool-call event from metadata only — call inputs and results never
+ * reach this factory, and only the whitelist fields land on the event. */
+export function toolCallEvent(input) {
+    return Object.freeze({
+        kind: "tool_call",
+        ts: input.ts,
+        agent: input.agent,
+        session: input.session,
+        provider: input.provider,
+        tool: input.tool,
+        durationMs: input.durationMs,
+        result: input.result,
+    });
+}
+/** Build a session-start event; `workspaceRoot` is the process-observed root
+ * or null when the session has no workspace attribution. */
+export function sessionStartEvent(input) {
+    return Object.freeze({
+        kind: "session_start",
+        ts: input.ts,
+        agent: input.agent,
+        session: input.session,
+        workspaceRoot: input.workspaceRoot,
+    });
+}
+/** Build a session-end event. Emitted before upstream release on orderly
+ * shutdown; not guaranteed on SIGKILL/crash (spec says so explicitly). */
+export function sessionEndEvent(input) {
+    return Object.freeze({
+        kind: "session_end",
+        ts: input.ts,
+        agent: input.agent,
+        session: input.session,
+    });
+}

package/dist/host/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `agent-trellis/host` — the narrow host facade (host-extension-points).
+ *
+ * The ONLY symbols published under the `./host` subpath. Everything here
+ * is host-owned: functions defined in this directory, plus their own
+ * option/result types. No `src/adapters/*` or `src/commands/*` symbol is
+ * re-exported — the facade composes those layers internally and hands
+ * out its own shapes, so a consumer (the self-evolution engine) can
+ * never come to depend on internal surfaces the spec says it must not
+ * see.
+ */
+export { readSurface } from "./surface.js";
+export type { ReadSurfaceOptions, SurfaceLayer, SurfaceRead } from "./surface.js";
+export { describeEvolveLevels, evolveLevelPolicyPath, LEVELS, loadEvolveLevelPolicy, resolveEvolveLevel, writeEvolveLevelPolicy } from "./levels.js";
+export type { EvolveLevelPolicy, EvolveLevelSection, Level } from "./levels.js";
+export { createStaging, NATIVE_CHECK_SURFACE } from "./staging.js";
+export type { CreateStagingOptions, Staging } from "./staging.js";
+export { runChecks } from "./checks.js";
+export type { CheckEntry, CheckResult, CheckSource, RunChecksOptions } from "./checks.js";
+export { applyEdits, HostEditError, rollbackSession } from "./edits.js";
+export type { ApplyEditsOptions, ApplyEditsResult, EditOp, RollbackItem, RollbackSessionOptions, RollbackSessionResult } from "./edits.js";
+export { classifyManagedObservation, isMemoryDeliveryEnabled, triggerRenderSync } from "./delivery.js";

package/dist/host/index.js

@@ -0,0 +1,17 @@
+/**
+ * `agent-trellis/host` — the narrow host facade (host-extension-points).
+ *
+ * The ONLY symbols published under the `./host` subpath. Everything here
+ * is host-owned: functions defined in this directory, plus their own
+ * option/result types. No `src/adapters/*` or `src/commands/*` symbol is
+ * re-exported — the facade composes those layers internally and hands
+ * out its own shapes, so a consumer (the self-evolution engine) can
+ * never come to depend on internal surfaces the spec says it must not
+ * see.
+ */
+export { readSurface } from "./surface.js";
+export { describeEvolveLevels, evolveLevelPolicyPath, LEVELS, loadEvolveLevelPolicy, resolveEvolveLevel, writeEvolveLevelPolicy } from "./levels.js";
+export { createStaging, NATIVE_CHECK_SURFACE } from "./staging.js";
+export { runChecks } from "./checks.js";
+export { applyEdits, HostEditError, rollbackSession } from "./edits.js";
+export { classifyManagedObservation, isMemoryDeliveryEnabled, triggerRenderSync } from "./delivery.js";