dsh-completion-guard 0.4.2 → 0.5.0

package/dist/{index-DNF0OTi-.d.ts → index-Cd3wXBLi.d.ts}

@@ -54,6 +54,13 @@ declare function requestedTargetAuthorizesMutation(action: StatefulAction, reque
 declare function validateActionManifest(): string[];
 //#endregion
 //#region src/domain/rebind.d.ts
+interface RebindArgs {
+  operation: "propose" | "query" | "withdraw";
+  item_id?: string;
+  proposal_id?: string;
+  clauses?: string[];
+  clarification_item_ids?: string[];
+}
 interface RebindProposal {
   id: string;
   digest: string;
@@ -78,7 +85,56 @@ interface RebindProposal {
   status: "pending" | "confirmed" | "withdrawn" | "stale";
   confirmationEvent?: string;
   replacementIds?: string[];
-}
+  /** Proposals created under the 0.5 protocol carry their replay schema. */
+  protocol?: "v050";
+  /** Matching control line observed during a non-durable replay (not applied). */
+  observedUnconfirmedEvent?: string;
+}
+/** Bounded alignment facts for a mismatched partition, budget-aware. */
+interface BoundedSource {
+  length: number;
+  sha256: string;
+  text?: string;
+  head?: string;
+  tail?: string;
+}
+/** Typed propose outcomes; `undefined` never hides WHY a proposal failed. */
+type ProposeOutcome = {
+  ok: true;
+  proposal: RebindProposal;
+} | {
+  ok: false;
+  reasonCode: "item_not_found" | "item_not_pending" | "unsupported_clarification" | "partition_mismatch" | "payload_too_large" | "no_certification_gain";
+  /** Bounded alignment facts for partition mismatches, within the 12 KiB budget. */
+  source?: BoundedSource;
+};
+/** Exact source partition is deliberately conservative: a proposal cannot
+* invent authority or silently discard a difficult acceptance clause. */
+declare function proposeRebind(p: GuardProjection, args: RebindArgs): RebindProposal | undefined;
+/** 0.5 proposer with typed failures and the no-certification-gain gate. */
+declare function proposeRebindOutcome(p: GuardProjection, args: RebindArgs): ProposeOutcome;
+/**
+* Frozen v0.4.2/v0.4.3 proposer: identical semantics to the 0.4 releases,
+* without the 0.5 no-gain gate or typed failures. Used ONLY to replay
+* historical tool results and historical confirmations faithfully.
+*/
+declare function proposeRebindV042(p: GuardProjection, args: RebindArgs): RebindProposal | undefined;
+/** Stable attempt key: item identity, exact inputs, and outcome class. Identical
+* retries collapse onto it no matter how many unrelated log rows intervene. */
+declare function rebindAttemptKey(p: GuardProjection, args: RebindArgs, reasonCode: string): string;
+declare function rebindResponse(p: GuardProjection, args: RebindArgs): Record<string, unknown>;
+/**
+* Replay validation with version dispatch (A12): structured v0.5 results
+* match semantically (display text may evolve); results carrying the frozen
+* 0.4 response shapes validate against the frozen 0.4 rules exactly. Anything
+* else is tampered or unknown and never replays.
+*/
+declare function replayRebindResult(p: GuardProjection, args: RebindArgs, recorded: Record<string, unknown>): void;
+/** Invoked only for a canonical root user message, never tool or plugin text.
+* The single durable confirmation event is the atomic transaction commit:
+* the confirmation validates against the state BEFORE this message, and the
+* caller processes the remaining text afterwards with its own semantics. */
+declare function confirmRebind(p: GuardProjection, proposalId: string, eventId: string, durable: boolean): boolean;
 //#endregion
 //#region src/domain/digest.d.ts
 type TypedObject = {
@@ -173,6 +229,8 @@ interface GuardItem {
   targetCaptureReasonCode?: TargetCaptureReasonCode;
   authority?: "root_instruction" | "root_adoption" | "legacy_authority_unclassified";
   legacyFlags?: Array<"legacy_generic_run" | "legacy_authority_unclassified">;
+  /** v0.5 intent layer: inquiries keep the obligation but are not machine certifiable. */
+  taskKind?: "inquiry" | "action";
   waitAuthorization?: WaitAuthorization;
   deferAuthorization?: DeferAuthorization;
   persistenceAuthorization?: PersistenceAuthorization;
@@ -304,9 +362,17 @@ interface GuardProjection {
     offendingEvidenceIds?: string[];
   }>;
   lastCheckpointRejectionRevision?: number;
+  /** Bounded fact about the latest rejected confirmation attempt (never raw text). */
+  lastConfirmationRejection?: {
+    eventSeq: number;
+    kind: "malformed" | "ambiguous";
+    reason: string;
+  };
   continuationAttempts: Map<number, number>;
   /** Process-local one-shot fallback counters keyed by epoch + contract revision. */
   persistenceCorrectionAttempts: Map<string, number>;
+  /** Log-derived count of rejected rebind attempts by stable attempt key; survives reload. */
+  rebindRejections: Map<string, number>;
   integrity: GuardIntegrity;
 }
 declare function createProjection(): GuardProjection;
@@ -326,6 +392,10 @@ interface DeriveResult {
   enablementTransitioned: boolean;
   /** Sequence of the last compaction summary in the log, or -1 when none. */
   lastCompactionSeq: number;
+  /** True when a real root user input (text or asset) is present while enabled. */
+  realRootInputSeen: boolean;
+  /** True when the durable log carries the 0.5 first-step protocol boundary. */
+  protocolV4Present: boolean;
 }
 interface DerivedEnvelope {
   seq: number;
@@ -454,6 +524,41 @@ interface CheckpointResult {
 }
 declare function certifyCheckpoint(projection: GuardProjection, bindings: EvidenceBinding[], id: string, commit?: boolean): CheckpointResult;
 //#endregion
+//#region src/domain/confirm-parse.d.ts
+/**
+* 0.5 confirmation-line grammar (A10/A11).
+*
+* A durable root message may carry AT MOST ONE rebind confirmation as a
+* restricted top-level control line; everything after it is follow-up content
+* processed with its own semantics. The parser is intentionally conservative:
+* - only the first non-empty top-level line can be a control line;
+* - lines inside code fences, quoted lines, and blockquote/forward wrappers
+*   are data, never control;
+* - an embedded or mid-sentence control string is `malformed`, never a
+*   confirmation;
+* - a matching control line that is NOT in first position, or an explicit
+*   reversal in the remainder, makes the whole message `ambiguous` (stays
+*   unconfirmed; no partial effect).
+*/
+type ParsedConfirmation = {
+  kind: "none";
+} | {
+  kind: "malformed";
+  reason: "embedded_control_text" | "inside_code_fence" | "quoted";
+} | {
+  kind: "ambiguous";
+  reason: "multiple_control_lines" | "late_control_line" | "reversal_in_remainder";
+} | {
+  kind: "confirm";
+  proposalId: string;
+  remainder: string;
+};
+declare const CONFIRM_LINE_PATTERN: RegExp;
+/** Parse control without rewriting the follow-up's authority wrappers. */
+declare function parseConfirmationMessage(text: string): ParsedConfirmation;
+/** Whether a recorded tool/result carries the frozen v0.4.x response shape. */
+declare function isFrozenV042RebindResponse(recorded: unknown): boolean;
+//#endregion
 //#region src/domain/conversation.d.ts
 type UserInteractionKind = "instruction" | "conversational";
 /**
@@ -469,6 +574,15 @@ type UserInteractionKind = "instruction" | "conversational";
 * forms, and finally a progression lead over a featureless remainder.
 */
 declare function classifyUserInteraction(text: string): UserInteractionKind;
+type TaskIntent = "inquiry" | "action";
+/**
+* Separate intent layer (v0.5): whether the captured work is an inquiry about
+* state or an ordered change. Intent NEVER drops capture or weakens
+* protection — an inquiry keeps its original obligation; it only changes what
+* certification support the diagnosis reports (inquiries are not machine
+* certifiable by the current adapters and must not be re-bound).
+*/
+declare function classifyTaskIntent(text: string): TaskIntent;
 //#endregion
 //#region src/domain/contract-segment.d.ts
 type AuthorityBlockKind = "instruction" | "reference" | "quoted" | "code" | "uncertain";
@@ -528,24 +642,24 @@ declare const ALPHA2_HOST_PACKAGES: PackageRow[];
 */
 declare const ALPHA2_DSHMARKET_139_HOST_PACKAGES: PackageRow[];
 /**
-* Audited host cohort registry. The rc.2 cohort keeps the exact identities
-* audited for 0.3.0/0.3.1 on macOS and Windows. The alpha.2 cohort carries the
-* exact package graph extracted from native macOS and Windows DSH
-* `0.1.2-alpha.2` / dshmarket `1.38.1` runtimes. The alpha.2+dshmarket-1.39.0
-* cohort carries the exact upgraded-Windows graph. The alpha.3 cohort carries
-* the graph audited in the 2026-09-01 annex. The rc.1 cohort carries the exact
-* runtime plus dshmarket 1.41.0 graph audited natively on macOS, then confirmed
-* on Windows: the 2026-09-04 native Windows rc.1 runtime graph (dshmarket
-* 1.41.0) was extracted from the runtime lockfile and verified row-for-row
-* identical (name, version, registry integrity) to the posix extraction before
-* this cohort was widened. Graphs that mix cohorts, lack
-* rows, duplicate rows, or use identities outside every registered cohort
-* fail closed.
+* Historical audited host cohort registry. Every entry keeps the exact package
+* identities audited natively for a past Guard release (CG-DSH-001 whole-graph
+* contracts). These are historical verification facts only: since 0.5.0 the
+* active support target is `0.1.2-rc.1`, so an installed graph from any of
+* these cohorts — including previous RCs and alphas — is no longer an active
+* support entry and fails closed in `evaluateHostLock`.
+*/
+declare const LEGACY_HOST_COHORTS: readonly HostCohort[];
+/** Core-lock/v1 separates optional market identity from the audited DSH graph.
+* The active support target is exactly one audited cohort, `0.1.2-rc.1`:
+* historical cohorts stay in `LEGACY_HOST_COHORTS` as verification data but are
+* never silently re-labelled as accepted active locks, and an installed
+* historical graph fails closed under `evaluateHostLock`.
 */
 declare const HOST_COHORTS: readonly HostCohort[];
 /**
-* rc.2 audited package identities (first registry cohort). The audited
-* cohort is an atomic whole-graph contract (CG-DSH-001): any drifted,
+* rc.1 audited package identities: the active support cohort since 0.5.0. The
+* audited cohort is an atomic whole-graph contract (CG-DSH-001): any drifted,
 * duplicated, unknown-version, unbound, OR MISSING row fails the whole lock
 * closed (`host_lock_missing`); no capability inherits independence from a
 * partially present graph.
@@ -567,7 +681,7 @@ interface HostLockEvaluation {
   status: HostLockStatus;
   digest: string;
   goalAvailable: boolean;
-  reasonCode?: "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
+  reasonCode?: "host_lock_migration_required" | "host_lock_installed_graph_drift" | "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
   packages: PackageRow[];
   capabilities: Record<HostCapabilityId, HostCapabilityEvaluation>;
   platform?: HostPlatform;
@@ -658,6 +772,14 @@ declare const DEFAULT_HOST_LOCK: HostLockEvaluation;
 declare const CAPTURE_V042_NOTICE = "Context Guard capture boundary: v0.4.2";
 declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 /**
+* 0.5.0 first-step boundary: written at the first real root input step (never
+* at session start), before the constrained root message in the same batch.
+* It implies the v3 protocol and v0.4.2 capture semantics and marks the cut
+* where the 0.5 confirmation syntax becomes active; earlier notices keep
+* their historical meaning for replay.
+*/
+declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
+/**
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
 * piece of state is derived from `command/run`, `user/message`, `tool/call`,
@@ -666,6 +788,50 @@ declare const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 */
 declare function deriveProjection(sourceEvents: readonly DerivedEnvelope[], config: DeriveConfig, scope: DeriveScope, durableConfirmed: boolean, hostLock?: HostLockEvaluation): DeriveResult;
 //#endregion
+//#region src/domain/diagnostics.d.ts
+type TaskKind = "inquiry" | "action" | "deliverable" | "constraint" | "unresolved";
+type CertificationSupport = "supported" | "unsupported" | "needs_target" | "needs_evidence" | "unavailable";
+type Repairability = "agent_repairable" | "user_input_required" | "unsupported" | "historical_gap" | "none";
+interface DiagnosisNextAction {
+  kind: "report_only" | "collect_evidence" | "checkpoint" | "clarify_target" | "restore_host" | "none";
+  tool?: string;
+  required_input?: string;
+  resume_condition?: string;
+}
+/** The single unified diagnosis shared by checkpoint, recovery, rebind,
+* evidence/action, and status surfaces (v0.5). It states what certification
+* can do, never invents targets, evidence IDs, or authority. */
+interface UnifiedItemDiagnosis {
+  item_id: string;
+  item_revision: number;
+  contract_revision: number;
+  task_kind: TaskKind;
+  certification: CertificationSupport;
+  reason_code: string;
+  repairability: Repairability;
+  missing_fields: string[];
+  missing_facets: Array<"resolution" | "effect" | "state">;
+  next_action: DiagnosisNextAction;
+  /** Stable over unchanged inputs; identical retries collapse onto it. */
+  attempt_fingerprint: string;
+}
+/**
+* The pure repair judge. It decides between: fixable from existing evidence,
+* missing pre-evidence, missing a user target choice, not supported by any
+* adapter, an executed-without-evidence historical gap, or nothing to do —
+* and it NEVER recommends a rebind that cannot change certification.
+*/
+declare function deriveItemDiagnosis(p: GuardProjection, item: GuardItem): UnifiedItemDiagnosis;
+/** Legacy compact view, now derived from the single unified diagnosis. */
+declare function itemDiagnosis(p: GuardProjection, item: GuardItem): {
+  certifiable: boolean;
+  reason_code: string;
+  next_step: string;
+};
+declare function evidenceAvailabilityReason(evidence: GuardEvidence): string | undefined;
+/** Shared display filter; certification remains the full domain check. */
+declare function relevantEvidence(p: GuardProjection, item: GuardItem, evidence: GuardEvidence): boolean;
+//#endregion
 //#region src/domain/evidence.d.ts
 interface ToolCallInput {
   callId: string;
@@ -862,6 +1028,12 @@ interface LinearCommitReadback {
 * wildcard refspecs, and implicit HEAD/ref destinations fail closed because
 * none occur in an accepted exact shape.
 */
+/**
+* Canonical command templates, derived from the SAME audited argv shapes the
+* parser accepts above. Guidance surfaces (context_guard_prepare) render these
+* so a tool description can never advertise a command the executor rejects.
+*/
+declare const GIT_COMMAND_TEMPLATES: Partial<Record<GitAdapterAction, Record<string, unknown>>>;
 declare function parseGitCommandManifest(command: string, surface: CanonicalCommandSurface): GitCommandParseResult;
 /** Bind the command's explicit remote/ref identities to the canonical target. */
 declare function gitCommandMatchesTarget(manifest: GitCommandManifest, target: GitTargetIdentity): boolean;
@@ -900,7 +1072,7 @@ declare class HostProfileError extends Error {
 * v9 lockfile. Multiple resolved versions are preserved as separate rows so
 * callers cannot silently select a nearest instance.
 */
-declare function packageRowsFromPnpmLock(text: string): PackageRow[];
+declare function packageRowsFromPnpmLock(text: string, names?: readonly string[]): PackageRow[];
 declare function resolveInstalledHostLock(moduleUrl?: string): HostLockEvaluation;
 /**
 * Resolve only package identities reachable from the active pnpm importer.
@@ -917,6 +1089,24 @@ interface ActiveProfileHostLock {
   platform: HostPlatform;
   profileKind: HostProfileKind;
 }
+/** Read exact reachable critical rows without requiring Guard installation.
+* Used by target preflight before a legacy profile can be migrated.
+*/
+declare function readActiveHostGraph(runtimeRoot: string, profileRoot: string): PackageRow[];
+interface TargetHostGraph {
+  packages: PackageRow[];
+  profileGraph: {
+    state: "active_importer" | "dependency_free_headless";
+    manifestSha256?: string;
+    bundles?: PackageRow[];
+  };
+}
+/**
+* Pre-install inspection only. A fresh rc.1 Headless profile can use its two
+* installation-owned bundles without a private importer. Never extend this
+* absence rule to inject or runtime replay, which still call the strict reader.
+*/
+declare function inspectTargetHostGraph(runtimeRoot: string, profileRoot: string): TargetHostGraph;
 /** Read and validate the actual runtime graph plus the installed profile plugin. */
 declare function resolveActiveProfileHostLock(runtimeRoot: string, profileRoot: string, expectedPluginVersion: string): ActiveProfileHostLock;
 /** Atomically inject a repeatable managed patch into the selected profile only. */
@@ -927,7 +1117,76 @@ declare function hostLockContextFromComposedDump(text: string): {
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
 };
-declare function verifyComposedHostLockDump(text: string, expected: HostLockEvaluation): HostLockEvaluation;
+declare function verifyComposedHostLockDump(text: string, expected: HostLockEvaluation, roots?: Pick<ActiveProfileHostLock, "runtimeRoot" | "profileRoot">): HostLockEvaluation;
+//#endregion
+//#region src/domain/lifecycle.d.ts
+/**
+* Runtime-owned startup lifecycle. It expresses the activation strategy of a
+* session, never contract or certification state: `armed` means protection is
+* enabled and waiting for the first real root user input, `active` means that
+* input has entered a step, and `disabled` means an explicit `off` (or an
+* opt-in session without `on`). Certification still depends only on durable
+* root events, the current contract, and the evidence chain.
+*/
+type LifecyclePhase = "armed" | "active" | "disabled";
+interface FirstStepInjection {
+  /** Versioned protocol boundary appended before this step's messages. */
+  boundary: string;
+  /** Compact first-step guidance describing the activated protection. */
+  guidance: string;
+}
+/** One claimed pre-step message: a validated host `UserMessage`. */
+interface ClaimedMessage {
+  source?: {
+    kind?: unknown;
+    plugin?: unknown;
+  };
+  content?: unknown;
+}
+/**
+* Pure preview of one claimed pre-step batch. Messages claimed by the loop are
+* NOT yet persisted as `user/message` events at pre-step time, so this reads
+* only the validated claim: it never writes contract items, evidence, or
+* authority. A message activates protection when it carries a root user source
+* and real content — non-empty text, or any non-text part (image/attachment).
+* Whitespace-only messages with no other parts are real input but state no
+* task, so they neither activate nor produce contract items.
+*/
+declare function claimedBatchHasRealRootInput(messages: readonly unknown[]): boolean;
+interface FirstStepPreviewInput {
+  activation: "opt-in" | "always";
+  /** Log-derived enablement: an explicit `off` suppresses `always` until `on`. */
+  enabled: boolean;
+  /** The durable log already contains a v4 (or newer) Guard boundary. */
+  boundaryPresent: boolean;
+  /** The session is a delegated/subagent session, never a root conversation. */
+  delegated: boolean;
+}
+/**
+* Pure decision for the first-step activation injection when protection is enabled. The
+* boundary must precede the first constrained root message inside the SAME
+* persisted step batch; guidance is compact and never claims a recovery that
+* did not happen. `opt-in` reaches this path only after its explicit `on` command. Delegated sessions receive neither: their
+* scope arrives through the parent's delegation prompt (A04).
+*/
+declare function previewFirstStepInjection(input: FirstStepPreviewInput, claimedRealInput: boolean): FirstStepInjection | undefined;
+/**
+* Compact first-step guidance: protection has started, what it protects, and
+* the working order for stateful actions. It is not a task, asks no question,
+* and contains no recovery wording.
+*/
+declare const FIRST_STEP_GUIDANCE = "Context Guard is now protecting this session: requirements from your messages stay open until they are certified with matching durable evidence. Before a stateful action (write, install, commit, push, publish, restart), call context_guard_prepare to see the supported command shape and required resolution/effect/state order; collect evidence with the guarded tools, then close items with context_guard_checkpoint. Ordinary answers and investigations need no certification.";
+/**
+* Lifecycle phase derived from durable facts. `enabled` is the log-derived
+* enablement (`always`, or the explicit `on`/`off` command sequence), and
+* `realInputSeen` records that a real root user input already entered a step.
+* Pure over its inputs so status display and tests cannot drift from the
+* injection decision.
+*/
+declare function lifecyclePhase(input: {
+  enabled: boolean;
+  realInputSeen: boolean;
+}): LifecyclePhase;
 //#endregion
 //#region src/domain/manifest.d.ts
 /**
@@ -1137,4 +1396,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { resolveInstalledHostLock as $, DeriveResult as $n, HostCapabilityEvaluation as $t, createProofManifest as A, ClassifiedClause as An, ActionManifest as Ar, hasCurrentCertificate as At, COMMAND_SURFACE_MANIFEST as B, BoundaryEffectuation as Bn, isStatefulAction as Br, PROTOCOL_V3_NOTICE as Bt, ProofKind as C, segmentAuthorityBlocks as Cn, TargetValue as Cr, ParsedShell as Ct, SessionQuery as D, RejectedBinding as Dn, PackageRow as Dr, parsePwshCommand as Dt, ProofSurface as E, CheckpointResult as En, createProjection as Er, isRunExecutable as Et, EvidenceFacetCoverage as F, extractArtifactPaths as Fn, STOP_PROTOCOL_VERSION as Fr, extractTextContent as Ft, ActiveProfileHostLock as G, availableBoundaryQualifications as Gn, validateActionManifest as Gr, BASE_HOST_PACKAGES as Gt, ManifestIssue as H, BoundaryRequest as Hn, requestedTargetMatchesResolved as Hr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Ht, bindingSatisfies as I, extractMethod as In, SUPPORTED_EVIDENCE_ADAPTERS as Ir, extractToolSubject as It, hostLockRowsFromComposedDump as J, qualifyBoundary as Jn, digestStrings as Jr, ExecutableIdentity as Jt, HostProfileError as K, effectuateBoundary as Kn, validateActionTarget as Kr, DEFAULT_HOST_LOCK as Kt, evidenceCoverage as L, extractOperation as Ln, SemanticAction as Lr, isDeterministicCheck as Lt, proofEvidenceConstraints as M, captureClause as Mn, CERTIFICATE_VERSION as Mr, ToolResultInput as Mt, sessionQuery as N, captureItem as Nn, SEMANTIC_ACTIONS as Nr, ToolSubject as Nt, bindProofToProjection as O, certifyCheckpoint as On, ACTION_MANIFEST as Or, parseShellCommand as Ot, validateProofManifest as P, classifyClause as Pn, STATEFUL_ACTIONS as Pr, evidenceFromPersistedToolResult as Pt, resolveActiveProfileHostLock as Q, DeriveConfig as Qn, sha256 as Qr, HOST_COHORTS as Qt, evidenceMatchesItem as R, isInformationalMessage as Rn, StatefulAction as Rr, withDurability as Rt, PROOF_PROTOCOL_VERSION as S, authorityCaptureCounts as Sn, TargetTuple as Sr, CanonicalCommandSurface as St, ProofObligation as T, classifyUserInteraction as Tn, WaitAuthorization as Tr, canonicalArgvFromCommand as Tt, OperationVerbEntry as U, GoalActivationState as Un, semanticActionFromCommand as Ur, ALPHA2_HOST_PACKAGES as Ut, CommandSurfaceManifest as V, BoundaryQualification as Vn, requestedTargetAuthorizesMutation as Vr, deriveProjection as Vt, validateManifest as W, GoalBoundaryAccess as Wn, semanticActionFromText as Wr, AuditedExecutable as Wt, packageRowsFromActiveGraph as X, BoundaryQualificationKind as Xn, sanitizeClauseText as Xr, GOAL_HOST_PACKAGES as Xt, injectActiveProfileHostLock as Y, BoundaryDisposition as Yn, normalizeClause as Yr, ExecutableIdentityBinding as Yt, packageRowsFromPnpmLock as Z, DeferAuthorization as Zn, sanitizeUrl as Zr, HOST_CAPABILITY_PACKAGE_GROUPS as Zt, openItems as _, selectHostCohort as _n, GuardProjection as _r, gitCommandMatchesTarget as _t, classifyCompletionClaim as a, HostLockContext as an, EvidenceRole as ar, GitCommandParseResult as at, ALPHA3_HOST_PACKAGES as b, AuthorityBlockKind as bn, TargetCaptureReasonCode as br, verifiedLinearCommitReadback as bt, isWholeTaskCompletionClaim as c, HostPlatform as cn, GoalRef as cr, GitEffectRunner as ct, snapshotSessionEvents as d, bindExecutableIdentity as dn, GuardEvidence as dr, GitTargetIdentity as dt, HostCapabilityId as en, DeriveScope as er, verifyComposedHostLockDump as et, RC1_HOST_PACKAGES as f, bindLiveGoalCapability as fn, GuardIntegrity as fr, LinearCommitReadback as ft, closingHint as g, evaluateToolSurfaceCapability as gn, GuardOperation as gr, executeRevalidatedGitEffect as gt, RecoveryOptions as h, evaluateHostLock as hn, GuardItemStatus as hr, createGitPrestateEnvelope as ht, TurnStoppingDecision as i, HostCohortSelectionReason as in, EvidenceParseStatus as ir, GitCommandManifest as it, proofDigest as j, ClauseSegment as jn, ActionSpec as jr, ToolCallInput as jt, canonicalProjection as k, CaptureScope as kn, ACTION_MANIFEST_VERSION as kr, goalCompletionDenial as kt, latestAssistantText as l, HostProfileKind as ln, GuardBoundary as lr, GitPrestateCheck as lt, MIN_RECOVERY_CHAR_BUDGET as m, evaluateHostCapability as mn, GuardItemKind as mr, commitTreeSnapshotDigest as mt, AssistantOutcomeObservation as n, HostCohort as nn, EvidenceBinding as nr, GitAdapterAction as nt, decideTurnBoundary as o, HostLockEvaluation as on, ExpectedTransition as or, GitCommandRejected as ot, DEFAULT_RECOVERY_CHAR_BUDGET as p, evaluateExternalWaitCapability as pn, GuardItem as pr, commitIndexSnapshotDigest as pt, hostLockContextFromComposedDump as q, isCurrentAcceptedBoundary as qn, canonicalizePath as qr, EXPECTED_HOST_PACKAGES as qt, CompletionDisposition as r, HostCohortSelection as rn, EvidenceOutcome as rr, GitCommandAccepted as rt, decideTurnStopping as s, HostLockStatus as sn, ExternalOperation as sr, GitEffectExecution as st, supersedeItem as t, HostCapabilityRequest as tn, DerivedEnvelope as tr, GIT_COMMAND_MANIFEST_IDS as tt, observeAssistantOutcome as u, HostToolSurface as un, GuardCheckpoint as ur, GitPrestateEnvelope as ut, recoveryDigest as v, currentContractDigest as vn, HostStatus as vr, parseGitCommandManifest as vt, ProofManifest as w, UserInteractionKind as wn, VerificationContract as wr, ShellParseStatus as wt, PROOF_KINDS as x, AuthorityKind as xn, TargetCaptureStatus as xr, CanonicalArgv as xt, renderRecoveryPacket as y, AuthorityBlock as yn, PersistenceAuthorization as yr, revalidateGitPrestate as yt, isVerifyingCapability as z, segmentClauses as zn, actionCompatible as zr, CAPTURE_V042_NOTICE as zt };
+export { ActiveProfileHostLock as $, isFrozenV042RebindResponse as $n, VerificationContract as $r, Repairability as $t, createProofManifest as A, semanticActionFromText as Ai, HostPlatform as An, DerivedEnvelope as Ar, parseGitCommandManifest as At, COMMAND_SURFACE_MANIFEST as B, selectHostCohort as Bn, GuardEvidence as Br, parseShellCommand as Bt, ProofKind as C, SemanticAction as Ci, HostCapabilityRequest as Cn, qualifyBoundary as Cr, GitTargetIdentity as Ct, SessionQuery as D, requestedTargetAuthorizesMutation as Di, HostLockContext as Dn, DeriveConfig as Dr, createGitPrestateEnvelope as Dt, ProofSurface as E, isStatefulAction as Ei, HostCohortSelectionReason as En, DeferAuthorization as Er, commitTreeSnapshotDigest as Et, EvidenceFacetCoverage as F, normalizeClause as Fi, bindLiveGoalCapability as Fn, ExpectedTransition as Fr, ParsedShell as Ft, ClaimedMessage as G, authorityCaptureCounts as Gn, GuardOperation as Gr, ToolSubject as Gt, ManifestIssue as H, AuthorityBlock as Hn, GuardItem as Hr, hasCurrentCertificate as Ht, bindingSatisfies as I, sanitizeClauseText as Ii, evaluateExternalWaitCapability as In, ExternalOperation as Ir, ShellParseStatus as It, FirstStepPreviewInput as J, UserInteractionKind as Jn, PersistenceAuthorization as Jr, extractToolSubject as Jt, FIRST_STEP_GUIDANCE as K, segmentAuthorityBlocks as Kn, GuardProjection as Kr, evidenceFromPersistedToolResult as Kt, evidenceCoverage as L, sanitizeUrl as Li, evaluateHostCapability as Ln, GoalRef as Lr, canonicalArgvFromCommand as Lt, proofEvidenceConstraints as M, validateActionTarget as Mi, HostToolSurface as Mn, EvidenceOutcome as Mr, verifiedLinearCommitReadback as Mt, sessionQuery as N, canonicalizePath as Ni, LEGACY_HOST_COHORTS as Nn, EvidenceParseStatus as Nr, CanonicalArgv as Nt, bindProofToProjection as O, requestedTargetMatchesResolved as Oi, HostLockEvaluation as On, DeriveResult as Or, executeRevalidatedGitEffect as Ot, validateProofManifest as P, digestStrings as Pi, bindExecutableIdentity as Pn, EvidenceRole as Pr, CanonicalCommandSurface as Pt, previewFirstStepInjection as Q, ParsedConfirmation as Qn, TargetValue as Qr, DiagnosisNextAction as Qt, evidenceMatchesItem as R, sha256 as Ri, evaluateHostLock as Rn, GuardBoundary as Rr, isRunExecutable as Rt, PROOF_PROTOCOL_VERSION as S, SUPPORTED_EVIDENCE_ADAPTERS as Si, HostCapabilityId as Sn, isCurrentAcceptedBoundary as Sr, GitPrestateEnvelope as St, ProofObligation as T, actionCompatible as Ti, HostCohortSelection as Tn, BoundaryQualificationKind as Tr, commitIndexSnapshotDigest as Tt, OperationVerbEntry as U, AuthorityBlockKind as Un, GuardItemKind as Ur, ToolCallInput as Ut, CommandSurfaceManifest as V, currentContractDigest as Vn, GuardIntegrity as Vr, goalCompletionDenial as Vt, validateManifest as W, AuthorityKind as Wn, GuardItemStatus as Wr, ToolResultInput as Wt, claimedBatchHasRealRootInput as X, classifyUserInteraction as Xn, TargetCaptureStatus as Xr, withDurability as Xt, LifecyclePhase as Y, classifyTaskIntent as Yn, TargetCaptureReasonCode as Yr, isDeterministicCheck as Yt, lifecyclePhase as Z, CONFIRM_LINE_PATTERN as Zn, TargetTuple as Zr, CertificationSupport as Zt, openItems as _, ActionSpec as _i, ExecutableIdentityBinding as _n, BoundaryRequest as _r, GitCommandParseResult as _t, classifyCompletionClaim as a, RebindArgs as ai, relevantEvidence as an, ClassifiedClause as ar, inspectTargetHostGraph as at, ALPHA3_HOST_PACKAGES as b, STATEFUL_ACTIONS as bi, HOST_COHORTS as bn, availableBoundaryQualifications as br, GitEffectRunner as bt, isWholeTaskCompletionClaim as c, proposeRebind as ci, PROTOCOL_V4_NOTICE as cn, captureItem as cr, readActiveHostGraph as ct, snapshotSessionEvents as d, rebindAttemptKey as di, ALPHA2_HOST_PACKAGES as dn, extractMethod as dr, verifyComposedHostLockDump as dt, WaitAuthorization as ei, TaskKind as en, parseConfirmationMessage as er, HostProfileError as et, RC1_HOST_PACKAGES as f, rebindResponse as fi, AuditedExecutable as fn, extractOperation as fr, GIT_COMMAND_MANIFEST_IDS as ft, closingHint as g, ActionManifest as gi, ExecutableIdentity as gn, BoundaryQualification as gr, GitCommandManifest as gt, RecoveryOptions as h, ACTION_MANIFEST_VERSION as hi, EXPECTED_HOST_PACKAGES as hn, BoundaryEffectuation as hr, GitCommandAccepted as ht, TurnStoppingDecision as i, ProposeOutcome as ii, itemDiagnosis as in, CaptureScope as ir, injectActiveProfileHostLock as it, proofDigest as j, validateActionManifest as ji, HostProfileKind as jn, EvidenceBinding as jr, revalidateGitPrestate as jt, canonicalProjection as k, semanticActionFromCommand as ki, HostLockStatus as kn, DeriveScope as kr, gitCommandMatchesTarget as kt, latestAssistantText as l, proposeRebindOutcome as li, deriveProjection as ln, classifyClause as lr, resolveActiveProfileHostLock as lt, MIN_RECOVERY_CHAR_BUDGET as m, ACTION_MANIFEST as mi, DEFAULT_HOST_LOCK as mn, segmentClauses as mr, GitAdapterAction as mt, AssistantOutcomeObservation as n, PackageRow as ni, deriveItemDiagnosis as nn, RejectedBinding as nr, hostLockContextFromComposedDump as nt, decideTurnBoundary as o, RebindProposal as oi, CAPTURE_V042_NOTICE as on, ClauseSegment as or, packageRowsFromActiveGraph as ot, DEFAULT_RECOVERY_CHAR_BUDGET as p, replayRebindResult as pi, BASE_HOST_PACKAGES as pn, isInformationalMessage as pr, GIT_COMMAND_TEMPLATES as pt, FirstStepInjection as q, TaskIntent as qn, HostStatus as qr, extractTextContent as qt, CompletionDisposition as r, BoundedSource as ri, evidenceAvailabilityReason as rn, certifyCheckpoint as rr, hostLockRowsFromComposedDump as rt, decideTurnStopping as s, confirmRebind as si, PROTOCOL_V3_NOTICE as sn, captureClause as sr, packageRowsFromPnpmLock as st, supersedeItem as t, createProjection as ti, UnifiedItemDiagnosis as tn, CheckpointResult as tr, TargetHostGraph as tt, observeAssistantOutcome as u, proposeRebindV042 as ui, ALPHA2_DSHMARKET_139_HOST_PACKAGES as un, extractArtifactPaths as ur, resolveInstalledHostLock as ut, recoveryDigest as v, CERTIFICATE_VERSION as vi, GOAL_HOST_PACKAGES as vn, GoalActivationState as vr, GitCommandRejected as vt, ProofManifest as w, StatefulAction as wi, HostCohort as wn, BoundaryDisposition as wr, LinearCommitReadback as wt, PROOF_KINDS as x, STOP_PROTOCOL_VERSION as xi, HostCapabilityEvaluation as xn, effectuateBoundary as xr, GitPrestateCheck as xt, renderRecoveryPacket as y, SEMANTIC_ACTIONS as yi, HOST_CAPABILITY_PACKAGE_GROUPS as yn, GoalBoundaryAccess as yr, GitEffectExecution as yt, isVerifyingCapability as z, evaluateToolSurfaceCapability as zn, GuardCheckpoint as zr, parsePwshCommand as zt };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as resolveInstalledHostLock, $n as DeriveResult, $t as HostCapabilityEvaluation, A as createProofManifest, An as ClassifiedClause, Ar as ActionManifest, At as hasCurrentCertificate, B as COMMAND_SURFACE_MANIFEST, Bn as BoundaryEffectuation, Br as isStatefulAction, Bt as PROTOCOL_V3_NOTICE, C as ProofKind, Cn as segmentAuthorityBlocks, Cr as TargetValue, Ct as ParsedShell, D as SessionQuery, Dn as RejectedBinding, Dr as PackageRow, Dt as parsePwshCommand, E as ProofSurface, En as CheckpointResult, Er as createProjection, Et as isRunExecutable, F as EvidenceFacetCoverage, Fn as extractArtifactPaths, Fr as STOP_PROTOCOL_VERSION, Ft as extractTextContent, G as ActiveProfileHostLock, Gn as availableBoundaryQualifications, Gr as validateActionManifest, Gt as BASE_HOST_PACKAGES, H as ManifestIssue, Hn as BoundaryRequest, Hr as requestedTargetMatchesResolved, Ht as ALPHA2_DSHMARKET_139_HOST_PACKAGES, I as bindingSatisfies, In as extractMethod, Ir as SUPPORTED_EVIDENCE_ADAPTERS, It as extractToolSubject, J as hostLockRowsFromComposedDump, Jn as qualifyBoundary, Jr as digestStrings, Jt as ExecutableIdentity, K as HostProfileError, Kn as effectuateBoundary, Kr as validateActionTarget, Kt as DEFAULT_HOST_LOCK, L as evidenceCoverage, Ln as extractOperation, Lr as SemanticAction, Lt as isDeterministicCheck, M as proofEvidenceConstraints, Mn as captureClause, Mr as CERTIFICATE_VERSION, Mt as ToolResultInput, N as sessionQuery, Nn as captureItem, Nr as SEMANTIC_ACTIONS, Nt as ToolSubject, O as bindProofToProjection, On as certifyCheckpoint, Or as ACTION_MANIFEST, Ot as parseShellCommand, P as validateProofManifest, Pn as classifyClause, Pr as STATEFUL_ACTIONS, Pt as evidenceFromPersistedToolResult, Q as resolveActiveProfileHostLock, Qn as DeriveConfig, Qr as sha256, Qt as HOST_COHORTS, R as evidenceMatchesItem, Rn as isInformationalMessage, Rr as StatefulAction, Rt as withDurability, S as PROOF_PROTOCOL_VERSION, Sn as authorityCaptureCounts, Sr as TargetTuple, St as CanonicalCommandSurface, T as ProofObligation, Tn as classifyUserInteraction, Tr as WaitAuthorization, Tt as canonicalArgvFromCommand, U as OperationVerbEntry, Un as GoalActivationState, Ur as semanticActionFromCommand, Ut as ALPHA2_HOST_PACKAGES, V as CommandSurfaceManifest, Vn as BoundaryQualification, Vr as requestedTargetAuthorizesMutation, Vt as deriveProjection, W as validateManifest, Wn as GoalBoundaryAccess, Wr as semanticActionFromText, Wt as AuditedExecutable, X as packageRowsFromActiveGraph, Xn as BoundaryQualificationKind, Xr as sanitizeClauseText, Xt as GOAL_HOST_PACKAGES, Y as injectActiveProfileHostLock, Yn as BoundaryDisposition, Yr as normalizeClause, Yt as ExecutableIdentityBinding, Z as packageRowsFromPnpmLock, Zn as DeferAuthorization, Zr as sanitizeUrl, Zt as HOST_CAPABILITY_PACKAGE_GROUPS, _ as openItems, _n as selectHostCohort, _r as GuardProjection, _t as gitCommandMatchesTarget, a as classifyCompletionClaim, an as HostLockContext, ar as EvidenceRole, at as GitCommandParseResult, b as ALPHA3_HOST_PACKAGES, bn as AuthorityBlockKind, br as TargetCaptureReasonCode, bt as verifiedLinearCommitReadback, c as isWholeTaskCompletionClaim, cn as HostPlatform, cr as GoalRef, ct as GitEffectRunner, d as snapshotSessionEvents, dn as bindExecutableIdentity, dr as GuardEvidence, dt as GitTargetIdentity, en as HostCapabilityId, er as DeriveScope, et as verifyComposedHostLockDump, f as RC1_HOST_PACKAGES, fn as bindLiveGoalCapability, fr as GuardIntegrity, ft as LinearCommitReadback, g as closingHint, gn as evaluateToolSurfaceCapability, gr as GuardOperation, gt as executeRevalidatedGitEffect, h as RecoveryOptions, hn as evaluateHostLock, hr as GuardItemStatus, ht as createGitPrestateEnvelope, i as TurnStoppingDecision, in as HostCohortSelectionReason, ir as EvidenceParseStatus, it as GitCommandManifest, j as proofDigest, jn as ClauseSegment, jr as ActionSpec, jt as ToolCallInput, k as canonicalProjection, kn as CaptureScope, kr as ACTION_MANIFEST_VERSION, kt as goalCompletionDenial, l as latestAssistantText, ln as HostProfileKind, lr as GuardBoundary, lt as GitPrestateCheck, m as MIN_RECOVERY_CHAR_BUDGET, mn as evaluateHostCapability, mr as GuardItemKind, mt as commitTreeSnapshotDigest, n as AssistantOutcomeObservation, nn as HostCohort, nr as EvidenceBinding, nt as GitAdapterAction, o as decideTurnBoundary, on as HostLockEvaluation, or as ExpectedTransition, ot as GitCommandRejected, p as DEFAULT_RECOVERY_CHAR_BUDGET, pn as evaluateExternalWaitCapability, pr as GuardItem, pt as commitIndexSnapshotDigest, q as hostLockContextFromComposedDump, qn as isCurrentAcceptedBoundary, qr as canonicalizePath, qt as EXPECTED_HOST_PACKAGES, r as CompletionDisposition, rn as HostCohortSelection, rr as EvidenceOutcome, rt as GitCommandAccepted, s as decideTurnStopping, sn as HostLockStatus, sr as ExternalOperation, st as GitEffectExecution, t as supersedeItem, tn as HostCapabilityRequest, tr as DerivedEnvelope, tt as GIT_COMMAND_MANIFEST_IDS, u as observeAssistantOutcome, un as HostToolSurface, ur as GuardCheckpoint, ut as GitPrestateEnvelope, v as recoveryDigest, vn as currentContractDigest, vr as HostStatus, vt as parseGitCommandManifest, w as ProofManifest, wn as UserInteractionKind, wr as VerificationContract, wt as ShellParseStatus, x as PROOF_KINDS, xn as AuthorityKind, xr as TargetCaptureStatus, xt as CanonicalArgv, y as renderRecoveryPacket, yn as AuthorityBlock, yr as PersistenceAuthorization, yt as revalidateGitPrestate, z as isVerifyingCapability, zn as segmentClauses, zr as actionCompatible, zt as CAPTURE_V042_NOTICE } from "./index-DNF0OTi-.js";
+import { $ as ActiveProfileHostLock, $n as isFrozenV042RebindResponse, $r as VerificationContract, $t as Repairability, A as createProofManifest, Ai as semanticActionFromText, An as HostPlatform, Ar as DerivedEnvelope, At as parseGitCommandManifest, B as COMMAND_SURFACE_MANIFEST, Bn as selectHostCohort, Br as GuardEvidence, Bt as parseShellCommand, C as ProofKind, Ci as SemanticAction, Cn as HostCapabilityRequest, Cr as qualifyBoundary, Ct as GitTargetIdentity, D as SessionQuery, Di as requestedTargetAuthorizesMutation, Dn as HostLockContext, Dr as DeriveConfig, Dt as createGitPrestateEnvelope, E as ProofSurface, Ei as isStatefulAction, En as HostCohortSelectionReason, Er as DeferAuthorization, Et as commitTreeSnapshotDigest, F as EvidenceFacetCoverage, Fi as normalizeClause, Fn as bindLiveGoalCapability, Fr as ExpectedTransition, Ft as ParsedShell, G as ClaimedMessage, Gn as authorityCaptureCounts, Gr as GuardOperation, Gt as ToolSubject, H as ManifestIssue, Hn as AuthorityBlock, Hr as GuardItem, Ht as hasCurrentCertificate, I as bindingSatisfies, Ii as sanitizeClauseText, In as evaluateExternalWaitCapability, Ir as ExternalOperation, It as ShellParseStatus, J as FirstStepPreviewInput, Jn as UserInteractionKind, Jr as PersistenceAuthorization, Jt as extractToolSubject, K as FIRST_STEP_GUIDANCE, Kn as segmentAuthorityBlocks, Kr as GuardProjection, Kt as evidenceFromPersistedToolResult, L as evidenceCoverage, Li as sanitizeUrl, Ln as evaluateHostCapability, Lr as GoalRef, Lt as canonicalArgvFromCommand, M as proofEvidenceConstraints, Mi as validateActionTarget, Mn as HostToolSurface, Mr as EvidenceOutcome, Mt as verifiedLinearCommitReadback, N as sessionQuery, Ni as canonicalizePath, Nn as LEGACY_HOST_COHORTS, Nr as EvidenceParseStatus, Nt as CanonicalArgv, O as bindProofToProjection, Oi as requestedTargetMatchesResolved, On as HostLockEvaluation, Or as DeriveResult, Ot as executeRevalidatedGitEffect, P as validateProofManifest, Pi as digestStrings, Pn as bindExecutableIdentity, Pr as EvidenceRole, Pt as CanonicalCommandSurface, Q as previewFirstStepInjection, Qn as ParsedConfirmation, Qr as TargetValue, Qt as DiagnosisNextAction, R as evidenceMatchesItem, Ri as sha256, Rn as evaluateHostLock, Rr as GuardBoundary, Rt as isRunExecutable, S as PROOF_PROTOCOL_VERSION, Si as SUPPORTED_EVIDENCE_ADAPTERS, Sn as HostCapabilityId, Sr as isCurrentAcceptedBoundary, St as GitPrestateEnvelope, T as ProofObligation, Ti as actionCompatible, Tn as HostCohortSelection, Tr as BoundaryQualificationKind, Tt as commitIndexSnapshotDigest, U as OperationVerbEntry, Un as AuthorityBlockKind, Ur as GuardItemKind, Ut as ToolCallInput, V as CommandSurfaceManifest, Vn as currentContractDigest, Vr as GuardIntegrity, Vt as goalCompletionDenial, W as validateManifest, Wn as AuthorityKind, Wr as GuardItemStatus, Wt as ToolResultInput, X as claimedBatchHasRealRootInput, Xn as classifyUserInteraction, Xr as TargetCaptureStatus, Xt as withDurability, Y as LifecyclePhase, Yn as classifyTaskIntent, Yr as TargetCaptureReasonCode, Yt as isDeterministicCheck, Z as lifecyclePhase, Zn as CONFIRM_LINE_PATTERN, Zr as TargetTuple, Zt as CertificationSupport, _ as openItems, _i as ActionSpec, _n as ExecutableIdentityBinding, _r as BoundaryRequest, _t as GitCommandParseResult, a as classifyCompletionClaim, ai as RebindArgs, an as relevantEvidence, ar as ClassifiedClause, at as inspectTargetHostGraph, b as ALPHA3_HOST_PACKAGES, bi as STATEFUL_ACTIONS, bn as HOST_COHORTS, br as availableBoundaryQualifications, bt as GitEffectRunner, c as isWholeTaskCompletionClaim, ci as proposeRebind, cn as PROTOCOL_V4_NOTICE, cr as captureItem, ct as readActiveHostGraph, d as snapshotSessionEvents, di as rebindAttemptKey, dn as ALPHA2_HOST_PACKAGES, dr as extractMethod, dt as verifyComposedHostLockDump, ei as WaitAuthorization, en as TaskKind, er as parseConfirmationMessage, et as HostProfileError, f as RC1_HOST_PACKAGES, fi as rebindResponse, fn as AuditedExecutable, fr as extractOperation, ft as GIT_COMMAND_MANIFEST_IDS, g as closingHint, gi as ActionManifest, gn as ExecutableIdentity, gr as BoundaryQualification, gt as GitCommandManifest, h as RecoveryOptions, hi as ACTION_MANIFEST_VERSION, hn as EXPECTED_HOST_PACKAGES, hr as BoundaryEffectuation, ht as GitCommandAccepted, i as TurnStoppingDecision, ii as ProposeOutcome, in as itemDiagnosis, ir as CaptureScope, it as injectActiveProfileHostLock, j as proofDigest, ji as validateActionManifest, jn as HostProfileKind, jr as EvidenceBinding, jt as revalidateGitPrestate, k as canonicalProjection, ki as semanticActionFromCommand, kn as HostLockStatus, kr as DeriveScope, kt as gitCommandMatchesTarget, l as latestAssistantText, li as proposeRebindOutcome, ln as deriveProjection, lr as classifyClause, lt as resolveActiveProfileHostLock, m as MIN_RECOVERY_CHAR_BUDGET, mi as ACTION_MANIFEST, mn as DEFAULT_HOST_LOCK, mr as segmentClauses, mt as GitAdapterAction, n as AssistantOutcomeObservation, ni as PackageRow, nn as deriveItemDiagnosis, nr as RejectedBinding, nt as hostLockContextFromComposedDump, o as decideTurnBoundary, oi as RebindProposal, on as CAPTURE_V042_NOTICE, or as ClauseSegment, ot as packageRowsFromActiveGraph, p as DEFAULT_RECOVERY_CHAR_BUDGET, pi as replayRebindResult, pn as BASE_HOST_PACKAGES, pr as isInformationalMessage, pt as GIT_COMMAND_TEMPLATES, q as FirstStepInjection, qn as TaskIntent, qr as HostStatus, qt as extractTextContent, r as CompletionDisposition, ri as BoundedSource, rn as evidenceAvailabilityReason, rr as certifyCheckpoint, rt as hostLockRowsFromComposedDump, s as decideTurnStopping, si as confirmRebind, sn as PROTOCOL_V3_NOTICE, sr as captureClause, st as packageRowsFromPnpmLock, t as supersedeItem, ti as createProjection, tn as UnifiedItemDiagnosis, tr as CheckpointResult, tt as TargetHostGraph, u as observeAssistantOutcome, ui as proposeRebindV042, un as ALPHA2_DSHMARKET_139_HOST_PACKAGES, ur as extractArtifactPaths, ut as resolveInstalledHostLock, v as recoveryDigest, vi as CERTIFICATE_VERSION, vn as GOAL_HOST_PACKAGES, vr as GoalActivationState, vt as GitCommandRejected, w as ProofManifest, wi as StatefulAction, wn as HostCohort, wr as BoundaryDisposition, wt as LinearCommitReadback, x as PROOF_KINDS, xi as STOP_PROTOCOL_VERSION, xn as HostCapabilityEvaluation, xr as effectuateBoundary, xt as GitPrestateCheck, y as renderRecoveryPacket, yi as SEMANTIC_ACTIONS, yn as HOST_CAPABILITY_PACKAGE_GROUPS, yr as GoalBoundaryAccess, yt as GitEffectExecution, z as isVerifyingCapability, zn as evaluateToolSurfaceCapability, zr as GuardCheckpoint, zt as parsePwshCommand } from "./index-Cd3wXBLi.js";
 import "@deepseek-ai/dsh-tools";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
@@ -9,6 +9,9 @@ declare const Config: z<{
   hostLockPackages?: PackageRow[];
   hostLockPlatform?: HostPlatform;
   hostLockProfile?: HostProfileKind;
+  hostLockPolicy?: string;
+  hostLockRuntimeRoot?: string;
+  hostLockProfileRoot?: string;
 }>;
 //#endregion
 //#region src/runtime.d.ts
@@ -19,6 +22,9 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockPackages?: unknown;
   hostLockPlatform?: unknown;
   hostLockProfile?: unknown;
+  hostLockPolicy?: unknown;
+  hostLockRuntimeRoot?: unknown;
+  hostLockProfileRoot?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RC1_HOST_PACKAGES, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isFrozenV042RebindResponse, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, latestAssistantText, lifecyclePhase, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parsePwshCommand, parseShellCommand, previewFirstStepInjection, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };